CiscoPedia
Empowering the Internet Generation

Ciscopedia is a collection of commands that are taught in Cisco Networking Academy courses. It includes information on where, when, why, and how to use the commands. It also includes examples for simple configurations.

Print Formatting Conventions for IOS Commands

ip routing

interface type number

ip broadcast-address [ip-address mask]

ip address ip-address mask [secondary]

interface [type slot/port-adapter/port] [ethernet | serial]

queue-list list-number queue queue-number limit limit-number

access list access-list-number {deny | permit} source [source-wildcard]

show ip route [address [mask] | protocol]

Ciscopedia v3.0
Copyright Cisco Systems, Inc. 2001, 2002, 2003
World Wide Education


Command:

aaa accounting

Mode:

Router(config)#

Syntax:

aaa accounting {system | network | exec | connection | commands level | nested | suppress | update} {default | list-name} {start-stop | wait-start | stop-only | none} method1 [method2...]

no aaa accounting {system | network | exec | connection | commands level | nested | suppress | update}

Syntax Description:

system

Performs accounting for all system-level events not associated with users, such as reloads.

network

Runs accounting for all network-related service requests, including SLIP, PPP, PPP NCPs, and ARAP.

exec

To create a method list to provide accounting records about user EXEC terminal sessions on the network access server, including username, date, start, and stop times, use the exec keyword.

connection

Provides information about all outbound connections made from the network access server (NAS), such as Telnet, local-area transport (LAT), TN3270, packet assembler/disassembler (PAD), and rlogin.

commands

Runs accounting for all commands at the specified privilege level.

level

Specific command level to track for accounting. Valid entries are 0 through 15.

default

Uses the listed accounting methods that follow this argument as the default list of methods for accounting services.

list-name

Character string used to name the list of accounting methods.

start-stop

Sends a start accounting notice at the beginning of a process and a stop accounting notice at the end of a process. The start accounting record is sent in the background. The requested user process begins regardless of whether or not the start accounting notice was received by the accounting server.

wait-start

As in start-stop, sends both a start and a stop accounting notice to the accounting server. However, if the wait-start keyword is used, the requested user service does not begin until the start accounting notice is acknowledged. A stop accounting notice is also sent.

stop-only

Sends a stop accounting notice at the end of the requested user process.

none

Disables accounting services on this line or interface.

resource

Provides start and stop records for calls that have passed user authentication, and provides stop records for calls that fail to authenticate

nested

Provides accounting when starting PPP from EXEC, generate NETWORK records before EXEC-STOP record.

update

Enables periodic interim accounting records to be sent to the accounting server.

method1 [method2...]

At least one of the keywords described in the table below.

Command Description:

To enable AAA accounting of requested services for billing or security purposes when using RADIUS or TACACS+, use the aaa accounting global configuration command. Use the no form of this command to disable accounting.

This command first appeared in Cisco IOS Release 10.3.

Use the aaa accounting command to enable accounting and to create named method lists defining specific accounting methods on a per-line or per-interface basis. Method keywords are described in the table.

Table: AAA Accounting Methods

Keyword Description

group radius

Uses the list of all RADIUS servers to provide accounting services

group tacacs+

Uses the list of all TACACS+ servers to provide accounting services.

group | group-name

Uses a subset of RADIUS or TACACS+ servers for accounting as defined by the server group group-name.

Cisco IOS software supports the following two methods for accounting:

  • group TACACS+---The network access server reports user activity to the TACACS+ security servers in the form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server.
  • group RADIUS---The network access server reports user activity to the RADIUS security servers in the form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server.

Method lists for accounting define the way accounting will be performed. Named accounting method lists enables the option to designate a particular security protocol to be used on specific lines or interfaces for particular types of accounting services. Create a list by entering the list-name and the method, where list-name is any character string used to name this list (excluding the names of methods, such as radius or tacacs+) and method identifies the method(s) tried in the given sequence.

Named accounting method lists are specific to the indicated type of accounting. To create a method list to provide accounting information for ARAP (network) sessions, use the arap keyword. To create a method list to provide accounting records about user EXEC terminal sessions on the network access server, including username, date, start and stop times, use the exec keyword. To create a method list to provide accounting information about specific, individual EXEC commands associated with a specific privilege level, use the commands keyword. To create a method list to provide accounting information about all outbound connections made from the network access server, use the connection keyword.

Note System accounting does not use named accounting lists; only the default list for system accounting can be defined.

For minimal accounting, include the stop-only keyword to send a stop record accounting notice at the end of the requested user process. For more accounting, include the start-stop keyword, so that RADIUS or TACACS+ sends a start accounting notice at the beginning of the requested process and a stop accounting notice at the end of the process. For even more accounting control, include the wait-start keyword, which ensures that the start notice is received by the RADIUS or TACACS+ server before granting the user's process request. Accounting is stored only on the RADIUS or TACACS+ server. The none keyword disables accounting services for the specified line or interface.

When aaa accounting is activated, the network access server monitors either RADIUS accounting attributes or TACACS+ AV pairs pertinent to the connection, depending on the security method implemented. The network access server reports these attributes as accounting records, which are then stored in an accounting log on the security server. For a list of supported RADIUS accounting attributes, refer to the "RADIUS Attributes" appendix in the Security Configuration Guide. For a list of supported TACACS+ accounting AV pairs, refer to the "TACACS+ Attribute-Value Pairs" appendix in the Security Configuration Guide.

Example:

In the following example, a default commands accounting method list is defined, where commands accounting services are provided by a TACACS+ security server, set for privilege level 15 commands with a stop-only restriction.

Router(config)#aaa accounting commands 15 default stop-only group tacacs+

Misconceptions:

This command can be used with TACACS or extended TACACS.

Related Commands:

aaa authorization

aaa new-model

© Cisco Systems, Inc. 2001, 2002, 2003


Command:

aaa authentication arap

Mode:

Router(config)#

Syntax:

aaa authentication arap {default  | list-name} method1 [method2...]

no aaa authentication arap {default  | list-name} method1 [method2...]

Syntax Description:

default

Uses the listed methods that follow this argument as the default list of methods when a user logs in.

list-name

Character string used to name the following list of authentication methods tried when a user logs in.

method

One of the keywords described in the table: aaa authentication arap Methods.

Command Description:

To enable an AAA authentication method for AppleTalk Remote Access (ARA) using TACACS+, use the aaa authentication arap global configuration command. Use the no form of this command to disable this authentication.

Usage Guidelines

The list names and default that are set with the aaa authentication arap command are used with the arap authentication command. Note that ARAP guest logins are disabled by default when AAA is enabled. To allow guest logins, either the guest or auth-guest method listed in the table must be used. Only one of these methods must be used, they are mutually exclusive.

Create a list by entering the aaa authentication arap list-name method command, where list-name is any character string used to name this list (such as MIS-access). The method# arguments identify the list of methods the authentication algorithm tries in the given sequence. For descriptions of method keywords, see Table: aaa authentication arap Methods.

If no list is specified on an interface or line with the arap authentication command, a default list to be used can be specified with the default keyword followed by the methods.

The additional methods of authentication are used only if the previous method returns an error, not if it fails.

Use the show running-config command to view currently configured lists of authentication methods.

Table: aaa authentication arap Methods

Keyword

Description

guest

Allows guest logins. This method must be the first method listed, but it can be followed by other methods if it does not succeed.

auth-guest

Allows guest logins only if the user has already logged in to EXEC. This method must be the first method listed, but can be followed by other methods if it does not succeed.

line

Uses the line password for authentication.

local

Uses the local username database for authentication.

group

Uses a group of TACACS+, RADIUS, or named server group for authentication.

local-case

Uses case-sensitive local username authentication.

Example

The following example creates a list called MIS-access, which first tries TACACS+ authentication and then none:

Router(config)#aaa authentication arap MIS-access group tacacs+ none

The following example creates the same list, but sets it as the default list that is used for all ARA protocol authentications if no other list is specified:

Router(config)#aaa authentication arap default group tacacs+ none

Misconceptions:

This command can be used with TACACS or extended TACACS.

Related Commands:

aaa new-model


Command:

aaa authentication enable default

Mode:

Router(config)#

Syntax:

aaa authentication enable default method1 [method2...]

no aaa authentication enable default method1 [method2...]

Syntax Description:

method

At least one of the keywords described in the table below.

Command Description:

To enable AAA authentication to determine if a user can access the privileged command level, use the aaa authentication enable default global configuration command. Use the no form of this command to disable this authorization method.

Usage Guidelines

Use the aaa authentication enable default command to create a series of authentication methods that are used to determine whether a user can access the privileged command level. Method keywords are described in the table below. The additional methods of authentication are used only if the previous method returns an error, not if it fails. To specify that the authentication should succeed even if all methods return an error, specify none as the final method in the command line.

If a default authentication routine is not set for a function, the default is none and no authentication is performed. Use the show running-config command to view currently configured lists of authentication methods.

Table: aaa authentication enable Default Methods

Keyword

Description

enable

Uses the enable password for authentication.

line

Uses the line password for authentication.

none

Uses no authentication.

group tacacs+

Uses the list of all TACACS+ to provide authentication services.

group radius

Uses the list of all RADIUS to provide authentication services.

group | group-name

Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the server group group-name.

Example:

The following example creates an authentication list that first tries to contact a TACACS+ server. If no server can be found, AAA tries to use the enable password. If this attempt also returns an error (because no enable password is configured on the server), the user is allowed access with no authentication.

Router(config)#aaa authentication enable default group tacacs+ enable none

Misconceptions:

The additional methods of authentication are used if the previous method fails.

Related Commands:

aaa authorization

aaa new-model

enable password


Command:

aaa authentication login

Mode:

Router(config)#

Syntax:

aaa authentication login {default  | list-name} method1 [method2...]

no aaa authentication login {default  | list-name} method1 [method2...]

Syntax Description:

default

Uses the listed authentication methods that follow this argument as the default list of methods when a user logs in.

list-name

Character string used to name the following list of authentication methods activated when a user logs in.

method

At least one of the keywords described in the table: aaa authentication login Methods.

Command Description:

To set AAA authentication at login, use the aaa authentication login global configuration command. Use the no form of this command to disable AAA authentication.

Usage Guidelines

The default and optional list names created with the aaa authentication login command are used with the login authentication command.

Create a list by entering the aaa authentication login list-name method command for a particular protocol, where list-name is any character string used to name this list (such as MIS-access). The method argument identifies the list of methods that the authentication algorithm tries, in the given sequence. Method keywords are described in the table.

If no list is specified on an interface with the login authentication command, a default list to be used can be specified with the default keyword followed by the methods.

The additional methods of authentication are used only if the previous method returns an error, not if it fails. To ensure that the authentication succeeds even if all methods return an error, specify none as the final method in the command line.

If authentication is not specifically set for a line, the default is to deny access and no authentication is performed. Use the show running-config command to display currently configured lists of authentication methods.

Table: aaa authentication login Methods

Keyword

Description

enable

Uses the enable password for authentication.

krb5

Uses Kerberos 5 for authentication.

line

Uses the line password for authentication.

local

Uses the local username database for authentication.

none

Uses no authentication.

group radius

Uses the list of all RADIUS to provide authentication services.

group tacacs+

Uses the list of all TACACS+ to provide authentication services.

krb5-telnet

Uses Kerberos 5 Telnet authentication protocol when using Telnet to connect to the router.

group | group-name

Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the server group group-name.

local-case

Uses case-sensitive local username authentication

This command cannot be used with TACACS or extended TACACS.

Examples:

The following example creates an AAA authentication list called MIS-access. This authentication first tries to contact a TACACS+ server. If no server is found, TACACS+ returns an error and AAA tries to use the enable password. If this attempt also returns an error (because no enable password is configured on the server), the user is allowed access with no authentication.

Router(config)#aaa authentication login MIS-access group tacacs+ enable none

The following example creates the same list, but it sets it as the default list that is used for all login authentications if no other list is specified:

Router(config)#aaa authentication login default group tacacs+ enable none

The following example sets authentication at login to use the Kerberos 5 Telnet authentication protocol when using Telnet to connect to the router:

Router(config)#aaa authentication login default krb5-telnet krb5

Misconceptions:

None

Related Commands:

aaa new-model

login authentication


Command:

aaa authentication nasi

Mode:

Router(config)#

Syntax:

aaa authentication nasi {default  | list-name} method1 [method2...]

no aaa authentication nasi {default  | list-name} method1 [method2...]

Syntax Description:

default

Makes the listed authentication methods that follow this argument the default list of methods used when a user logs in.

list-name

Character string used to name the following list of authentication methods activated when a user logs in.

method1  [method2...]

At least one of the methods described in the table below.

Command Description:

To specify AAA authentication for Netware Asynchronous Services Interface (NASI) clients connecting through the access server, use the aaa authentication nasi global configuration command. Use the no form of this command to disable authentication for NASI clients.

Usage Guidelines

The default and optional list names created with the aaa authentication nasi command are used with the nasi authentication command.

Create a list by entering the aaa authentication nasi command, where list-name is any character string that names the list (such as MIS-access). The method argument identifies the list of methods the authentication algorithm tries in the given sequence. Method keywords are described in table below.

To create a default list that is used if no list is assigned to a line with the nasi authentication command, use the default argument followed by the methods that are desired in default situations.

The remaining methods of authentication are used only if the previous method returns an error, not if it fails. To ensure that the authentication succeeds even if all methods return an error, specify none as the final method in the command line.

If authentication is not specifically set for a line, the default is to deny access and no authentication is performed. Use the show running-config command to display currently configured lists of authentication methods.

Table: aaa authentication nasi Methods

Keyword

Description

enable

Uses the enable password for authentication.

local-case

Uses case-sensitive local username authentication.

line

Uses the line password for authentication.

local

Uses the local username database for authentication.

none

Uses no authentication.

group | group-name

Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the server group group-name.

group radius

Uses the list of all RADIUS to provide authentication service.

group tacacs+

Uses the list of all TACACS+ to provide authentication services.

This command cannot be used with TACACS or extended TACACS.

Examples:

The following example creates an AAA authentication list called list1. This authentication first tries to contact a TACACS+ server. If no server is found, TACACS+ returns an error and AAA tries to use the enable password. If this attempt also returns an error (because no enable password is configured on the server), the user is allowed access with no authentication.

Router(config)#aaa authentication nasi list1 group tacacs+ enable none

The following example creates the same list, but sets it as the default list that is used for all login authentications if no other list is specified:

Router(config)#aaa authentication nasi default group tacacs+ enable none

Misconceptions:

None

Related Commands:

None


Command:

aaa authentication password-prompt

Mode:

Router(config)#

Syntax:

aaa authentication password-prompt text-string

no aaa authentication password-prompt text-string

Syntax Description:

text-string

String of text that will be displayed when the user is prompted to enter a password. If this text-string contains spaces or unusual characters, it must be enclosed in double-quotes (for example, "Enter your password:").

Command Description:

To change the text displayed when users are prompted for a password, use the aaa authentication password-prompt global configuration command. Use the no form of this command to return to the default password prompt text.

Usage Guidelines

Use the aaa authentication password-prompt command to change the default text that the Cisco IOS software displays when prompting a user to enter a password. This command changes the password prompt for the enable password as well as for login passwords that are not supplied by remote security servers. The no form of this command returns the password prompt to the default value:

Password:

The aaa authentication password-prompt command does not change any dialog that is supplied by a remote TACACS+ or RADIUS server.

Example:

The following example changes the text for the password prompt:

 Router(config)#aaa authentication password-prompt
  "Enter your password now:"

Misconceptions:

None

Related Commands:

aaa authentication username-prompt

aaa new-model

enable password


Command:

aaa authentication ppp

Mode:

Router(config)#

Syntax:

aaa authentication ppp {default  | list-name} method1 [method2...]

no aaa authentication ppp {default  | list-name} method1 [method2...]

Syntax Description:

default

Uses the listed authentication methods that follow this argument as the default list of methods when a user logs in.

list-name

Character string used to name the following list of authentication methods tried when a user logs in.

method1  [method2...]

At least one of the keywords described in the table below.

Command Description:

To specify one or more AAA authentication methods for use on interfaces running Point-to-Point Protocol (PPP), use the aaa authentication ppp global configuration command. Use the no form of this command to disable authentication.

Usage Guidelines

The lists created with the aaa authentication ppp command are used with the ppp authentication command. These lists contain up to four authentication methods that are used when a user tries to log in to the serial interface.

Create a list by entering the aaa authentication ppp list-name method command, where list-name is any character string used to name this list (such as MIS-access). The method argument identifies the list of methods that the authentication algorithm tries in the given sequence. Up to four methods can be entered. Method keywords are described in table below.

The additional methods of authentication are only used if the previous method returns an error, not if it fails. Specify none as the final method in the command line to have authentication succeed even if all methods return an error.

If authentication is not specifically set for a function, the default is none and no authentication is performed. Use the show running-config command to display currently configured lists of authentication methods.

Table: aaa authentication ppp Methods

Keyword

Description

if-needed

Does not authenticate if user has already been authenticated on a TTY line

krb5

Uses Kerberos 5 for authentication (can only be used for PAP authentication)

local-case

Uses case-sensitive local username authentication

local

Uses the local username database for authentication

group | group-name

Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the server group group-name

none

Uses no authentication

group radius

Uses the list of all RADIUS to provide authentication service

group tacacs+

Uses the list of all TACACS+ to provide authentication service

This command cannot be used with TACACS or extended TACACS.

Example:

The following example creates an AAA authentication list called MIS-access for lines that use PPP. This authentication first tries to contact a TACACS+ server. If this action returns an error, the user is allowed access with no authentication.

Router(config)#aaa authentication ppp MIS-access group tacacs+ none

Misconceptions:

None

Related Commands:

aaa new-model

ppp authentication


Command:

aaa authentication username-prompt

Mode:

Router(config)#

Syntax:

aaa authentication username-prompt text-string

no aaa authentication username-prompt text-string

Syntax Description:

text-string

String of text that will be displayed when the user is prompted to enter a username. If this text-string contains spaces or unusual characters, it must be enclosed in double-quotes (for example, "Enter your name:").

Command Description:

To change the text displayed when users are prompted to enter a username, use the aaa authentication username-prompt global configuration command. Use the no form of this command to return to the default username prompt text.

Usage Guidelines

Use the aaa authentication username-prompt command to change the default text that the Cisco IOS software displays when prompting a user to enter a username. The no form of this command returns the username prompt to the default value:

Username:

Some protocols (for example, TACACS+) have the ability to override the use of local username prompt information. Using the aaa authentication username-prompt command will not change the username prompt text in these instances.

The aaa authentication username-prompt command does not change any dialog that is supplied by a remote TACACS+ server.

Example:

The following example changes the text for the username prompt:

Router(config)#aaa authentication username-prompt "Enter your name here:"

Misconceptions:

None

Related Commands:

aaa authentication password-prompt

aaa new-model

enable password


Command:

aaa authorization

Mode:

Router(config)#

Syntax:

aaa authorization {network | exec | commands level| reverse-access | configuration | config-commands | auth-proxy | ipmobile} {default | list-name} method1 [method2...]

no aaa authorization {network | exec | commands level| reverse-access | configuration | config-commands | auth-proxy | ipmobile}

Syntax Description:

auth-proxy

For Authentication Proxy Services.

network

Runs authorization for all network-related service requests, including SLIP, PPP, PPP NCPs, and ARAP.

exec

Runs authorization to determine if the user is allowed to run an EXEC shell.

commands

Runs authorization for all commands at the specified privilege level.

config-commands

For configuration mode commands.

configuration

Downloads the configuration from the AAA server.

ipmobile

For Mobile IP services.

level

Specific command level that should be authorized. Valid entries are 0 through 15.

reverse-access

Runs authorization for reverse access connections, such as reverse Telnet.

default

Uses the listed authorization methods that follow this argument as the default list of methods for authorization.

list-name

Character string used to name the list of authorization methods.

method1 [method2...]

One of the keywords listed in the table below.

Command Description:

Use the aaa authorization global configuration command to set parameters that restrict a user's network access. Use the no form of this command to disable authorization for a function. Use the aaa authorization command to enable authorization and to create named methods lists, defining authorization methods that can be used when a user accesses the specified function. Method lists for authorization define the ways authorization will be performed and the sequence in which these methods will be performed. A method list is simply a named list describing the authorization methods to be queried (such as RADIUS or TACACS+), in sequence. Method lists enable one or more security protocols to be used for authorization to be designated, thus ensuring a backup system in case the initial method fails. Cisco IOS software uses the first method listed to authorize users for specific network services; if that method fails to respond, the Cisco IOS software selects the next method listed in the method list. This process continues until there is successful communication with a listed authorization method, or all methods defined are exhausted.

Note The Cisco IOS software attempts authorization with the next listed method only when there is no response from the previous method. If authorization fails at any point in this cycle (meaning that the security server or local username database responds by denying the user services) the authorization process stops and no other authorization methods are attempted.

Use the aaa authorization command to create a list by entering the list-name and the method, where list-name is any character string used to name this list (excluding all method names) and method identifies the list of authorization method(s) tried in the given sequence.

Method keywords are described in the table below.

Table: AAA Authorization Methods

Keyword Description

group radius

Uses the list of all RADIUS to provide authorization service.

if-authenticated

Allows the user to access the requested function if the user is
authenticated.

None

No authorization is performed.

Local

Uses the local database for authorization.

group tacacs+

Uses the list of all TACACS+ to provide authorization services.

krb5-instance

Uses the instance defined by the kerberos instance map command.

Cisco IOS software supports the following six methods for authorization:

  • Group TACACS+---The network access server exchanges authorization information with the TACACS+ security daemon. TACACS+ authorization defines specific rights for users by associating attribute-value (AV) pairs, which are stored in a database on the TACACS+ security server, with the appropriate user.
  • If-Authenticated---The user is allowed to access the requested function provided the user has been authenticated successfully.
  • None---The network access server does not request authorization information. Authorization is not performed over this line/interface.
  • Local---The router or access server consults its local database, as defined by the username command, to authorize specific rights for users. Only a limited set of functions can be controlled via the local database.
  • Group RADIUS---The network access server requests authorization information from the RADIUS security server. RADIUS authorization defines specific rights for users by associating attributes, which are stored in a database on the RADIUS server.
  • Kerberos Instance Map---The network access server uses the instance defined by the kerberos instance map command for authorization.

Method lists are specific to the type of authorization being requested. AAA supports four different types of authorization:

  • Network---Applies to network connections. This can include a PPP, SLIP, or ARAP connection.
  • EXEC---Applies to the attributes associated with a user EXEC terminal session.
  • Commands---Applies to the EXEC mode commands a user issues. Command authorization attempts authorization for all EXEC mode commands, including global configuration commands, associated with a specific privilege level.
  • Reverse Access---Applies to reverse Telnet sessions.

When creating a named method list, a particular list of authorization methods for the indicated authorization type is defined. Once defined, method lists must be applied to specific lines or interfaces before any of the defined methods will be performed. The authorization command causes a request packet containing a series of AV pairs to be sent to the RADIUS or TACACS daemon as part of the authorization process. The daemon can do one of the following:

  • Accept the request as is
  • Make changes to the request
  • Refuse the request and refuse authorization

For a list of supported RADIUS attributes, refer to the "RADIUS Attributes" appendix in the Cisco IOS Release 11.3 Security Configuration Guide. For a list of supported TACACS+ AV pairs, refer to the "TACACS+ AV Pairs" appendix in the Cisco IOS Release 11.3 Security Configuration Guide.

Note There are five commands associated with privilege level 0; disable, enable, exit, help, and logout. If AAA authorization is configured for a privilege level greater than 0, these five commands will not be included in the privilege level command set.

Example:

The following example defines the network authorization method list named scoobee, which specifies that RADIUS authorization will be used on serial lines using PPP. If the RADIUS server fails to respond, then local network authorization will be performed.

Router(config)#aaa authorization network scoobee group radius local

Misconceptions:

This command can be used with TACACS or extended TACACS.

Related Commands:

aaa accounting

aaa new-model


 Command:

aaa new-model

Mode:

Router(config)#

Syntax:

aaa new-model

no aaa new-model

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the AAA access control model, issue the aaa new-model global configuration command. Use the no form of this command to disable the AAA access control model.

Example:

The following example initializes AAA:

Router(config)#aaa new-model

Misconceptions:

None

Related Commands:
aaa accounting
aaa authentication arap
aaa authentication enable default
aaa authentication login
aaa authentication ppp
aaa authorization


Command:

ip accounting mac-address

Mode:

Router(config-if)#

Syntax:

ip accounting mac-address {input | output}
no ip accounting mac-address {input | output}

Syntax Description:

input | Performs accounting based on the source MAC address on received packets.
output | Performs accounting based on the destination MAC address on transmitted packets.

Command Description:

To enable IP accounting on a LAN interface based on the source and destination MAC address, use the ip accounting mac-address command in interface configuration mode. To disable IP accounting based on the source and destination MAC address, use the no form of this command.

This command is disabled by default.

This feature is supported on Ethernet, FastEthernet, and FDDI interfaces.

To display the MAC accounting information, use the show interface mac EXEC command.

MAC address accounting provides accounting information for IP traffic based on the source and destination MAC address on LAN interfaces. This calculates the total packet and byte counts for a LAN interface that receives or sends IP packets to or from a unique MAC address. It also records a timestamp for the last packet received or sent. With MAC address accounting, you can determine how much traffic is being sent to and/or received from various peers at NAPS/peering points.

Example:

The following example enables IP accounting based on the source and destination MAC address for received and transmitted packets:

Router(config)#interface ethernet 4/0/0
Router(config-if)#ip accounting mac-address input
Router(config-if)#ip accounting mac-address output

Misconceptions:

None

Related Commands:

None


Command:

radius-server host

Mode:

Router(config)#

Syntax:

radius-server host {hostname | ip-address} [auth-port port-number] [acct-port port-number] [timeout seconds] [retransmit retries] [key string] [alias{hostname | ip-address}]

no radius-server host {hostname | ip-address} [auth-port port-number] [acct-port port-number] [timeout seconds] [retransmit retries] [key string]

Syntax Description:

hostname | DNS name of the RADIUS server host.
ip-address | IP address of the RADIUS server host.
auth-port | (Optional) Specifies the UDP destination port for authentication requests.
port-number | (Optional) Port number for authentication requests; the host is not used for authentication if set to 0.
acct-port | (Optional) Specifies the UDP destination port for accounting requests.
port-number | (Optional) Port number for accounting requests; the host is not used for accounting if set to 0.

Command Description:

To specify a RADIUS server host, use the radius-server host global configuration command. Use the no form of this command to delete the specified RADIUS host.

Usage Guidelines

Use multiple radius-server host commands to specify multiple hosts. The software searches for hosts in the order they are specified.

Example:

The following example specifies host1 as the RADIUS server and uses default ports for both accounting and authentication:

Router(config)#radius-server host host1.domain.com

The following example specifies port 12 as the destination port for authentication requests and port 16 as the destination port for accounting requests on a RADIUS host named host1:

Router(config)#radius-server host host1.domain.com auth-port 12 acct-port 16

Because entering a line resets all the port numbers, you must specify a host and configure accounting and authentication ports on a single line.

To use separate servers for accounting and authentication, use the zero port value as appropriate. The following example specifies that RADIUS server host1 be used for accounting but not for authentication, and that RADIUS server host2 be used for authentication but not for accounting:

Router(config)#radius-server host host1.domain.com auth-port 0
Router(config)#radius-server host host2.domain.com acct-port 0

Misconceptions:

None

Related Commands:

aaa accounting

aaa authentication

aaa authorization

ppp authentication

radius-server key

username


Command:

radius-server key

Mode:

Router(config)#

Syntax:

radius-server key {string}

no radius-server key

Syntax Description:

string

The key used to set authentication and encryption. This key must match the encryption used on the RADIUS daemon.

Command Description:

To set the authentication and encryption key for all RADIUS communications between the router and the RADIUS daemon, use the radius-server key global configuration command. Use the no form of this command to disable the key.

Usage Guidelines

After enabling AAA authentication with the aaa new-model command, the authentication and encryption key must be set using the radius-server key command.

The key entered must match the key used on the RADIUS daemon. All leading spaces are ignored, but spaces within and at the end of the key are used. If spaces are used in the key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.

Example:

The following example sets the authentication and encryption key to "dare to go":

Router(config)#radius-server key dare to go

Misconceptions:

None

Related Commands:

aaa new-model

ppp authentication

radius-server host

username


Command:

tacacs-server host

Mode:

Router(config)#

Syntax:

tacacs-server host hostname [single-connection ] [port integer] [timeout integer] [key string]

no tacacs-server host hostname

Syntax Description:

hostname  | Name or IP address of the host.
single-connection | (Optional) Specify that the router maintain a single open connection for confirmation from a AAA/TACACS+ server (CiscoSecure Release 1.0.1 or later). This command contains no autodetect and fails if the specified host is not running a CiscoSecure daemon.
port | (Optional) Specify a server port number. This option overrides the default, which is port 49.
integer | (Optional) Port number of the server. Valid port numbers range from 1 to 65535.
timeout | (Optional) Specify a timeout value. This overrides the global timeout value set with the tacacs-server timeout command for this server only.
integer | (Optional) Integer value, in seconds, of the timeout interval.
key | (Optional) Specify an authentication and encryption key. This must match the key used by the TACACS+ daemon. Specifying this key overrides the key set by the global command tacacs-server key for this server only.
string | (Optional) Character string specifying authentication and encryption key.

Command Description:

To specify a TACACS host, use the tacacs-server host global configuration command. Use the no form of this command to delete the specified name or address.

Usage Guidelines

Multiple tacacs-server host commands can be used to specify additional hosts. The Cisco IOS software searches for hosts in the order in which they are specified. Use the single-connection, port, timeout, and key options only when running a AAA/TACACS+ server.

Because some of the parameters of the tacacs-server host command override global settings made by the tacacs-server timeout and tacacs-server key commands, this command can be used to enhance security on a network by uniquely configuring individual TACACS+ connections.

Examples:

The following example specifies a TACACS host named Sea_Change:

Router(config)#tacacs-server host Sea_Change

The following example specifies that, for AAA confirmation, the router consult the CiscoSecure TACACS+ host named Sea_Cure on port number 51. The timeout value for requests on this connection is three seconds; the encryption key is a_secret.

Router(config)#tacacs-server host Sea_Cure single-connection port 51 timeout 3 key a_secret

Misconceptions:

None

Related commands:

tacacs-server key


 Command:

tacacs-server key

Mode:

Router(config)#

Syntax:

tacacs-server key key

no tacacs-server key [key]

Syntax Description:

key

Key used to set authentication and encryption. This key must match the key used on the TACACS+ daemon.

Command Description:

To set the authentication encryption key used for all TACACS+ communications between the access server and the TACACS+ daemon, use the tacacs-server key global configuration command. Use the no form of this command to disable the key.

Usage Guidelines

After enabling AAA with the aaa new-model command, the authentication and encryption key must be set using the tacacs-server key command.

The key entered must match the key used on the TACACS+ daemon. All leading spaces are ignored; spaces within and at the end of the key are not. If spaces are used in the key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.
Example:

The following example sets the authentication and encryption key to "dare to go":

Router(config)#tacacs-server key dare to go
Misconceptions:
None

Related commands:
aaa new-model
tacacs-server host


%command%

Command:

show tacacs

Mode:

Router#

Syntax:

show tacacs

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display statistics for a TACACS+ server, use the show tacacs command in EXEC configuration mode.

Example:

Router# show tacacs

Tacacs+ Server : 172.19.192.80/49

Socket opens: 3

Socket closes: 3

Socket aborts: 0

Socket errors: 0

Socket Timeouts: 0

Failed Connect Attempts: 0

Total Packets Sent: 7

Total Packets Recv: 7

Expected Replies: 0

No current connection

Field | Description
Tacacs+ Server | IP address of the TACACS+ server.
Socket opens | Number of successful TCP socket connections to the TACACS+ server.
Socket closes | Number of successfully closed TCP socket attempts.
Socket aborts | Number of premature TCP socket closures to the TACACS+ server; that is, the peer did not wait for a reply from the server after a the peer sent its request.
Socket errors | Any other socket read or write errors, such as incorrect packet format and length.
Failed Connect Attempts | Number of failed TCP socket connections to the TACACS+ server.
Total Packets Sent | Number of packets sent to the TACACS+ server.
Total Packets Recv | Number of packets received from the TACACS+ server.
Expected replies | Number of outstanding replies from the TACACS+ server.

Misconceptions:

None

Related commands:

aaa new-model

tacacs-server host

© Cisco Systems, Inc. 2001, 2002


Command:

absolute

Mode:

Router(config-time-range)#

Syntax:

absolute [start time date] [end time date]

no absolute

Syntax Description:

This command has no arguments or keywords.

Command Description:

To specify an absolute time when a time range is in effect, use the absolute time-range configuration command. To remove an absolute time-range, use the no form of the command.

Note All time specifications are interpreted as local time. To ensure that the time range entries take effect at the desired times, the software clock should be synchronized using the Network Time Protocol (NTP), or some other authoritative time source.

Example:

The following example defines a time range from 8:00 December 18, 2002 until 8:00 January 3, 2003:

Router(config-time-range)#absolute 8:00 18 december 2002 8:00 3 january 2003

Misconceptions:

None

Related Commands:

ip access-list extended

access-list

periodic

time-range


Command:

access-enable

Mode:

Router#

Syntax:

access-enable [host] [timeout minutes]

Syntax Description:

host

Tells the software to enable access only for the host from which the Telnet session originated. If not specified, the software allows all hosts on the defined network to gain access. The dynamic access list contains the network mask to use for enabling the new network.

timeout

Specifies an idle timeout for the temporary access list entry. If the access list entry is not accessed within this period, it is automatically deleted and requires the user to authenticate again. The default is for the entries to remain permanently.

Command Description:

To enable the router to create a temporary access list entry in a dynamic access list, use the access-enable privileged EXEC command. This command enables the lock-and-key access feature.

Always define either an idle timeout (with the timeout keyword in this command), or an absolute timeout (with the timeout keyword in the access-list command). Otherwise, the temporary access list entry will remain, even after the user terminates the session.

Use the autocommand command with the access-enable command to cause the access-enable command to execute when a user opens a Telnet session into the router.

Example:

The following example causes the software to create a temporary access list entry and tells the software to enable access only for the host from which the Telnet session originated. If the access list entry is not accessed within 5 minutes, it is deleted:

Router#access-enable host timeout 5

Misconceptions:

None

Related Commands:

dynamic

ip access-list extended

access-list


Command:

access-list (IP)

Mode:

Router(config)#

Syntax:

IP standard access-list: access-list access-list-number {deny | permit | remark line} source[source-wildcard] [log]

IP extended access-list: access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit | remark line } protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log | log-input][time-range name]

no access-list access-list-number

TCP extended access-list: access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit | remark line } tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator port [port]] [established] [precedence precedence] [tos tos] [log | log-input] [time-range name]

Syntax Description:

access-list-number

Number of an access list. This is a decimal number from 1 to 99 for IP standard and 100 to 199 or from 2000 to 2699 for IP extended.

dynamic dynamic-name

(Optional) Identifies this access list as a dynamic access list. Refer to lock-and-key access documented in the "Configuring Lock-and-Key Security (Dynamic Access Lists)" chapter in the Security Configuration Guide.

timeout minutes

(Optional) Specifies the absolute length of time (in minutes) that a temporary access list entry can remain in a dynamic access list. The default is an infinite length of time and allows an entry to remain permanently. Refer to lock-and-key access documented in the "Configuring Lock-and-Key Security (Dynamic Access Lists)" chapter in the Security Configuration Guide.

deny

Denies access if the conditions are matched.

permit

Permits access if the conditions are matched.

protocol

It can be one of the keywords ahp, eigrp, esp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, pcp, pim, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP) use the keyword ip. Some protocols allow further qualifiers described below.

source

Number of the network or host from which the packet is being sent. There are three alternative ways to specify the source:

· Use a 32-bit quantity in four-part, dotted-decimal format.

· Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255.

· Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

source-wildcard

Wildcard bits to be applied to source. Each wildcard bit set to zero indicates that the corresponding bit position in the packet's ip address must exactly match the bit value in the corresponding bit position in the source. Each wildcard bit set to one indicates that both a zero bit and a one bit in the corresponding position of the packet's ip address will be considered a match to this access list entry.

There are three alternative ways to specify the source wildcard:

· Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions to be ignored. For example, 0.0.255.255 to require an exact match of only the first 16 bits of the source.

· Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255.

· Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

Wildcard bits set to one do not need to be contiguous in the source-wildcard. For example, a source-wildcard of 0.255.0.64 would be valid.

destination

Number of the network or host to which the packet is being sent. There are three alternative ways to specify the destination:

· Use a 32-bit quantity in four-part, dotted-decimal format.

· Use the keyword any as an abbreviation for the destination and destination-wildcard of 0.0.0.0 255.255.255.255.

· Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

destination-wildcard

Wildcard bits to be applied to the destination. There are three alternative ways to specify the destination wildcard:

· Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions to be ignored.

· Use the keyword any as an abbreviation for a destination and destination-wildcard of 0.0.0.0 255.255.255.255.

· Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

precedence precedence

(Optional) Packets can be filtered by precedence level, as specified by a number from 0 to 7 or by name. The IP precedence is the three leftmost bits in the TOS octet of an IP header (as defined in RFCs 1349, 1812, 2474 & 2873). This may be set using the route map or policy map command set ip precedence. The precedence names are shown in the Command Usage section.

tos tos

(Optional) Packets can be filtered by type of service level, as specified by a number from 0 to 15 or by name. The TOS Field is bits 3-6 in the TOS octet of IPv4 header [RFC 1349].

icmp-type

(Optional) ICMP packets can be filtered by ICMP message type. The type is a number from 0 to 255. The type is identified in the first byte of the ICMP datagram and are defined by rfc 792.

icmp-code

(Optional) ICMP packets that are filtered by ICMP message type can also be filtered by the ICMP message code. The code is a number from 0 to 255. The code is identified in the second byte of the ICMP datagram and are defined by rfc 792.

icmp-message

(Optional) ICMP packets can be filtered by an ICMP message type name or ICMP message type and code name. The possible names are found in the section "Usage Guidelines."

igmp-type or igmp-message

(Optional) IGMP packets can be filtered by IGMP message type or message name. A message type is a number from 0 to 15. IGMP message names are listed in the section "Usage Guidelines."

operator

(Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).

If the operator is positioned after the source and source-wildcard, it must match the source port.

If the operator is positioned after the destination and destination-wildcard, it must match the destination port.

The range operator requires two port numbers. All other operators require one port number.

port

(Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535. TCP port names are listed in the section "Usage Guidelines." TCP port names can only be used when filtering TCP. UDP port names are listed in the section "Usage Guidelines." UDP port names can only be used when filtering UDP.

TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP.

established

(Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection.

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.

The logging facility might drop some logging message packets if there are too many to be handled or if there is more than one logging message to be handled in 1 second. This behavior prevents the router from crashing due to too many logging packets. Therefore, the logging facility should not be used as a billing tool or an accurate source of the number of matches to an access list.

log-input

(Optional) Includes the input interface and source MAC address or VC in the logging output.

Command Description:

To define an access-control list, use the access-list global configuration command. To remove a standard access lists, use the no form of this command. Plan the access conditions carefully and be aware of the implicit "deny all" statement at the end of the access list. Access lists can be used to control the transmission of packets on an interface, control virtual terminal line access, and restrict the contents of routing updates.

Usage Guidelines

Note After an access list is created initially, any subsequent additions (possibly entered from the terminal) are placed at the end of the list. In other words, access list command lines cannot be selectively added or removed from a specific access list.

The following is a list of precedence names:

critical
flash
flash-override
immediate
internet
network
priority
routine

The following is a list of type of service (TOS) names:

max-reliability
max-throughput
min-delay
min-monetary-cost
normal

The following is a list of TCP port names that can be used instead of port numbers. Refer to the current Assigned Numbers RFC to find a reference to these protocols. Port numbers corresponding to these protocols can also be found by typing a ? in the place of a port number.

bgp
chargen
daytime
discard
domain
echo
finger
ftp
ftp-data
gopher
hostname
irc
klogin
kshell
lpd
nntp
pop2
pop3
smtp
sunrpc
syslog
tacacs-ds
talk
telnet
time
uucp
whois
www

Example:

The following example creates standard IP access-list 1, which will permit all traffic from network 171.0.0.0:

Router(config)# access-list 1 permit 171.0.0.0 0.0.255.255

The following IP standard access control list command defines an entry in access list 1 that permits all IP traffic from host 192.168.4.2:

Router(config)# access-list 1 permit 192.168.4.2 0.0.0.0

Misconceptions:

None

Related Commands:

ip access-group


Command:

access-list (IP extended)

Mode:

Router(config)#

Syntax:

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit} protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log | log-input]

no access-list access-list-number

Internet Control Message Protocol (ICMP)

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit} icmp source source-wildcard destination destination-wildcard [icmp-type | [[icmp-type icmp-code] | [icmp-message]] [precedence precedence] [tos tos] [log | log-input]

Internet Group Management Protocol (IGMP)

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit} igmp source source-wildcard destination destination-wildcard [igmp-type] [precedence precedence] [tos tos] [log | log-input]

TCP

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit} tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator port [port]] [established] [precedence precedence] [tos tos] [log | log-input]

User Datagram Protocol (UDP)

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit} udp source source-wildcard [operator port [port]] destination destination-wildcard [operator port [port]] [precedence precedence] [tos tos] [log | log-input]

Caution Enhancements to this command are backward compatible. Migrating from releases prior to Release 11.1 will convert access lists automatically. However, releases prior to Release 11.1 are not upwardly compatible with these enhancements. Therefore, if an access list is saved with these images and then used on software prior to Release 11.1, the resulting access list will not be interpreted correctly. This could cause severe security problems. Save old configuration file before booting these images.

Syntax Description:

access-list-number

Number of an access list. This is a decimal number from 1 to 99 for IP standard, and 100 to 199 for IP extended, or from 1000 to 1099 for IP SAP.

dynamic dynamic-name

(Optional) Identifies this access list as a dynamic access list. Refer to lock-and-key access documented in the "Configuring Lock-and-Key Security (Dynamic Access Lists)" chapter in the Security Configuration Guide.

timeout minutes

(Optional) Specifies the absolute length of time (in minutes) that a temporary access list entry can remain in a dynamic access list. The default is an infinite length of time and allows an entry to remain permanently. Refer to lock-and-key access documented in the "Configuring Lock-and-Key Security (Dynamic Access Lists)" chapter in the Security Configuration Guide.

deny

Denies access if the conditions are matched.

permit

Permits access if the conditions are matched.

protocol

Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, pim, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP) use the keyword ip. Some protocols allow further qualifiers described below.

source

Number of the network or host from which the packet is being sent. There are three alternative ways to specify the source:

  • Use a 32-bit quantity in four-part, dotted-decimal format.
  • Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255.
  • Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

source-wildcard

Wildcard bits to be applied to source. Each wildcard bit set to zero indicates that the corresponding bit position in the packet's ip address must exactly match the bit value in the corresponding bit position in the source. Each wildcard bit set to one indicates that both a zero bit and a one bit in the corresponding position of the packet's ip address will be considered a match to this access list entry.

There are three alternative ways to specify the source wildcard:

  • Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions to be ignored. For example, 0.0.255.255 to require an exact match of only the first 16 bits of the source.
  • Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255.
  • Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

Wildcard bits set to one do not need to be contiguous in the source-wildcard. For example, a source-wildcard of 0.255.0.64 would be valid.

destination

Number of the network or host to which the packet is being sent. There are three alternative ways to specify the destination:

  • Use a 32-bit quantity in four-part, dotted-decimal format.
  • Use the keyword any as an abbreviation for the destination and destination-wildcard of 0.0.0.0 255.255.255.255.
  • Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

destination-wildcard

Wildcard bits to be applied to the destination. There are three alternative ways to specify the destination wildcard:

  • Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions to be ignored.
  • Use the keyword any as an abbreviation for a destination and destination-wildcard of 0.0.0.0 255.255.255.255.
  • Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

precedence precedence

(Optional) Packets can be filtered by precedence level, as specified by a number from 0 to 7 or by name as listed in the section "Usage Guidelines."

tos tos

(Optional) Packets can be filtered by type of service level, as specified by a number from 0 to 15 or by name as listed in the section "Usage Guidelines."

icmp-type

(Optional) ICMP packets can be filtered by ICMP message type. The type is a number from 0 to 255.

icmp-code

(Optional) ICMP packets that are filtered by ICMP message type can also be filtered by the ICMP message code. The code is a number from 0 to 255.

icmp-message

(Optional) ICMP packets can be filtered by an ICMP message type name or ICMP message type and code name. The possible names are found in the section "Usage Guidelines."

igmp-type

(Optional) IGMP packets can be filtered by IGMP message type or message name. A message type is a number from 0 to 15. IGMP message names are listed in the section "Usage Guidelines."

operator

(Optional) Compares source or destination ports. Possible operands include; lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).

If the operator is positioned after the source and source-wildcard, it must match the source port.

If the operator is positioned after the destination and destination-wildcard, it must match the destination port.

The range operator requires two port numbers. All other operators require one port number.

port

(Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535. TCP port names are listed in the section "Usage Guidelines." TCP port names can only be used when filtering TCP. UDP port names are listed in the section "Usage Guidelines." UDP port names can only be used when filtering UDP.

TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP.

established

(Optional) For the TCP protocol only. Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection.

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.

The logging facility might drop some logging message packets if there are too many to be handled or if there is more than one logging message to be handled in 1 second. This behavior prevents the router from crashing due to too many logging packets. Therefore, the logging facility should not be used as a billing tool or an accurate source of the number of matches to an access list.

log-input

(Optional) Log matches against this entry, including input interface.

Command Description:

To define an extended IP access list, use the extended version of the access-list global configuration command. Access lists can be used to control the transmission of packets on an interface, control virtual terminal line access, and restrict contents of routing updates. The Cisco IOS software stops checking the extended access list after a match occurs.

Fragmented IP packets, other than the initial fragment, are immediately accepted by any extended IP access list. Extended access lists used to control virtual terminal line access or restrict contents of routing updates must not match against the TCP source port, the type of service value, or the packet's precedence.

Note After an access list is created initially, any subsequent additions (possibly entered from the terminal) are placed at the end of the list. In other words, access list command lines cannot be selectively added or removed from a specific access list.

The following is a list of precedence names:

  • Critical
  • flash
  • flash-override
  • immediate
  • internet
  • network
  • priority
  • routine

The following is a list of type of service (TOS) names:

  • max-reliability
  • max-throughput
  • min-delay
  • min-monetary-cost
  • normal

The following is a list of ICMP message type names and ICMP message type and code names:

  • administratively-prohibited
  • alternate-address
  • conversion-error
  • dod-host-prohibited
  • dod-net-prohibited
  • echo
  • echo-reply
  • general-parameter-problem
  • host-isolated
  • host-precedence-unreachable
  • host-redirect
  • host-tos-redirect
  • host-tos-unreachable
  • host-unknown
  • host-unreachable
  • information-reply
  • information-request
  • mask-reply
  • mask-request
  • mobile-redirect
  • net-redirect
  • net-tos-redirect
  • net-tos-unreachable
  • net-unreachable
  • network-unknown
  • no-room-for-option
  • option-missing
  • packet-too-big
  • parameter-problem
  • port-unreachable
  • precedence-unreachable
  • protocol-unreachable
  • reassembly-timeout
  • redirect
  • router-advertisement
  • router-solicitation
  • source-quench
  • source-route-failed
  • time-exceeded
  • timestamp-reply
  • timestamp-request
  • traceroute
  • ttl-exceeded
  • unreachable

The following is a list of IGMP message names:

  • dvmrp
  • host-query
  • host-report
  • pim
  • trace

The following is a list of TCP port names that can be used instead of port numbers. Refer to the current Assigned Numbers RFC to find a reference to these protocols. Port numbers corresponding to these protocols can also be found by typing a ? in the place of a port number.

  • bgp
  • chargen
  • daytime
  • discard
  • domain
  • echo
  • finger
  • ftp
  • ftp-data
  • gopher
  • hostname
  • irc
  • klogin
  • kshell
  • lpd
  • nntp
  • pop2
  • pop3
  • smtp
  • sunrpc
  • syslog
  • tacacs-ds
  • talk
  • telnet
  • time
  • uucp
  • whois
  • www

The following is a list of UDP port names that can be used instead of port numbers. Refer to the current Assigned Numbers RFC to find a reference to these protocols. Port numbers corresponding to these protocols can also be found by typing a ? in the place of a port number.

  • biff
  • bootpc
  • bootps
  • discard
  • dns
  • dnsix
  • echo
  • mobile-ip
  • nameserver
  • netbios-dgm
  • netbios-ns
  • ntp
  • rip
  • snmp
  • snmptrap
  • sunrpc
  • syslog
  • tacacs-ds
  • talk
  • tftp
  • time
  • who
  • xdmcp

Examples:

In the following example, serial interface 0 is part of a Class B network with the address 128.88.0.0, and the mail host's address is 128.88.1.2. The keyword established is used only for the TCP protocol to indicate an established connection. A match occurs if the TCP datagram has the ACK or RST bits set, which indicate that the packet belongs to an existing connection.

Router(config)#access-list 102 permit tcp 0.0.0.0 255.255.255.255 128.88.0.0 0.0.255.255 established
Router(config)#access-list 102 permit tcp 0.0.0.0 255.255.255.255 128.88.1.2 0.0.0.0 eq 25
Router(config)#interface serial 0
Router(config-if)#ip access-group 102 in

The following example also permits Domain Naming System (DNS) packets and ICMP echo and echo reply packets:

Router(config)#access-list 102 permit tcp any 128.88.0.0 0.0.255.255 established
Router(config)#access-list 102 permit tcp any host 128.88.1.2 eq smtp
Router(config)#access-list 102 permit tcp any any eq domain
Router(config)#access-list 102 permit udp any any eq domain
Router(config)#access-list 102 permit icmp any any echo
Router(config)#access-list 102 permit icmp any any echo-reply

The following examples show how wildcard bits are used to indicate the bits of the prefix or mask that are relevant. They are similar to the bitmasks that are used with normal access lists. Prefix/mask bits corresponding to wildcard bits set to 1 are ignored during comparisons and prefix/mask bits corresponding to wildcard bits set to 0 are used in comparison.

In the following example, permit 192.108.0.0 255.255.0.0 but deny any more specific routes of 192.108.0.0 (including 192.108.0.0 255.255.255.0).

Router(config)#access-list 101 permit ip 192.108.0.0  0.0.0.0   255.255.0.0  0.0.0.0

Router(config)#access-list 101 deny ip 192.108.0.0  0.0.255.255  255.255.0.0  0.0.255.255

In the following example, permit 131.108.0/24 but deny 131.108/16 and all other subnets of 131.108.0.0.

Router(config)#access-list 101 permit ip 131.108.0.0  0.0.0.0  255.255.255.0  0.0.0.0
Router(config)#access-list 101 deny ip 131.108.0.0  0.0.255.255  255.255.0.0  0.0.255.255

Misconceptions:

None

Related Commands:

access-list

access-list (IPX standard)

access-list (IPX extended)

ip access-group


Command:

access-list (IPX extended)

Mode:

Router(config)#

Syntax:

access-list access-list-number {deny | permit} {protocol} [source-network | source-net.node-address | source-net.node-address source-network.node-mask | source-net.node-address source-node-mask] [source-socket] [destination-network | destination-network.destination-node | destination-network.destination-node destination-node-mask | destination-network.destination-node destination-network-mask.destination-node-mask]
[destination-socket] [log] [time-range time-range]

no access-list access-list-number {deny | permit} {protocol} [source-network | source-net.node-address | source-net node-address source-network.node-mask | source-net.node-address source-node-mask] [source-socket] [destination-network | destination-network.destination-node | destination-network.destination-node destination-node-mask | destination-network.destination-node destination-network-mask.destination-node-mask] [destination-socket] [log] [time-range time-range]

Syntax Description:

access-list-number

Number of the access list. This is a number from 900 to 999.

deny

Denies access if the conditions are matched.

permit

Permits access if the conditions are matched.

protocol

Name or number of an IPX protocol type. This is sometimes referred to as the packet type. The table in the "Usage Guidelines" section lists some IPX protocol names and numbers.

source-network

(Optional) Number of the network from which the packet is being sent. This is an eight-digit hexadecimal number that uniquely identifies a network cable segment. It can be a number in the range 1 to FFFFFFFE. A network number of 0 matches the local network. A network number of -1 matches all networks.

Leading zeros do not need to be specified in the network number. For example, for the network number 000000AA, simply enter AA.

source-node

(Optional) Node on source-network from which the packet is being sent. This is a 48-bit value represented by a dotted triplet of four-digit hexadecimal numbers (xxxx.xxxx.xxxx).

source-node-mask

(Optional) Mask to be applied to source-node. This is a 48-bit value represented as a dotted triplet of four-digit hexadecimal numbers (xxxx.xxxx.xxxx). Place ones in the bit positions to be masked.

source-network-mask

(Optional) Mask to be applied to source-network. This is an eight-digit hexadecimal mask. Place ones in the bit positions to be masked.

The mask must immediately be followed by a period, which must in turn immediately be followed by source-node-mask.

source-socket

(Optional) Socket name or number (hexadecimal) from which the packet is being sent. Table in the "Usage Guidelines" section lists some IPX socket names and numbers.

destination-network

(Optional) Number of the network to which the packet is being sent. This is an eight-digit hexadecimal number that uniquely identifies a network cable segment. It can be a number in the range 1 to FFFFFFFE. A network number of 0 matches the local network. A network number of -1 matches all networks.

Leading zeros do not need to be specified in the network number. For example, for the network number 000000AA, simply enter AA.

destination-node

(Optional) Node on destination-network to which the packet is being sent. This is a 48-bit value represented by a dotted triplet of four-digit hexadecimal numbers (xxxx.xxxx.xxxx).

destination-node-mask

(Optional) Mask to be applied to destination-node. This is a 48-bit value represented as a dotted triplet of four-digit hexadecimal numbers (xxxx.xxxx.xxxx). Place ones in the bit positions to be masked.

destination-network-mask.

(Optional) Mask to be applied to destination-network. This is an eight-digit hexadecimal mask. Place ones in the bit positions to be masked.

The mask must immediately be followed by a period, which must in turn immediately be followed by destination-node-mask.

destination-socket

(Optional) Socket name or number (hexadecimal) to which the packet is being sent. Table in the "Usage Guidelines" section lists some IPX socket names and numbers.

log

(Optional) Logs IPX access control list violations whenever a packet matches a particular access list entry. The information logged includes source address, destination address, source socket, destination socket, protocol type, and action taken (permit/deny).

Command Description:

To define an extended Novell IPX access list, use the extended version of the access-list global configuration command. To remove an extended access list, use the no form of this command.

Extended IPX access lists filter on protocol type. All other parameters are optional.

If a network mask is used, all other fields are required.

Use the ipx access-group command to assign an access list to an interface. Only one extended or one standard access list can be applied to an interface. The access list filters all outgoing packets on the interface.

Note For some versions of NetWare, the protocol type field is not a reliable indicator of the type of packet encapsulated by the IPX header. In these cases, use the source and destination socket fields to make this determination. For additional information, contact Novell.

Table lists some IPX protocol names and numbers. Table lists some IPX socket names and numbers. For additional information about IPX protocol numbers and socket numbers, contact Novell.

Table: Some IPX Protocol Names and Numbers

IPX Protocol Name IPX Protocol Number (Decimal) Protocol (Packet Type)

-1

any

Wildcard; matches any packet type in 900 lists

0

Undefined; refer to the socket number to determine the packet type

1

rip

Routing Information Protocol (RIP)

4

sap

Service Advertising Protocol (SAP)

5

spx

Sequenced Packet Exchange (SPX)

17

ncp

NetWare Core Protocol (NCP)

20

netbios

IPX NetBIOS

Table: Some IPX Socket Names and Numbers

IPX Socket Number (Hexadecimal) IPX Socket Name

Socket

0

all

All sockets, wildcard used to match all sockets

2

cping

Cisco IPX ping packet

451

ncp

NetWare Core Protocol (NCP) process

452

sap

Service Advertising Protocol (SAP) process

453

rip

Routing Information Protocol (RIP) process

455

netbios

Novell NetBIOS process

456

diagnostic

Novell diagnostic packet

457

Novell serialization socket

4000-7FFF

Dynamic sockets; used by workstations for interaction with file servers and other network servers

8000-FFFF

Sockets as assigned by Novell, Inc.

85BE

eigrp

IPX Enhanced Interior Gateway Routing Protocol (EIGRP)

9001

nlsp

NetWare Link Services Protocol

9086

nping

Novell standard ping packet

To delete an extended access list, specify the minimum number of keywords and arguments needed to delete the proper access list. For example, to delete the entire access list, use the following command:

Router(config)#no access-list access-list-number

To delete the access list for a specific protocol, use the following command:

     Router(config)#no access-list access-list-number {deny | permit} protocol

Examples:

The following example denies access to all RIP packets from the RIP process socket on source network 1 that are destined for the RIP process socket on network 2. It permits all other traffic. This example uses protocol and socket names rather than hexadecimal numbers.

Router(config)#access-list  900  deny  -1 1 rip 2 rip

Router(config)#access-list  900  permit  -1

The following example permits type 2 packets from any socket from host 10.0000.0C01.5234 to access any sockets on any node on networks 1000 through 100F. It denies all other traffic (with an implicit deny all):

Note This type is chosen only as an example. The actual type to use depends on the specific application.

Router(config)#access-list 910 permit 2 10.0000.0C01.5234 0000.0000.0000 0 1000.0000.0000.0000 F.FFFF.FFFF.FFFF 0

Misconceptions:

None

Related Commands:

ipx access-group

ipx access-list

access-list (IPX standard)


Command:

access-list (IPX standard)

Mode:

Router(config)#

Syntax:

access-list access-list-number {deny | permit} {-1 | source-network | source-network.source-node |source-network.source-node source-node-mask} [-1 | destination-network |destination-network.destination-node | destination-network.destination-node destination-node-mask]

no access-list access-list-number {deny | permit} {-1 | source-network | source-network.source-node |source-network.source-node source-node-mask} [-1 | destination-network |destination-network.destination-node | destination-network.destination-node destination-node-mask]

Syntax Description:

access-list-number

Number of the access list. This is a number from 800 to 899.

deny

Denies access if the conditions are matched.

permit

Permits access if the conditions are matched.

source-network

Number of the network from which the packet is being sent. This is an eight-digit hexadecimal number that uniquely identifies a network cable segment. It can be a number in the range 1 to FFFFFFFE. A network number of 0 matches the local network. A network number of -1 matches all networks.

Leading zeros do not need to be specified in the network number. For example, for the network number 000000AA, simply enter AA.

.source-node

(Optional) Node on source-network from which the packet is being sent. This is a 48-bit value represented by a dotted triplet of four-digit hexadecimal numbers (xxxx.xxxx.xxxx).

source-node-mask

(Optional) Mask to be applied to source-node. This is a 48-bit value represented as a dotted triplet of four-digit hexadecimal numbers (xxxx.xxxx.xxxx). Place ones in the bit positions to be masked.

destination-network

(Optional) Number of the network to which the packet is being sent. This is an eight-digit hexadecimal number that uniquely identifies a network cable segment. It can be a number in the range 1 to FFFFFFFE. A network number of 0 matches the local network. A network number of -1 matches all networks.

Leading zeros do not need to be specified in the network number. For example, for the network number 000000AA, simply enter AA.

.destination-node

(Optional) Node on destination-network to which the packet is being sent. This is a 48-bit value represented by a dotted triplet of four-digit hexadecimal numbers (xxxx.xxxx.xxxx).

destination-node-mask

(Optional) Mask to be applied to destination-node. This is a 48-bit value represented as a dotted triplet of four-digit hexadecimal numbers (xxxx.xxxx.xxxx). Place ones in the bit positions to be masked.

Command Description:

To define a standard IPX access list, use the standard version of the access-list global configuration command. To remove a standard access list, use the no form of this command.

Standard IPX access lists filter on the source network. All other parameters are optional.

Use the ipx access-group command to assign an access list to an interface. Only one extended or one standard access list can be applied to an interface. The access list filters all outgoing packets on the interface.

To delete a standard access list, specify the minimum number of keywords and arguments needed to delete the proper access list. For example, to delete the entire access list, use the following command:

Router (config)#no access-list access-list-number

To delete the access list for a specific network, use the following command:

Router (config)#no access-list access-list-number {deny | permit} source-network

Example:

The following example denies access to traffic from all IPX networks (-1) to destination network 2:

Router(config)#access-list 800 deny -1 2

The following example denies access to all traffic from IPX address 1.0000.0c00.1111:

Router(config)#access-list 800 deny 1.0000.0c00.1111

The following example denies access from all nodes on network 1 that have a source address beginning with 0000.0c:

Router(config)#access-list 800 deny 1.0000.0c00.0000 0000.00ff.ffff

The following example denies access from source address 1111.1111.1111 on network 1 to destination address 2222.2222.2222 on network 2:

Router(config)#access-list 800 deny 1.1111.1111.1111 0000.0000.0000 2.2222.2222.2222 0000.0000.0000
 or
Router(config)#access-list 800 deny 1.1111.1111.1111 2.2222.2222.2222

Misconceptions:

IPX standard access lists cannot filter based on source and destination addresses (they, in fact, can).

Related Commands:

access-list (IPX extended)

ipx access-list

ipx access-group


Command:

clear access-list counters

Mode:

Router>

Router#

Syntax:

clear access-list counters {access-list-number | access-list-name}

Syntax Description:

access-list-number | Access list number of the access list for which to clear the counters.
access-list-name | Name of an IP access list. The name cannot contain a space or quotation mark, and must begin with an alphabetic character to avoid ambiguity with numbered access lists.

Command Description:

To clear the counters of an access list, use the clear access-list counters command in EXEC mode.

Some access lists keep counters that count the number of packets that pass each line of an access list. The show access-lists command displays the counters as a number of matches. Use the clear access-list counters command to restart the counters for a particular access list to zero.

Example:

The following example clears the counters for access list 101:

Router> clear access-list counters 101

Misconceptions:

None

Related Commands:

show access-lists


 Command:

deny (extended)

Mode:

Router(config-ext-nacl)#

Syntax:

deny protocol source source-wildcard [operator port] destination destination-wildcard [operator port][precedence precedence] [tos tos] [established] [log]

Syntax Description:
precedence

Packets can be filtered by precedence level, as specified by a number from 0 to 7 or by name. The IP precedence is the three leftmost bits in the TOS octet of an IP header (as defined in RFCs 1349, 1812, 2474 & 2873). This may be set using the route map or policy map command set ip precedence.

tos | Packets can be filtered by type of service level, as specified by a number from 0 to 15 or by name. The TOS Field is bits 3-6 in the TOS octet of IPv4 header [RFC 1349].
established | For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection.
log | Causes an informational logging message about the packet that matches the entry to be sent to the console.

Command Description:

In access-list configuration mode, specify the conditions allowed or denied. Use the log keyword to get access list logging messages, including violations.

Example:

The following example makes an entry into an IP named extended access list. This entry denies telnet traffic from a telnet client originating on host 172.19.99.67 TCP port 11005 from accessing the telnet server running on host 192.168.60.185.

Router(config-ext-nacl)#deny tcp host 172.19.99.67 eq 11005 host 192.168.60.185 eq telnet

Misconceptions:

None

Related Commands:
ip access-list (extended)
permit (extended)


 Command:

deny (standard)

Mode:

Router(config-std-nacl)#

Syntax:

deny {source [source-wildcard] | any} [log]

Syntax Description:
any | applies the list to all sources
log | (Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)
source Number of the network or host from which the packet is being sent. There are three alternative ways to specify the source:
Use a 32-bit quantity in four-part, dotted-decimal format.
Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255.
Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.
source-wildcard | Wildcard bits to be applied to source. Each wildcard bit set to zero indicates that the corresponding bit position in the packet's ip address must exactly match the bit value in the corresponding bit position in the source. Each wildcard bit set to one indicates that both a zero bit and a one bit in the corresponding position of the packet's ip address will be considered a match to this access list entry.

Command Description:

In access-list configuration mode, specify one or more conditions denied. Packets matching this condition will not be allowed to pass through the interface.

Example:

This example adds a entry to an IP standard named access control list that denies all IP traffic from host 1.2.3.4:

Router(config-std-nacl)#deny 1.2.3.4

Misconceptions:
None

Related Commands:
ip access-list standard
permit (standard)


Command:

dynamic

Mode:

Router(config-ext-nacl)#

Syntax:

dynamic dynamic-name [timeout minutes] {deny | permit} protocol source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [precedence precedence] [tos tos] [log]

no dynamic dynamic-name [timeout minutes] {deny | permit} protocol source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [precedence precedence] [tos tos] [log]

Syntax Description:

timeout

Specifies the absolute length of time (in minutes) that a temporary access list entry can remain in a dynamic access list. The default is an infinite length of time and allows an entry to remain permanently.

precedence

Packets can be filtered by precedence level, as specified by a number from 0 to 7 or by name. The IP precedence is the three leftmost bits in the TOS octet of an IP header (as defined in RFCs 1349, 1812, 2474 & 2873). This may be set using the route map or policy map command set ip precedence.

tos

Packets can be filtered by type of service level, as specified by a number from 0 to 15 or by name. The TOS Field is bits 3-6 in the TOS octet of IPv4 header [RFC 1349].

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

Command Description:

To define a named dynamic IP access list, use the dynamic access-list configuration command. To remove the access lists, use the no form of this command. Use the any keyword as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0. Use the any keyword as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255.

Example:

The following example defines a named access lists with a dynamic access list entry. The first line allows any host to telnet to the router to the router (IP address 172.18.21.2). The second line enables a dynamic list entry called testlist. This entry will allow any IP traffic from the host that telneted into the router. It also specifies that the temporary access will end after 120 seconds of no activity.

Router(config-ext-nacl)#permit tcp any host 172.18.21.2 eq telnet
Router(config-ext-nacl)#dynamic testlist timeout 120 permit ip any any

Misconceptions:

None

Related Commands:

ip access-list extended

access-list


Command:

evaluate

Mode:

Router(config-ext-nacl)#

Syntax:

evaluate name

Syntax Description:

name

The name of the access-list

Command Description:

Used to identify a reflexive access-list. Add an entry that "points" to the reflexive access list. Add an entry for each reflexive access list name previously defined.

Example:

This example will create an entry in a named access control list that will be used to allow traffic for sessions that have entries into the reflexive list names "this".

Router(config-ext-nacl)#evaluate this

The entries are put in the list names this with an access statement like:

Router(config-ext-nacl)#permit ip any any reflect this

Misconceptions:

None

Related Commands:

ip reflexive-list


Command:

ip access-group

Mode:

Router(config-if)#

Syntax:

ip access-group access-list-number | access-list-name {in | out}

no ip access-group access-list-number |access-list-name

Syntax Description:

access-list-number | access-list-name

Assigned IP access list number or name

in

This defines access control on packets transmitted from the host. These packets are received into the router interface.

out

This defines access control on packets being sent to the host. These packets are transmitted out of the router interface. The default is out.

Command Description:

To configure an access list to be used for packets transmitted to and from the host, use the ip access-group interface configuration command. To disable control over packets transmitted to or from a host, use the no form of this command.

With this command in effect, various fields within the packet are compared to criteria within the access list for acceptability and dropped or passed. Some of the fields that can be compared include: source IP address, destination IP address, protocol, source port number and destination port number.

Example:

The following example assumes that users are restricted from accessing certain servers, but access to other hosts can be accessed.

 Router(config)#access-list 2 deny 172.16.42.55
 Router(config)#access-list 2 deny 172.16.111.1
 Router(config)#access-list 2 deny 172.16.55.99
 Router(config)#access-list 2 permit 172.16.0.0 0.0.255.255

!! Specify the access list interface

 Router(config)#async 6
 Router(config-if)#async dynamic address
 Router(config-if)#ip access-group 2 out

Misconceptions:

None

Related Commands:

access-list


 Command:

ip access-list extended

Mode:

Router(config)#

Syntax:

ip access-list extended name

Syntax Description:
name  The name of the access list to be defined.

Command Description:

Define an extended IP access list using a name.

Example:

The following example creates an extended IP access list named "fred". This list permits all IP traffic from subnet 128.106.0.0 to any location.

Router(config)#ip access-list extended fred
Router(config-ext-nacl)#permit ip 128.106.0.0 0.0.255.255 any

Misconceptions:
None

Related Commands:
permit
deny


 Command:

ip access-list standard

Mode:

Router(config)#

Syntax:

ip access-list standard name

Syntax Description:
name  The name of the access-list.

Command Description:

The ip access-list standard command allows one to define a standard IP access list using a name.

Example:

The following example creates an standard IP access list named "myaccesslist". This list denies all IP traffic from net 192.168.4.0.

Router(config)#ip access-list standard myaccesslist
Router(config-std-nacl)#deny 192.168.4.0 0.0.0.255

Misconceptions:
None

Related Commands:
ip access-list extended
deny (standard)
permit (standard)


 Command:

ip reflexive-list

Mode:

Router(config)#

Syntax:

ip reflexive-list timeout seconds

Syntax Description:
seconds  The time (in seconds) for the timeout.

Command Description:

To specify the length of time that reflexive access list entries will continue to exist when no packets in the session are detected, use the ip reflexive-list command in global configuration mode.

Example:

This example sets the IP reflexive access list time out to 300 seconds.

Router(config)#ip reflexive-list timeout  300

Misconceptions:
None

Related Commands:
ip access-list extended
access-list


 Command:

periodic

Mode:

Router(config-time-range)#

Syntax:

periodic days-of-the-week hh:mm to [days-of-the-week] hh:mm

Syntax Description:

days-of-the-week  | Defines the beginning or ending day of the time range.
hh:mm | Defines the beginning or ending time of the time range. hh is the 24 hour time and mm is the minute.

Command Description:

To specify a recurring (weekly) time range for functions that support the time-range feature, use the periodic time-range configuration command. The days-of-the-week argument can be any single day or combinations of days: Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, and Sunday, as well as daily (Monday through Sunday), weekdays (Monday through Friday), or weekend (Saturday and Sunday).

The first occurrence of the hh:mm argument is the starting hours:minutes that the associated time range is in effect. The second occurrence is the ending hours:minutes the associated statement is in effect. Times are expressed in a 24 hour clock, therefore 8:00pm would be entered as "20:00". Entry of the to keyword is required to complete the range "from start-time to end-time."

Example:

The following instruction defines a reoccuring time period of Monday and Tuesday from 8 AM until 3 PM.
Router(config-time-range)#periodic  monday tuesday 8:00 to 15:00

Misconceptions:

None

Related Commands:
ip access-list extended
access-list
absolute
time-range


Command:

permit (extended)

Mode:

Router(config-ext-nacl)#

Syntax:

permit protocol source source-wildcard [operator port] destination destination-wildcard [operator port][precedence precedence] [tos tos] [established] [log]

no permit protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log]

ICMP
permit icmp source source-wildcard destination destination-wildcard [icmp-type [icmp-code] | icmp-message] [precedence precedence] [tos tos] [log]

IGMP
permit igmp source source-wildcard destination destination-wildcard [igmp-type] [precedence precedence] [tos tos] [log]

TCP
permit tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator port [port]] [established] [precedence precedence] [tos tos] [log]

UDP
permit udp source source-wildcard [operator port [port]] destination destination-wildcard [operator port [port]] [precedence precedence] [tos tos] [log]

Syntax Description:

source

Number of the network or host from which the packet is being sent. There are two alternative ways to specify the source:

Use a 32-bit quantity in four-part, dotted-decimal format.

Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255.

source-wildcard

(Optional) Wildcard bits to be applied to the source. There are two alternative ways to specify the source wildcard:

Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions to be ignored.

Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255.

protocol

Name or number of an IP protocol. It can be one of the keywords ahp, eigrp, esp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, pcp, pim, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip. Some protocols allow further qualifiers described later.

source

Number of the network or host from which the packet is being sent. There are three alternative ways to specify the source:

  • Use a 32-bit quantity in four-part, dotted-decimal format.
  • Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255.
  • Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

source-wildcard

Wildcard bits to be applied to source. There are three alternative ways to specify the source wildcard:

  • Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions to be ignored.
  • Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255.
  • Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

destination

Number of the network or host to which the packet is being sent. There are three alternative ways to specify the destination:

  • Use a 32-bit quantity in four-part, dotted-decimal format.
  • Use the keyword any as an abbreviation for the destination and destination-wildcard of 0.0.0.0 255.255.255.255.
  • Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

destination-wildcard

Wildcard bits to be applied to the destination. There are three alternative ways to specify the destination wildcard:

  • Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions to be ignored.
  • Use the keyword any as an abbreviation for a destination and destination-wildcard of 0.0.0.0 255.255.255.255.
  • Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

precedence precedence

Packets can be filtered by precedence level, as specified by a number from 0 to 7 or by name. The IP precedence is the three leftmost bits in the TOS octet of an IP header (as defined in RFCs 1349, 1812, 2474 & 2873). This may be set using the route map or policy map command set ip precedence.

tos tos

Packets can be filtered by type of service level, as specified by a number from 0 to 15 or by name. The TOS Field is bits 3-6 in the TOS octet of IPv4 header [RFC 1349].

icmp-type

(Optional) ICMP packets can be filtered by ICMP message type. The type is a number from 0 to 255. The type is identified in the first byte of the ICMP datagram and are defined by rfc 792.

icmp-code

(Optional) ICMP packets that are filtered by ICMP message type can also be filtered by the ICMP message code. The code is a number from 0 to 255. The code is identified in the second byte of the ICMP datagram and are defined by rfc 792.

icmp-message

(Optional) ICMP packets can be filtered by an ICMP message type name or ICMP message type and code name.

operator

(Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).

If the operator is positioned after the source and source-wildcard, it must match the source port.

If the operator is positioned after the destination and destination-wildcard, it must match the destination port.

The range operator requires two port numbers. All other operators require one port number.

port

(Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535. TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP.

established

(Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection.

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

The message for a standard list includes the access list number, whether the packet was permitted or denied, the source address, and the number of packets.

The message for an extended list includes the access list number; whether the packet was permitted or denied; the protocol; whether it was TCP, UDP, ICMP, or a number; and, if appropriate, the source and destination addresses and source and destination port numbers.

For both standard and extended lists, the message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.

The logging facility might drop some logging message packets if there are too many to be handled or if there is more than one logging message to be handled in 1 second. This behavior prevents the router from crashing due to too many logging packets. Therefore, the logging facility should not be used as a billing tool or an accurate source of the number of matches to an access list.

Command Description:

To set conditions for a named IP access list, use the permit access-list configuration command. To remove a condition from an access list, use the no form of this command.

Example:

The following example makes an entry into an IP named extended access list. This entry permits telnet traffic from a telnet client originating on host 172.19.99.67 TCP port 11005 to access the telnet server running on host 192.168.60.185.

Router(config)#ip access-list extended Internetfilter
Router(config-ext-nacl)#permit tcp host 172.19.99.67 eq 11005 host 192.168.60.185 eq telnet

Misconceptions:

None

Related Commands:

ip access-list extended

deny (extended)


Command:

permit (standard)

Mode:

Router(config-std-nacl)#

Syntax:

permit {source [source-wildcard] | any} [log]

Syntax Description:

source

Number of the network or host from which the packet is being sent. There are two alternative ways to specify the source:

Use a 32-bit quantity in four-part, dotted-decimal format.

source-wildcard

(Optional) Wildcard bits to be applied to the source. There are two alternative ways to specify the source wildcard:

Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions to be ignored.

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

any

applies the list to all sources

Command Description:

In access-list configuration mode, specify one or more conditions allowed. Packets matching this condition will be allowed to pass through the interface.

Example:

This example adds a entry to an IP standard named access control list that permits all IP traffic from network 36.0.0.0:

Router(config-std-nacl)#permit 36.0.0.0 0.255.255.255

Misconceptions:

None

Related Commands:

ip access-list standard

deny (standard)


Command:

time-range

Mode:

Router(config)#

Syntax:

time-range time-range-name

Syntax Description:

time-range-name

The name of the time-range.

Command Description:

To enable time-range configuration mode and define time ranges for functions (such as extended access lists), use the time-range global configuration command.

Example:

The following example defines a time range named 'noaccessintheevening':

Router(config)#time-range noaccessintheevening

Misconceptions:

None

Related commands:

periodic

absolute

ip access-list extended


Command:

show access-lists

Mode:

Router#

Syntax:

show access-lists [access-list-number | access-list-name]

Syntax Description:

access-list-number

Specifies a specific access-list by number

access-list-name

Specifies a specific access-list by name

Command Description:

To display the contents of current access lists, use the show access-lists privileged EXEC command.

Example:

The following example displays the contents of access list 101.

Router#show access-lists 101

  Extended IP access list 101
  permit tcp host 198.92.32.130 any established (4304 matches)
  permit udp host 198.92.32.130 any eq domain (129 matches)
  permit icmp host 198.92.32.130 any
  permit tcp host 198.92.32.130 host 171.69.2.141 gt 1023
  permit tcp host 198.92.32.130 host 171.69.2.135 eq smtp (2 matches)
  permit tcp host 198.92.32.130 host 198.92.30.32 eq smtp
  permit tcp host 198.92.32.130 host 171.69.108.33 eq smtp
  permit udp host 198.92.32.130 host 171.68.225.190 eq syslog
  permit udp host 198.92.32.130 host 171.68.225.126 eq syslog
  deny ip 150.136.0.0 0.0.255.255 224.0.0.0 15.255.255.255
  deny ip 171.68.0.0 0.1.255.255 224.0.0.0 15.255.255.255 (2 matches)
  deny ip 172.24.24.0 0.0.1.255 224.0.0.0 15.255.255.255
  deny ip 192.82.152.0 0.0.0.255 224.0.0.0 15.255.255.255
  deny ip 192.122.173.0 0.0.0.255 224.0.0.0 15.255.255.255
  deny ip 192.122.174.0 0.0.0.255 224.0.0.0 15.255.255.255
  deny ip 192.135.239.0 0.0.0.255 224.0.0.0 15.255.255.255
  deny ip 192.135.240.0 0.0.7.255 224.0.0.0 15.255.255.255
  deny ip 192.135.248.0 0.0.3.255 224.0.0.0 15.255.255.255
  deny ip 192.150.42.0 0.0.0.255 224.0.0.0 15.255.255.255

Misconceptions:

None

Related Commands:

access-list


Command:

async

Mode:

Router(config-if)#

Syntax:

async [ dynamic address | dynamic routing | mode [dedicated | interactive]]

no async [ dynamic address | mode [dedicated | interactive]]

Syntax Description:

dynamic address

Specifies dynamic asynchronous addressing. In order to use dynamic addressing, the router must be in interactive mode, and the user will enter the address at the EXEC level. It is common to configure an asynchronous interface to have a default address and to allow dynamic addressing. With this configuration, the choice between the default address or a dynamic addressing is made by users when they enter the slip or ppp EXEC command. If the user enters an address, it is used, and if the user enters the default keyword, the default address is used.

routing

Allow user to run dynamic routing protocols

dedicated

Places a line into dedicated asynchronous mode using SLIP or PPP encapsulation. With dedicated asynchronous network mode, the interface will use either SLIP or PPP encapsulation, depending on which encapsulation method is configured for the interface. An EXEC prompt does not appear, and the router is not available for normal interactive use.

interactive

In interactive mode, the line can be used to make any type of connection, depending on the EXEC command entered by the user. For example, depending on its configuration, the line could be used for Telnet connections, or SLIP or PPP encapsulation.

Command Description:

The async interface configuration command is used to establish an asynchronous serial connection.

Example:

The following example sets the mode of the interface to dedicated:

Router(config-if)#async mode dedicated

The following example sets the mode of the interface to interactive:

Router(config-if)#async mode interactive

The following example sets the interface to dynamic address:

Router(config-if)#async dynamic address

Misconceptions:

None

Related Commands:

autoselect

peer default ip address


Command:

async mode dedicated

Mode:

Router(config-if)#

Syntax:

async mode dedicated

no async mode dedicated

Syntax Description:

This command has no arguments or keywords.

Command Description:

To place a line into dedicated asynchronous mode using Serial Line Internet Protocol (SLIP) or PPP encapsulation, use the async mode dedicated command in interface configuration mode. To return the line to interactive mode, use the no form of this command.

Example:

Router(config-if)# async mode dedicated

Misconceptions:

None

Related commands:

async mode interactive


Command:

async mode interactive

Mode:

Router(config-if)#

Syntax:

async mode interactive

no async mode interactive

Syntax Description:

This command has no arguments or keywords.

Command Description:

To place a line into interactive asynchronous mode using Serial Line Internet Protocol (SLIP) or PPP encapsulation, use the async mode interactive command in interface configuration mode. To return the line to dedicated mode, use the no form of this command.

Example:

Router(config-if)# async mode interactive

Misconceptions:

None

Related commands:

async mode interactive

© Cisco Systems, Inc. 2001, 2002


Command:

peer default ip address

Mode:

Router(config-if)#

Syntax:

peer default ip address {ip-address | dhcp | pool [pool-name]}

no peer default ip address {ip-address | dhcp | pool [pool-name]}

Syntax Description:

ip-address

Specific IP address to be assigned to a remote peer dialing in to the interface. To prevent duplicate IP addresses from being assigned on more than one interface, this command argument cannot be applied to a dialer rotary group nor to an ISDN interface.

dhcp

Retrieve an IP address from the DHCP server.

pool

Use the global default mechanism as defined by the ip address-pool command unless the optional pool-name argument is supplied. This is the default.

pool-name

(Optional) Name of a local address pool created using the ip local pool command. Retrieve an address from this pool regardless of the Global Default Mechanism setting.

Command Description:

Use the peer default ip address interface configuration command to specify an IP address, an address from a specific IP address pool, or an address from the DHCP mechanism to be returned to a remote peer connecting to this interface. This command sets the address used on the remote (PC) side. Use the no form of this command to disable a prior peer IP address pooling configuration on an interface. To remove the default address from the configuration, use the no form of this command also.

Example:

The following will assign the distant peer the IP address of 10.0.0.200.

Router(config-if)#peer default ip address 10.0.0.200

Misconceptions:

None

Related Commands:

None


%command%

Command:

physical-layer

Mode:

Router(config-if)#

Syntax:

physical-layer {sync | async}

no physical-layer

Syntax Description:

sync | Places the interface in synchronous mode. This is the default.
async | Places the interface in asynchronous mode.

Command Description:

To specify the mode of a slow-speed serial interface on a router as either synchronous or asynchronous, use the physical-layer command in interface configuration mode. To return the interface to the default mode of synchronous, use the no form of this command.

Example:

This example changes a low-speed serial interface from synchronous to asynchronous mode:

Router(config)#interface serial 2

Router(config-if)#physical-layer async

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


Command:

dialer in-band

Mode:

Router(config-if)#

Syntax:

dialer in-band [no-parity | odd-parity]

no dialer in-band

Syntax Description:

no-parity

This indicates that no parity is to be applied to the dialer string that is sent out to the modem on synchronous interfaces.

odd-parity

This indicates that the dialed number has odd parity (7-bit ASCII characters with the eighth bit as the parity bit) on synchronous interfaces.

Command Description:

To specify that dial-on-demand routing (DDR) is to be supported, use the dialer in-band interface configuration command. To disable DDR for the interface, use the no form of this command.

The dialer in-band command specifies that chat scripts will be used on asynchronous interfaces and V.25 bis will be used on synchronous interfaces. The parity keywords do not apply to asynchronous interfaces.

The parity setting applies to the dialer string that is sent out to the modem. If a parity is not specified, or no parity is specified, no parity is applied to the output number. If odd parity is configured, the dialed number will have odd parity (7-bit ASCII characters with the eighth bit as the parity bit.)

If an interface only accepts calls and does not place calls, the dialer in-band interface configuration command is the only command needed to configure it. If an interface is configured in this manner, with no dialer rotary groups, the idle timer never disconnects the line. It is up to the remote end (the end that placed the call) to disconnect the line based on idle time.

Example:

The following example specifies DDR for asynchronous interface 1:
Router(config)#interface async 1
Router(config-if)#dialer in-band

The DTR pulse signals for three seconds on the interfaces in dialer group 1. This holds the DTR low so the modem can recognize that DTR has been dropped.

Router(config-if)#pulse-time 3

Misconceptions:

None

Related Commands:

dialer map

dialer string


Command:

autoselect

Mode:

Router(config-line)#

Syntax:

autoselect { arap | ppp | slip | during-login | timeout }

no autoselect { arap | ppp | slip | during-login | timeout}

Syntax Description:

arap

Configures the Cisco IOS software to allow an ARAP session to start up automatically.

ppp

Configures the Cisco IOS software to allow a PPP session to start up automatically.

slip

Configures the Cisco IOS software to allow a SLIP session to start up automatically.

timeout

Set wait timeout for initial autoselect byte

during-login

The username and/or password prompt is displayed without pressing the Return key. After the user logs in, the autoselect function begins.

Command Description:

To configure a line to start an ARA, PPP, or SLIP session, use the autoselect line configuration command. Use the no form of this command to disable this function on a line.

Example:

The following will provide a PPP session when PPP headers are detected.

Router(config-line)#autoselect ppp

Misconceptions:

None

Related Commands:

async


Command:

chat-script

Mode:

Router(config)#

Syntax:

chat-script script-name expect send [expect1 send1]  [expect2 send2]...

no chat-script script-name

Syntax Description:

script-name

Name of the chat script.

expect send

Pairs of information elements: an item to expect and an item to send in response.

Command Description:

To create a script that will place a call over a modem, use the chat-script global configuration command. Use the no form of this command to disable the specified chat script. script-name is the name of the chat script to create, and expect-send represents pairs of information elements, an item to expect and an item to send in response. Chat scripts are in the form expect-send, where the send string following the hyphen (-) is executed if the preceding expect string fails. Each send string is followed by a return unless it ends with the escape sequence \c.

Chat Script Escape Sequences

Escape Sequence

Description

""

Expect a null string.

EOT

Send an end-of-transmission character.

BREAK

Cause a BREAK. This sequence is sometimes simulated with line speed changes and null characters. May not work on all systems.

\c

Suppress new line at the end of the send string.

\d

Delay for 2 seconds.

\K

Insert a BREAK.

\n

Send a newline or linefeed character.

\p

Pause for 1/4 second.

\r

Send a return.

\s

Send a space character.

\t

Send a table character.

\\

Send a backslash (\) character.

\T

Replaced by phone number.

\q

Reserved, not yet used.

Example:

The following creates a chat script named "t3000". This chat script uses the special case script modifier ABORT keyword designate that the chat script has failed if the modem returns ERROR. The first expect-send pair ("" "ATZ") tells the router to expect nothing and issue the ATZ command. The next pair, (OK "ATDT \T") tells the router to expect the modem to return with OK. Once the router sees OK, it will issue the next command (ATDT \T). The special case script modifier TIMEOUT 30 sets the time to wait for the CONNECT string. The CONNECT \c defines when "connect" is seen the router does not send anything. (Note that \c is effectively nothing; " " would have indicated nothing followed by a carriage return). This defines the end of the chat-script.

Router(config)#chat-script t3000 ABORT ERROR ABORT BUSY ABORT "NO ANSWER" "" "AT H" OK "AT DT \T"   DIALING \c TIMEOUT 30 CONNECT \c

Misconceptions:

None

Related Commands:

ppp pap

start-chat


Command:

clear line

Mode:

Router#

Syntax:

clear line line-number | aux number | console number | tty number | vty number

Syntax Description:

aux

Auxiliary line

vty

Virtual terminal

console

Primary terminal line

tty

Terminal controller

line-number

The line number to be cleared (Absolute line number)

Command Description:

To return a terminal line to idle state, use the clear line EXEC command. Use this command to log out of a specific session running on another line. If the line uses a modem, the modem will be disconnected.

Example:

The following example will clear line number 5.

Router#clear line 5

Misconceptions:

None

Related Commands:

show line


 Command:

modem autoconfigure discovery

Mode:

Router(config-line)#

Syntax:

modem autoconfigure discovery

no modem autoconfigure

Syntax Description:

This command has no arguments or keywords.

Command Description:

To configure a line to discover what kind of modem is connected to the router and to configure that modem automatically, use the modem autoconfigure discovery line configuration command. Use the no form of this command to disable this feature. The modem is identified each time the line is reset. If a modem cannot be detected, the line continues retrying for 10 seconds. When the modem type is determined, this information remains stored until the modem is recycled or disconnected. Discovery mode is much slower than configuring a line directly.

Example:

The following example discovers what kind of modem is attached to the router:

Router(config-line)#modem autoconfigure discovery

Misconceptions:
None

Related Commands:
modem autoconfigure type
speed
transport input
transport output
login
password
flowcontrol
stopbits


Command:

modem autoconfigure type

Mode:

Router(config-line)#

Syntax:

modem autoconfigure type modem-name

no modem autoconfigure type modem-name

Syntax Description:

modem-name

The name of the modem (such as Codex_3260).

Command Description:

To direct a line to attempt to configure the attached modem using the entry for modem-name, use the modem autoconfigure type line configuration command. Use the no form of this command to disable the feature. The modem is reconfigured each time the line goes down.

Example:

The following example set the line to autoconfigure the router using the Codex_3260 configuration from the modemcap database:

Router(config-line)#modem autoconfigure type Codex_3260

Misconceptions:

None

Related Commands:

show modemcap

speed

transport input

transport output

login

password

flowcontrol

speed

stopbits


 Command:

modem inout

Mode:

Router(config-line)#

Syntax:

modem inout

no modem inout

Syntax Description:

This command has no arguments or keywords.

Command Description:

To configure a line for both incoming and outgoing calls, use the modem inout line configuration command. Use the no form of this command to disable the line. This command uses DSR and RING signals for carrier detection. The Cisco IOS software does not support any dialing protocols. The host system software or the user must provide any special dialing commands when using the modem for outgoing calls.

Example:

The following example illustrates how to configure a line for both incoming and outgoing calls:

Router(config-line)#modem inout

Misconceptions:
None

Related Commands:
speed
login
password
flowcontrol
speed
parity
databits
stopbits


Command:

modemcap edit

Mode:

Router(config)#

Syntax:

modemcap edit modem-name attribute value

no modemcap edit modem-name attribute value

Syntax Description:

modem-name

Name of the modem whose values are being edited.

attribute

Modem capability, or attribute, as defined by the show modemcap command.

value

The AT command equivalent (such as &F).

Command Description:

To change a modem value that was returned from the show modemcap command, use the modemcap edit global configuration command. The argument modem-name is a modemcap entry, attribute is a modem function as defined by the show modemcap command, and value is the modem AT command, such as &F.

Example:

The following example adds the factory default entry, &F, to the configuration file. This entry, and others like it, are stored in a database that is referenced.

Router(config)#modemcap edit Codex_3250 factory-default &F

Misconceptions:

None

Related Commands:

modemcap entry

show modemcap


 Command:

modemcap entry

Mode:

Router(config)#

Syntax:

modemcap entry modem-type

no modemcap entry modem-type

Syntax Description:

modem-type

Name of the modem whose values are being edited.

Command Description:

To store and compress information about the capability of a specified modem, use the modemcap entry command. Use the no form of this command to disable the feature.

Example:

The following example shows the modem capability in a Codex_3260:

Router(config)#modemcap entry  Codex_3250

Misconceptions:
None

Related Commands:
show modemcap
modemcap edit


Command:

parity

Mode:

Router(config-line)#

Syntax:

parity {none | even | odd | space | mark}

Syntax Description:

none

No parity

even

Even parity

odd

Odd parity

space

Space parity

mark

Mark parity

Command Description:

To define generation of a parity bit, use the parity line configuration command. Use the no form of the command to specify no parity.

Example:

The following example changes the default of no parity to odd parity:

Router(config-line)#parity odd

Misconceptions:

None

Related Commands:

stopbits

databits

show line


Command:

speed (async)

Mode:

Router(config-line)#

Syntax:

speed bps

no speed

Syntax Description:

bps

The speed of the line in bits per second.

Command Description:

To set the terminal speed (how fast the terminal sends and receives information to/from the modem), use the speed line configuration command. The default is 9600 bps.

Usage Guidelines:

Set the speed to match the transmission rate of the device that is connected to the port. Some baud rates available on devices connected to the port might not be supported on the router. The router indicates whether the speed selected is not supported.

Use the Table below as a guide for setting line speeds.

Router Model

Baud Rates

Cisco 7000

50, 75, 110, 134, 150, 200, 300, 600, 1050, 1200, 2000, 2400, 4800, 9600, 19200, 38400

Cisco 2500 access servers

Any speed from 50 to 115200

Cisco 2500 routers, Cisco 4000 series

75, 110, 134, 150, 300, 600, 1200, 2000, 2400, 4800, 1800, 9600, 19200, 38400

Example:

The following sets the line transmit and receive speed for 115200 bits per second.

Router (config)#line 1 2

Router (config-line)#speed 115200

Misconceptions:

None

Related commands:

transport input

transport output

login

password

flowcontrol

speed

stopbits


Command:

start-chat

Mode:

Router#

Syntax:

start-chat regexp [ line-number | aux number| console number | tty number | vty number] [dialer-string]

Syntax Description:

regexp | Specifies the name of a regular expression or modem script to be executed. If there is more than one script with a name that matches the argument regexp, the first script found will be used.
line-number | (Optional) Indicates the line number on which to execute the chat script. If a line number is not specified, the current line number is chosen. If the specified line is busy, the script is not executed and an error message appears. If the dialer-string argument is specified, a line-number must be entered; it is not optional if a dialer string is specified.
dialer-string | (Optional) String of characters (often a telephone number) to be sent to a DCE. If a dialer string is entered, a line-number must also be specified, or the chat script regexp will not start.

Command Description:

To specify that a chat script start on a specified line at any point, use the start-chat privileged EXEC command. Use the no form of this command to stop the chat script. This command provides modem dialing commands for a chat script to be applied immediately to a line. If a line is not specified, the script runs on the current line. If the specified line is already in use, the script is not activated and an error message appears. This command functions only on physical terminal (TTY) lines. It does not function on virtual terminal (VTY) lines.

Example:

The following will execute chat script "telebit" on line 8.

Router#start-chat telebit line 8

Misconceptions:

None

Related commands:

debug chat

chat-script


 Command:

databits

Mode:

Router(config-line)#

Syntax:

databits {5 | 6 | 7 | 8}

no databits {5 | 6 | 7 | 8}

Syntax Description:

5

Five data bits per character.

6

Six data bits per character.

7

Seven data bits per character.

8

Eight data bits per character. This is the default.

Command Description:

To set the number of data bits per character that are interpreted and generated by the router hardware, use the databits line configuration command. Use the no form of the command to restore the default value. The databits line configuration command can be used to mask the high bit on input from devices that generate 7 data bits with parity. If parity is being generated, specify 7 data bits per character. If no parity generation is in effect, specify 8 data bits per character. The other keywords are supplied for compatibility with older devices and generally are not used.

 Example:

Router(config-line)#databits  7

Misconceptions:
None

Related Commands:
stopbits
parity
show line


 Command:

stopbits

Mode:

Router(config-line)#

Syntax:
stopbits {1 | 1.5 | 2 }

no stopbits

Syntax Description:

1 | One stop bit
1.5  | One and one-half stop bits
2 | Two stop bits

Command Description:

Communication protocols provided by devices such as terminals and modems often require a specific stop-bit setting. To set the number of the stop bits transmitted per byte, use the stopbits line configuration command. Use the no form of the command to restore the default value of 2.

Example:
The following example changes the default from 2 stop bits to 1 as a performance enhancement:
Router(config-line)#stopbits  1

Misconceptions:
None

Related commands:
speed
transport input
transport output
login
password
flowcontrol
speed


 Command:

flowcontrol

Mode:

Router(config-line)#

Syntax:

flowcontrol {none [lock ] [in | out ] | software [lock ] [in | out ] | hardware [in | out ]}

no flowcontrol {none [lock ] [in | out ] | software [lock ] [in | out ] | hardware [in | out ]}

Syntax Description:
none | Turns off flow control
software | Sets software flow control. An optional keyword specifies the direction: in causes the Cisco IOS software to listen to flow control from the attached device, and out causes the software to send flow control information to the attached device. If you do not specify a direction, both are assumed.
lock | (Optional) Used to make it impossible to turn off flow control from the remote host when the connected device needs software flow control. This option applies to connections using the Telnet or rlogin protocols.
hardware

Sets hardware flow control. An optional keyword specifies the direction: in causes the software to listen to flow control from the attached device, and out causes the software to send flow control information to the attached device. If you do not specify a direction, both are assumed. For more information about hardware flow control, see the hardware manual that was shipped with your router.

Command Description:

To set the method of data flow control between the terminal or other serial device and the router, use the flowcontrol line configuration command. Use the no form of this command to disable flow control.

Example:

The following command sets the flow control for the line to hardware.
Router(config-line)#flowcontrol hardware

Misconceptions:
None

Related Commands:
speed
transport input
transport output
login
password
flowcontrol
speed
stopbits


Command:

transport input

Mode:

Router(config-line)#

Syntax:

transport input {all | lat | mop | nasi | none | pad | rlogin | ssh | telnet | v120}

no transport input

Syntax Description:

all

Selects all protocols.

lat

Selects the Digital LAT protocol and specifies both incoming reverse LAT and host-initiated connections.

mop

Selects Maintenance Operation Protocol (MOP).

nasi

Select NetWare Access Servers Interface (NASI) as the input transport protocol.

none

Prevents any protocol selection on the line. This makes the port unusable by incoming connections.

pad

Selects X.3 PAD incoming connections.

rlogin

Selects the UNIX rlogin protocol.

ssh

Selects the Secure Shell (SSH) protocol.

telnet

Specifies all types of incoming TCP/IP connections.

v120

Select the V.120 protocol for incoming async over ISDN connections.

Command Description:

To define which protocols to use to connect to a specific line of the router, use the transport input line configuration command.

One protocol, multiple protocols, all protocols, or no protocols can be specified. To specify multiple protocols, enter the keyword for each protocol, separated by a space.

This command can be useful in distributing resources among different types of users, or making certain that only specific hosts can access a particular port. When using two-step protocol translation, the transport input command is useful in controlling exactly which protocols can be translated to other protocols.

Access lists for each individual protocol can be defined in addition to the allowances created by the transport input command. Any settings made with the transport input command override settings made with the transport preferred command.

Usage Guidelines:

Cisco routers do not accept incoming network connections to asynchronous ports (TTY lines) by default. An incoming transport protocol has to be specified, or specify transport input all before the line will accept incoming connections. For example, if you are using your router as a terminal server to make console-port connections to routers or other devices, you will not be able to use Telnet to connect to these devices. You will receive the message "Connection Refused." This behavior is new as of Cisco IOS Software Release 11.1. Previous to release 11.1, the default was transport input all. If upgrading to Cisco IOS software version 11.1(1) or later from Cisco IOS software Release 11.0 or earlier, the transport input {protocol | all} command must be added, otherwise the Telnet session will not function and router access will be denied.

Example:

The following example sets the incoming protocol to Telnet for vtys 0 to 4:

Router(config)#line vty 0 4

Router(config-line)#transport input telnet

Misconceptions:

None

Related commands:

transport output


Command:

transport output

Mode:

Router(config-line)#

Syntax:

transport output {all | lat | mop | nasi | none | pad | rlogin | telnet | v120}

no transport output

Syntax Description:

all

Selects all protocols.

lat

Selects the Digital LAT protocol, which is the protocol used most often to connect routers to Digital hosts.

mop

Selects Maintenance Operation Protocol (MOP).

nasi

Select NetWare Access Server Interface (NASI) as the output transport protocol.

none

Prevents any protocol selection on the line. The system normally assumes that any unrecognized command is a host name. If the protocol is set to none, the system no longer makes that assumption. No connection will be attempted if the command is not recognized.

pad

Selects X.3 PAD, used most often to connect routers to X.25 hosts.

rlogin

Selects the UNIX rlogin protocol for TCP connections. The rlogin setting is a special case of Telnet. If an rlogin attempt to a particular host has failed, the failure will be tracked, and subsequent connection attempts will use Telnet instead.

telnet

Selects the TCP/IP Telnet protocol. It allows a user at one site to establish a TCP connection to a login server at another site.

v120

Select the V.120 protocol for outgoing asynchronous over ISDN connections.

Command Description:

To determine the protocols that can be used for outgoing connections from a line, use the transport output line configuration command. The default setting is Telnet.

You can specify one protocol, multiple protocols, all protocols, or no protocols. To specify multiple protocols, enter the keyword for each protocol, separated by a space.

Any settings made with the transport output command override settings made with the transport preferred command.

Example:

The following example prevents any protocol selection:

Router(config-line)#transport output none

Misconceptions:

None

Related commands:

transport input


 Command:

debug confmodem

Mode:

Router#

Syntax:

debug confmodem

no debug confmodem

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information associated with the discovery and configuration of the modem attached to the router, use the debug confmodem privileged EXEC command. The no form of this command disables debugging output.

Usage Guidelines:

The debug confmodem command is used in debugging configurations that use the modem autoconfig command.

Example:

The following is a sample of debug confmodem output. In the first three lines, the router is searching for a speed at which it can communicate with the modem. The remaining lines show the actual sending of the modem command.

Router#debug confmodem

TTY4:detection speed(115200) response ------
TTY4:detection speed(57600) response ------
TTY4:detection speed(38400) response ---OK---
TTY4:Modem command: --AT&F&C1&D2S180=3S190=1S0=1--
TTY4: Modem configuration succeeded
TTY4: Done with modem configuration

Misconceptions:

None

Related Commands:
modem autoconfigure type
modem autoconfigure discovery
debug all


Command:

debug atm events

Mode:

Router#

Syntax:

debug atm events

no debug atm events

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the debug atm events privileged EXEC command to display ATM events. The no form of this command disables debugging output.

This command displays ATM events that occur on the ATM interface processor and is useful for diagnosing problems in an ATM network. It provides an overall picture of the stability of the network. In a stable network, the debug atm events command does not return any information. If the command generates numerous messages, the messages can indicate the possible source of problems.

When configuring or making changes to a router or interface for ATM, debug atm events. Doing so alerts you to the progress of the changes or to any errors that might result. Also use this command periodically when you suspect network problems.

Example:

The following is sample output from the debug atm events command:

Router#debug atm events
RESET(ATM4/0): PLIM type is 1, Rate is 100Mbps
aip_disable(ATM4/0): state=1
config(ATM4/0)
aip_love_note(ATM4/0): asr=0x201
aip_enable(ATM4/0)
aip_love_note(ATM4/0): asr=0x4000
aip_enable(ATM4/0): restarting VCs: 7
aip_setup_vc(ATM4/0): vc:1 vpi:1 vci:1
aip_love_note(ATM4/0): asr=0x200
aip_setup_vc(ATM4/0): vc:2 vpi:2 vci:2
aip_love_note(ATM4/0): asr=0x200
aip_setup_vc(ATM4/0): vc:3 vpi:3 vci:3
aip_love_note(ATM4/0): asr=0x200
aip_setup_vc(ATM4/0): vc:4 vpi:4 vci:4
aip_love_note(ATM4/0): asr=0x200
aip_setup_vc(ATM4/0): vc:6 vpi:6 vci:6
aip_love_note(ATM4/0): asr=0x200
aip_setup_vc(ATM4/0): vc:7 vpi:7 vci:7
aip_love_note(ATM4/0): asr=0x200
aip_setup_vc(ATM4/0): vc:11 vpi:11 vci:11
aip_love_note(ATM4/0): asr=0x200

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

debug packet

Mode:

Router#

Syntax:

debug packet [interface number [vcd vcd-number] | vc vpi/vci | vc-name]

no debug packet [interface number [vcd vcd-number] | vc vpi/vci | vc-name]

Syntax Description:

interface number | (Optional) interface or subinterface number.
vcd vcd-number | (Optional) Number of the virtual circuit designator (VCD).
vc vpi/vci | (Optional) VPI and VCI numbers of the VC.
vc-name | (Optional) Name of the PVC or SVC.

Command Description:

To display per-packet debugging output, use the debug packet privileged EXEC command. The no form of this command disables debugging output.

The debug packet command displays all process-level packets for both outbound and inbound packets. This command is useful for determining whether packets are being received and sent correctly. The output reports information online when a packet is received or a transmission is attempted.

For sent packets, the information is displayed only after the protocol data unit (PDU) is entirely encapsulated and a next hop VC is found. If information is not displayed, the address translation probably failed during encapsulation. When a next hop VC is found, the packet is displayed exactly as it will be presented on the wire. Having a display indicates that the packets are properly encapsulated for transmission.

For received packets, information is displayed for all incoming frames. The display can show whether the sending station properly encapsulates the frames. Because all incoming frames are displayed, this information is useful when performing back-to-back testing and corrupted frames cannot be dropped by an intermediary switch.

The debug packet command also displays the initial bytes of the actual PDU in hexadecimal. This information can be decoded only by qualified support or engineering personnel.

Because the debug packet command generates a substantial amount of output for every packet processed, use it only when traffic on the network is low, so other activity on the system is not adversely affected.

Example:

The following is sample output from the debug packet command:

Router# debug packet
2/0.5(I): VCD:0x9 VCI:0x23 Type:0x0 SAP:AAAA CTL:03 OUI:000000 TYPE:0800 Length0x70
4500 002E 0000 0000 0209 92ED 836C A26E FFFF FFFF 1108 006D 0001 0000 0000
A5CC 6CA2 0000 000A 0000 6411 76FF 0100 6C08 00FF FFFF 0003 E805 DCFF 0105

The following two lines of output are the binary data, which are the contents of the protocol PDU before
encapsulation:
4500 002E 0000 0000 0209 92ED 836C A26E FFFF FFFF 1108 006D 0001 0000 0000
A5CC 6CA2 0000 000A 0000 6411 76FF 0100 6C08 00FF FFFF 0003 E805 DCFF 0105

Router# debug packet
Ethernet0: Unknown ARPA, src 0000.0c00.6fa4, dst ffff.ffff.ffff, type 0x0a0
data 00000c00f23a00000c00ab45, len 60
Serial3: Unknown HDLC, size 64, type 0xaaaa, flags 0x0F00
Serial2: Unknown PPP, size 128
Serial7: Unknown FRAME-RELAY, size 174, type 0x5865, DLCI 7a
Serial0: compressed TCP/IP packet dropped

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

dsl operating-mode

Mode:

Router(config-if)#

Syntax:

dsl operating-mode {auto | ansi-dmt | itu-dmt | splitterless}

no dsl operating-mode {auto | ansi-dmt | itu-dmt}

Syntax Description:

auto | Configures the ADSL line after auto-negotiating with the DSL access multiplexer (DSLAM) located at the central office. This is the default operating mode.
ansi-dmt | Configures the ADSL line to use the ANSI T1.413 Issue 2 mode.
itu-dmt | Configures the ADSL line to use the G.992.1 mode.
splitterless | Configures the ADSL line to use the G.992.2 (G.lite) mode.

Command Description:

To modify the operating mode of the digital subscriber line for an ATM interface, use the dsl operating-mode command in interface configuration mode. To reset the operating mode to the default, use the no form of this command.

Example:

In the following example, the ADSL line is configured to use the G.992.1 mode:

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#interface atm 0

Router(config-if)#dsl operating-mode itu-dmt

Router(config-if)#end

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


Command:

encapsulation

Mode:

Router(config-if)#

Syntax:

encapsulation encapsulation-type

no encapsulation encapsulation-type

Syntax Description:

encapsulation-type

Encapsulation type; one of the following keywords:

  • atm-dxi—ATM Mode-Data Exchange Interface.
  • bstun—Block Serial Tunnel.
  • frame-relay—Frame Relay (for serial interface).
  • hdlc—High-Level Data Link Control (HDLC) protocol for serial interface. This encapsulation method provides the synchronous framing and error detection functions of HDLC without windowing or retransmission. This is the default for synchronous serial interfaces.
  • isl—Inter-Switch Link (ISL) (for virtual LANs).
  • lapb—X.25 Link Access Procedure, Balanced. Data link layer protocol (LAPB) DTE operation (for serial interface).
  • ppp—PPP (for serial interface).
  • sdlc—IBM serial Systems Network Architecture (SNA).
  • sdlc-primary—IBM serial SNA (for primary serial interface).
  • sdlc-secondary—IBM serial SNA (for secondary serial interface).
  • slip—Specifies Serial Line Internet Protocol (SLIP) encapsulation for an interface configured for dedicated asynchronous mode or dial-on-demand routing (DDR). This is the default for asynchronous interfaces.
smds—Switched Multimegabit Data Services (SMDS) (for serial interface).

Defaults

The default depends on the type of interface. For example, synchronous serial interfaces default to HDLC and asynchronous interfaces default to SLIP.

Command Description:

To set the encapsulation method used by the interface, use the encapsulation command in interface configuration mode. To remove the encapsulation use the no form of this command.

Example:

The following example resets HDLC serial encapsulation on serial interface 1:

Router(config)#interface serial 1

Router(config-if)#encapsulation hdlc

The following example enables PPP encapsulation on serial interface 0:

Router(config)#interface serial 0

Router(config-if)#encapsulation ppp

In the following example, async interface 1 is configured for PPP encapsulation:

Router#configure terminal

Configuring from terminal, memory, or network [terminal]?

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#interface async 1

 Router(config-if)#encapsulation ppp

Misconceptions:

None.

Related Commands:

keepalive (LMI)


%command%

Command:

pvc

Mode:

Router(config-if)#

Syntax:

pvc [name] vpi/vci [ces ilmi | qsaal | smds]

no pvc [name] vpi/vci [ces | ilmi | qsaal | smds]

Syntax Description:

name

(Optional) The name of the PVC or map. The name can be up to 15 characters long.

vpi/

ATM network virtual path identifier (VPI) for this PVC. The absence of the "/" and a vpi value defaults the vpivalue to 0.

On the Cisco 7200 and 7500 series routers, this value ranges from 0 to 255; on the Cisco 4500 and 4700 routers, this value ranges from 0 to 1 less than the quotient of 8192 divided by the value set by the atm vc-per-vp command; on 2600 and 3600 series routers using Inverse Multiplexing for ATM (IMA), the ranges are 0 to 15, 64 to 79, 128 to 143, and 192 to 207.

The arguments vpi and vci cannot both be set to 0; if one is 0, the other cannot be 0.

vci

ATM network virtual channel identifier (VCI) for this PVC. This value ranges from 0 to 1 less than the maximum value set for this interface by the atm vc-per-vp command. Typically, lower values 0 to 31 are reserved for specific traffic (for example, F4 OAM, SVC signalling, ILMI, and so on) and should not be used.

The VCI is a 16-bit field in the header of the ATM cell. The VCI value is unique only on a single link, not throughout the ATM network, because it has local significance only.

The arguments vpi and vci cannot both be set to 0; if one is 0, the other cannot be 0.

ces

(Optional) Circuit Emulation Service encapsulation. This keyword is available on the OC-3/STM-1 ATM Circuit Emulation Service network module only.

ilmi

(Optional) Used to set up communication with the Interim Local Management Interface (ILMI); the associated vpi and vci values ordinarily are 0 and 16, respectively.

qsaal

(Optional) A signalling-type PVC used for setting up or tearing down SVCs; the associated vpi and vci values ordinarily are 0 and 5, respectively.

smds

(Optional) Encapsulation for SMDS networks. If you are configuring an ATM PVC on the ATM Interface Processor (AIP), you must configure AAL3/4SMDS using the atm aal aal3/4 command before specifying smds encapsulation. If you are configuring an ATM network processor module (NPM), the atm aal aal3/4 command is not required. SMDS encapsulation is not supported on the ATM port adapter.

Command Description:

To create or assign a name to an ATM permanent virtual circuit (PVC), to specify the encapsulation type on an ATM PVC, and to enter interface-ATM-VC configuration mode, use the pvc command in interface or subinterface configuration mode. To remove an ATM PVC, use the no form of this command.

Example:

The following example creates a PVC with VPI 0 and VCI 16, and communication is set up with the ILMI:

pvc cisco 0/16 ilmi

exit

The following example creates a PVC used for ATM signalling for an SVC. It specifies VPI 0 and VCI 5:

pvc cisco 0/5 qsaal

exit

The following example configures the PVC called "cisco" to use class-based weighted fair queueing (CBWFQ). It attaches a policy map called "policy1" to the PVC. The classes the make up "policy1" determine the service policy for the PVC:

pvc cisco 0/5
service-policy output policy1

vbr-nrt 2000 2000
encap aal5snap

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show dsl interface atm

Mode:

Router#
Router>

Syntax:

show dsl interface atm number

Syntax Description:

number

ATM interface number.

Command Description:

To display information specific to the the asymmetric digital subscriber line (ADSL) for a specified ATM interface, use the show dsl interface atm command in EXEC mode.

Example:

Router# show dsl interface atm0

Alcatel 20150 chipset information

ATU-R (DS) ATU-C (US)

Modem Status: Showtime (DMTDSL_SHOWTIME)

DSL Mode: ITU G.992.1 (G.DMT)

ITU STD NUM: 0x01 0x1

Vendor ID: 'ALCB' 'ALCB'

Vendor Specific: 0x0000 0x0000

Vendor Country: 0x00 0x0F

Capacity Used: 85% 98%

Noise Margin: 13.5 dB 7.0 dB

Output Power: 9.5 dBm 12.0 dBm

Attenuation: 1.5 dB 3.5 dB

Defect Status: None None

Last Fail Code: None

Selftest Result: 0x00

Subfunction: 0x15

Interrupts: 5940 (0 spurious)

PHY Access Err: 0

Activations: 1

SW Version: 3.670

FW Version: 0x1A04

Interleave Fast Interleave Fast

Speed (kbps): 0 8128 0 864

Reed-Solomon EC: 0 0 0 0

CRC Errors: 0 0 0 7

Header Errors: 0 0 0 2

Bit Errors: 0 0

BER Valid sec: 0 0

BER Invalid sec: 0 0

DMT Bits Per Bin

00: 0 0 0 0 0 0 0 7 6 7 9 A B C C C

10: C C C C C C B B B B A 9 A 9 0 0

20: 0 0 0 0 0 0 2 2 3 4 4 5 6 6 7 7

30: 7 8 8 8 9 9 9 A A A A A A B B B

40: B B B B B B B B B B B A B B B B

50: B B B B B B B B B B B B 2 B B B

60: B B B B B B B B B B B B B B B B

70: B B B B B B B B B B B B B B B B

80: B B B B B B B B B B B B B B B B

90: B B B B B B B B B B B B B B B B

A0: B B B B B B B B B B B B B B B B

B0: B B B B B B B B B B B B A B A A

C0: A A A A A A A A A A A A A A A A

D0: A A A A A A A A A A A 9 9 9 9 9

E0: 9 9 9 9 9 9 9 9 9 9 9 9 8 8 8 8

F0: 8 8 8 8 8 8 7 7 7 7 6 6 5 5 4 4

Misconceptions:

None

Related commands:

dsl operating-mode

© Cisco Systems, Inc. 2001, 2002


Command:

backup delay

Mode:

Router(config-if)#

Syntax:

backup delay {enable-delay | never }{disable-delay | never}

no backup delay {enable-delay | never }{disable-delay | never}

Syntax Description:

enable-delay

Number of seconds that elapse after the primary line goes down before the Cisco IOS software activates the secondary line

disable-delay

Number of seconds that elapse after the primary line comes up before the Cisco IOS software deactivates the secondary line

never

Prevents the secondary line from being activated or deactivated

Command Description:

To define how much time should elapse before a secondary line status changes after a primary line status has changed, use the backup delay interface configuration command. Use the no form of this command to return to the default, so that as soon as the primary fails, the secondary is immediately brought up without delay.

For environments in which false signal disruptions appear as intermittent lost carrier signals, we recommend that you enable some delay before activating and deactivating a secondary line.

Example:

The following example sets a 10-second delay on deactivating the secondary line (serial interface 0). However, line S0 is activated immediately.

Router(config)#interface serial 0
Router(config-if)#backup delay 0 10

Misconceptions:

None

Related Commands:

None


Command:

backup interface

Mode:

Router(config-if)#

Syntax:

backup interface type number

no backup interface type number

Syntax Description:

type  number

Interface type and port number to use as the backup interface

Command Description:

To configure an interface as a secondary or dial backup, use the backup interface interface configuration command. Use the no form of this command to disable this feature. The interface you define with this command can back up only one other interface. Routers support only serial and ISDN backup interfaces. Access servers support both asynchronous and serial backup interfaces.

Example:

The following example sets serial 1 as the backup line to serial 0:

Router(config)#interface serial 0
Router(config-if)#backup interface serial 1

The following example on the Cisco 7200 sets serial 2/2 as the backup line to
serial 1/1:

Router(config)#interface serial 1/1
Router(config-if)#backup interface serial 2/2

Misconceptions:

None

Related Commands:

None


Command:

backup load

Mode:

Router(config-if)#

Syntax:

backup load {enable-threshold | never }{disable-load | never}

no backup load {enable-threshold | never }{disable-load | never}

Syntax Description:

enable-threshold

Percentage of the primary line's available bandwidth that the traffic load must exceed to enable dial backup

disable-load

Percentage of the primary line's available bandwidth that the traffic load must be less than to disable dial backup

never

The secondary line will never be activated due to traffic load.

Command Description:

To set a traffic load threshold for dial backup service, use the backup load interface configuration command. Use the no form of this command to return to the default value. The default has no predefined threshold.

When the transmitted or received load on the primary line is greater than the value assigned to the enable-threshold argument, the secondary line is enabled.

The secondary line is disabled when one of the following conditions occurs:

  • The transmitted load on the primary line plus the transmitted load on the secondary line is less than the value entered for the disable-load argument.
  • The received load on the primary line plus the received load on the secondary line is less than the value entered for the disable-load argument.

If the never keyword is used instead of an enable-threshold value, the secondary line is never activated because of traffic load. If the never keyword is used instead of a disable-load argument, the secondary line is never activated because of traffic load.

Example:

The following example sets the traffic load threshold to 60 percent of the primary line, serial 0. When that load is exceeded, the secondary line, serial 1, is activated, and will not be deactivated until the combined load is less than 5 percent of the primary bandwidth.

Router(config)#interface serial 0
Router(config-if)#backup load 60 5
Router(config-if)#backup interface serial 1

Misconceptions:

None

Related Commands:

backup interface


Command:

traffic-share

Mode:

Router(config-router)#

Syntax:

traffic-share {balanced | min}

no traffic share {balanced | min}

Syntax Description:

balanced

Distributes traffic proportionately to the ratios of the metrics

min

Uses routes that have minimum costs

Command Description:

When there are multiple routes for the same destination network that have different costs, use the traffic-share router configuration command. This command will control how traffic is distributed among the routes. To disable this function, use the no form of the command.

Usage Guidelines:

This command applies to IGRP and EIGRP routing protocols only. With the default setting, routes that have higher metrics represent less-preferable routes and get less traffic. Configuring traffic-share min causes the Cisco IOS software to divide traffic only among the routes with the best metric. Other routes will remain in the routing table, but will receive no traffic.

Example:

In the following example, only routes of minimum cost will be used:

Router(config)#router igrp 5

Router(config-router)#traffic-share min

Misconceptions:

None

Related commands:

None


 Command:

variance

Mode:

Router(config-router)#

Syntax:
variance multiplier

no variance

Syntax Description:

multiplier

A metric value used for load balancing. It can be a value from 1 to 128. The default is 1, which means equal-cost load balancing.

Command Description:

To control load balancing in an EIGRP-based internetwork, use the variance router configuration command. The variance value determines whether IGRP will accept unequal-cost routes. An IGRP router will only accept routes equal to the local best metric for the destination multiplied by the variance value.To reset the variance to the default value, use the no form of this command.

Usage Guidelines:

Setting a variance value lets the Cisco IOS software determine the feasibility of a potential route. A route is feasible if the next router in the path is closer to the destination than the current router and if the metric for the entire path is within the variance. Only paths that are feasible can be used for load balancing and included in the routing table.

If the following two conditions are met, the route is deemed feasible and can be added to the routing table:

    1. The local best metric must be greater than the metric learned from the next router.

    2. The multiplier times the local best metric for the destination must be greater than or equal to the metric through the next router.
Example:

The following example sets a variance value of 4:

Router(config)#router igrp 109
Router(config-router)#variance 4
Misconceptions:
None

Related commands:
None


Command:

address-family ipv4

Mode:

Router(config-router)#

Syntax:

address-family ipv4 [multicast | unicast | vrf vrf-name]

no address-family ipv4 [multicast | unicast | vrf vrf-name]

Syntax Description:

multicast

(Optional) Specifies IP Version 4 multicast address prefixes.

unicast

(Optional) Specifies IP Version 4 unicast address prefixes.

vrf vrf-name

(Optional) Specifies the name of the virtual routing and forwarding (VRF) instance to associate with subsequent IP Version 4 address family configuration mode commands.

Command Description:

To enter address family configuration mode for configuring routing sessions such as BGP that use standard IP Version 4 address prefixes, use the address-family ipv4 router configuration command. To disable address family configuration mode, use the no form of this command.

Usage Guidelines:

The address-family ipv4 command places the router in address family configuration mode, from which you can configure routing sessions that use standard IP Version 4 address prefixes. To leave address family configuration mode and return to router configuration mode, type exit.

Routing information for address family IP Version 4 is advertised by default when you configure a BGP routing session using the neighbor remote-as command unless you enter the no bgp default ipv4-unicast command.

The address-family ipv4 command replaces the match nlri and set nlri commands.

Example:

The following example places the router in address family configuration mode for the IP Version 4 address family:

Router(config)# router bgp 100
Router(config-router)# address-family ipv4
Router(config-router-af)#

The following example places the router in address family configuration mode and specifies multicast address prefixes for the IP Version 4 address family:

Router(config)# router bgp 100
Router(config-router)# address-family ipv4 multicast
Router(config-router-af)#

The following example places the router in address family configuration mode and specifies unicast address prefixes for the IP Version 4 address family:

Router(config)# router bgp 100
Router(config-router)# address-family ipv4 unicast
Router(config-router-af)#

The following example places the router in address family configuration mode and specifies cisco as the name of the VRF instance to associate with subsequent IP Version 4 address family configuration mode commands:

Router(config)# router bgp 100
Router(config-router)# address-family ipv4 vrf cisco
Router(config-router-af)#

Misconceptions:

None

Related Commands:

network (BGP)

neighbor weight

neighbor route-reflector-client

neighbor route-map

neighbor prefix-list

neighbor peer-group (creating)

neighbor peer-group (assigning members)

neighbor filter-list

neighbor advertisement-interval

maximum-paths

aggregate-address

neighbor advertisement-interval


Command:

aggregate-address

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

aggregate-address address mask [as-set] [summary-only] [suppress-map map-name] [advertise-map map-name] [attribute-map map-name]

no aggregate-address address mask [as-set] [summary-only] [suppress-map map-name] [advertise-map map-name] [attribute-map map-name]

Syntax Description:

as-set

Generates autonomous system set path information

summary-only

Filters all more-specific routes from updates

suppress-map

Name of the route map used to select the routes to be suppressed

advertise-map

Name of the route map used to select the routes to create AS_SET origin communities

attribute-map

Name of route map used to set the attribute of the aggregate route

Command Description:

To create an aggregate entry in a BGP or multicast BGP database, use the aggregate-address command in address family or router configuration mode.

Example:

The following example shows how to create the aggregate route for 193.*.*.*, and also suppress advertisements of more specific routes to all neighbors:

  Router(config)#router bgp 5
  Router(config-router)#aggregate-address 193.0.0.0 255.0.0.0 summary-only

In the following example, a multiprotocol BGP aggregate address is created in address family configuration mode and applied to the multicast database only using an IP Version 4 address family. More-specific routes are filtered from updates.

  Router(config)#router bgp 5
  Router(config-router)#address-family ipv4 multicast
  Router(config-router-af)#aggregate-address 193.0.0.0 255.0.0.0 summary-only

Misconceptions:

None

Related Commands:

address-family ipv4


 Command:

bgp always-compare-med

Mode:

Router(config-router)#

Syntax:

bgp always-compare-med

no bgp always-compare-med

Syntax Description:

This command has no arguments or keywords.

Command Description:

To allow the comparison of the Multi Exit Discriminator (MED) for paths from neighbors in different autonomous systems, use the bgp always-compare-med router configuration command. To disallow the comparison, use the no form of this command.

Example:

The following example configures the BGP speaker in autonomous system 109 to compare MEDs among alternative paths, regardless of the autonomous system from which the paths are received:

Router(config)#router bgp  109
Router(config-router)#bgp always-compare-med

Misconceptions:
None

Related Commands:
None


Command:

bgp bestpath as-path ignore

Mode:

Router(config-router)#

Syntax:

bgp bestpath as-path ignore
 no bgp bestpath as-path ignore

Syntax Description:

This command has no arguments or keywords.

Command Description:

To prevent the router from considering as-path as a factor in the algorithm for choosing a route, use the bgp bestpath as-path ignore command in router configuration mode. To allow the router to consider as-path in choosing a route, use the no form of this command.

By default, the router considers as-path in choosing a route.

Example:

The following example prevents the BGP router from considering as-path as a factor in choosing a route:

Router(config-router)# bgp bestpath as-path ignore

Misconceptions:

None

Related Commands:

show ip bgp ipv4


Command:

bgp bestpath compare-routerid

Mode:

Router(config-router)#

Syntax:

bgp bestpath compare-routerid
 no bgp bestpath compare-routerid

Syntax Description:

This command has no arguments or keywords.

Command Description:

To compare similar routes received from external BGP (eBGP) peers during the best path selection process and switch the best path to the route with the lowest router ID, use the bgp bestpath compare-routerid command in router configuration mode. To return the router to the default setting, use the no form of this command.

By default, the Border Gateway Protocol (BGP) does not compare similar paths received from eBGP peers during the best path selection process and switch the best path to the route with the lowest router ID.

By default, during the best path selection process, when BGP receives similar routes from eBGP peers (all the attributes are the same except for the router ID), the best path is not switched to the route with the lowest router ID if that route was not the first route received. If the bgp bestpath compare-routerid command is enabled, then similar routes are compared and the best path is switched to the route with the lowest router ID.

Example:

The following example shows the BGP speaker in autonomous system 500 configured to compare the router IDs of similar paths, regardless of the autonomous system from which the paths are received:

Router(config-router)# bgp bestpath compare-routerid

Misconceptions:

None

Related Commands:

show ip bgp


Command:

bgp bestpath med confed

Mode:

Router(config-router)#

Syntax:

bgp bestpath med confed
 no bgp bestpath med confed

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable Multi Exit Discriminator (MED) comparison among paths learned from confederation peers, use the bgp bestpath med confed command in router configuration mode. To prevent the software from considering the MED attribute in comparing paths, use the no form of this command.

By default, the software does not consider the MED attribute when choosing among paths learned from confederation peers.

The comparison between MEDs is made only if no external autonomous systems are in the path (an external autonomous system is an autonomous system that is not within the confederation). If an external autonomous system in the path, then the external MED is passed transparently through the confederation, and the comparison is not made.

For example, assume that autonomous system 65000, 65001, 65002, and 65004 are part of the confederation; autonomous system 1 is not; and we are comparing route A with four paths. If the bgp bestpath med confed command is enabled, path 1 would be chosen. The fourth path has a lower MED, but it is not involved in the MED comparison because there is an external autonomous system in this path. The following list displays the MED for each autonomous system.

path = 65000 65004, med = 2

path = 65001 65004, med = 3

path = 65002 65004, med = 4

path = 65003 1, med = 1

Example:

The following command enables the BGP router to compare MED values for paths learned from confederation peers:

Router(config-router)# bgp bestpath med confed

Misconceptions:

None

Related Commands:

show ip bgp
show ip bgp ipv4


Command:

bgp bestpath med missing-as-worst

Mode:

Router(config-router)#

Syntax:

bgp bestpath med missing-as-worst

no bgp bestpath med missing-as-worst

Syntax Description:

This command has no arguments or keywords.

Command Description:

To have Cisco IOS software consider a missing Multi Exit Discriminator (MED) attribute in a path as having a value of infinity, making the path without a MED value the least desirable path, use the bgp bestpath med missing-as-worst command in router configuration mode. To return the router to the default (assign a value of 0 to the missing MED), use the no form of this command.

By default, the software assigns a value of 0 to the missing MED, causing the path with the missing MED attribute to be considered the best path.

Example:

The following example specifies the BGP router to consider a missing MED attribute in a path as having a value of infinity, making this path the least desirable path:

Router(config-router)#bgp bestpath med missing-as-worst

Misconceptions:

None

Related Commands:

show ip bgp
show ip bgp ipv4


Command:

bgp client-to-client reflection

Mode:

Router(config-router)#
Router(config-router-af)#

Syntax:

bgp client-to-client reflection
 no bgp client-to-client reflection

Syntax Description:

This command has no arguments or keywords.

Command Description:

To restore route reflection from a BGP route reflector to clients, use the bgp client-to-client reflection command in address family or router configuration mode. To disable client-to-client reflection, use the no form of this command.

By default, when a route reflector is configured, the route reflector reflects routes from a client to other clients.

By default, the clients of a route reflector are not required to be fully meshed and the routes from a client are reflected to other clients. However, if the clients are fully meshed, route reflection is not required. Use the no bgp client-to-client reflection command to disable client-to-client reflection.

Example:

In the following router configuration mode example, the local router is a route reflector. The three neighbors are fully meshed, so client-to-client reflection is disabled:

Router(config)#router bgp 5
Router(config-router)#neighbor 10.24.95.22 route-reflector-client
Router(config-router)#neighbor 10.24.95.23 route-reflector-client
Router(config-router)#neighbor 10.24.95.24 route-reflector-client
Router(config-router)#no bgp client-to-client reflection

Misconceptions:

None

Related Commands:

show ip bgp


Command:

bgp cluster-id

Mode:

Router(config-router)#

Syntax:

bgp cluster-id cluster-id
no bgp cluster-id cluster-id

Syntax Description:

cluster-id

Cluster ID of this router acting as a route reflector; maximum of 4 bytes.

Command Description:

To configure the cluster ID if the BGP cluster has more than one route reflector, use the bgp cluster-id command in router configuration mode. To remove the cluster ID, use the no form of this command.

Together, a route reflector and its clients form a cluster.

Usually a cluster of clients will have a single route reflector. In that case, the cluster is identified by the router ID of the route reflector. In order to increase redundancy and avoid a single point of failure, a cluster might have more than one route reflector. In this case, all route reflectors in the cluster must be configured with the 4-byte cluster ID so that a route reflector can recognize updates from route reflectors in the same cluster.

If the cluster has more than one route reflector, use this command to configure the cluster ID.

Example:

In the following example, the local router is one of the route reflectors serving the cluster. It is configured with the cluster ID to identify the cluster:

Router(config)# router bgp 5
Router(config-router)# neighbor 198.92.70.24 route-reflector-client
Router(config-router)# bgp cluster-id 50000

Misconceptions:

None

Related Commands:

bgp client-to-client reflection
show ip bgp


Command:

bgp confederation identifier

Mode:

Router(config-router)#

Syntax:

bgp confederation identifier as-number
no bgp confederation identifier as-number

Syntax Description:

as-number

Autonomous system number that internally includes multiple autonomous systems.

Command Description:

To specify a BGP confederation identifier, use the bgp confederation identifier command in router configuration mode. To remove the confederation identifier, use the no form of this command.

One way to reduce the internal BGP (iBGP) mesh is to divide an autonomous system into multiple autonomous systems and group them into a single confederation. Each autonomous system is fully meshed within itself and has a few connections to another autonomous system in the same confederation. Even though the peers in different autonomous systems have external BGP (eBGP) sessions, they exchange routing information as if they are iBGP peers. Specifically, the next hop, Multi Exit Discriminator (MED), and local preference information is preserved. The preservation of this information enables to you to retain a single Interior Gateway Protocol (IGP) for all the autonomous systems. To the outside world, the confederation looks like a single autonomous system.

Example:

In the following example, the autonomous system is divided into autonomous systems 4001, 4002, 4003, 4004, 4005, 4006, and 4007 and identified by the confederation identifier 5. Neighbor 10.2.3.4 is someone inside your routing domain confederation. Neighbor 10.4.5.6 is someone outside your routing domain confederation. To the outside world, there appears to be a single autonomous system with the number 5:

Router(config)#router bgp 4001
Router(config-router)#bgp confederation identifier 5
Router(config-router)#bgp confederation peers 4002 4003 4004 4005 4006 4007
Router(config-router)#neighbor 10.2.3.4 remote-as 4002
Router(config-router)#neighbor 10.4.5.6 remote-as 510

Misconceptions:

None

Related Commands:

bgp confederation peers


Command:

bgp confederation peers

Mode:

Router(config-router)#

Syntax:

bgp confederation peers as-number [... as-number]

no bgp confederation peers as-number [... as-number]

Syntax Description:

as-number

Autonomous system numbers for BGP peers that will belong to the confederation.

Command Description:

To configure the autonomous systems that belong to the confederation, use the bgp confederation peers command in router configuration mode. To remove an autonomous system from the confederation, use the no form of this command.

By default, no BGP peers are identified as belonging to the confederation.

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the as-number argument.

The autonomous systems specified in this command are visible internally to a confederation. Each autonomous system is fully meshed within itself. The bgp confederation identifier command specifies the confederation to which the autonomous systems belong.

Example:

The following example specifies that autonomous systems 1090, 1091, 1092, and 1093 belong to a single confederation:

Router(config)#router bgp 1090
Router(config-router)#bgp confederation peers 1091 1092 1093

Misconceptions:

None

Related Commands:

bgp confederation identifier


Command:

bgp dampening

Mode:

Router(config-router)#

Syntax:

bgp dampening [half-life reuse suppress max-suppress-time] [route-map map-name]

no bgp dampening [half-life reuse suppress max-suppress-time] [route-map map-name]

Syntax Description:

half-life

(Optional) Time (in minutes) after which a penalty is decreased. Once the route has been assigned a penalty, the penalty is decreased by half after the half-life period (which is 15 minutes by default). The process of reducing the penalty happens every 5 seconds. The range of the half-life period is 1 to 45 minutes. The default is 15 minutes.

reuse

(Optional) Reuse values based on accumulated penalties. If the penalty for a flapping route decreases enough to fall below this value, the route is unsuppressed. The process of unsuppressing routes occurs at 10-second increments. The range of the reuse value is from 1 to 20000; the default is 750.

suppress

(Optional) A route is suppressed when its penalty exceeds this limit. The range is from 1 to 20000; the default is 2000.

max-suppress-time

(Optional) Maximum time (in minutes) a route can be suppressed. The range is from 1 to 20000; the default is 4 times the half-life. If the half-life value is allowed to default, the maximum suppress time defaults to 60 minutes. When the max-suppress-time is configured, the maximum penalty will never be exceeded, regardless of the number of times that the prefix dampens. The maximum penalty is computed with the following formula:

Max penalty = reuse-limit *2^(maximum suppress time/half time)

route-map map-name

(Optional) Name of route map that controls where BGP route dampening is enabled.

Command Description:

To enable BGP route dampening or change various BGP route dampening factors, use the bgp dampening command in address family or router configuration mode. To disable the function or restore the default values, use the no form of this command.

If this command is used with no arguments, it enables BGP route dampening. The half-life, reuse, suppress, and max-suppress-time arguments are position-dependent. Therefore, if any of these arguments are issued, they must all be specified.

When BGP dampening is configured and a prefix is withdrawn, BGP considers the withdrawn prefix as a flap and increases the penalty by a 1000. If BGP receives an attribute change, BGP increases the penalty by 500. If then the prefix has been withdrawn, BGP keeps the prefix in the BGP table as a history entry. If the prefix has not been withdrawn by the neighbor and BGP is not using this prefix, the prefix is marked as dampened. Dampened prefixes are not used in the BGP decision process and not installed to the routing table.

Example:

The following router configuration mode example sets the half life to 30 minutes, the reuse value to 1500, the suppress value to 10000, and the maximum suppress time to 120 minutes:

Router(config)#router bgp 5
Router(config-router)#bgp dampening 30 1500 10000 120

Misconceptions:

None

Related Commands:

clear ip bgp dampening
clear ip bgp flap-statistics
show ip bgp flap-statistics


Command:

bgp default ipv4-unicast

Mode:

Router(config-router)#
Router(config-router-af)#

Syntax:

bgp default ipv4-unicast
no bgp default ipv4-unicast

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the IP version 4 (IPv4) unicast address family on all neighbors, use the bgp default ipv4-unicast command in address family or router configuration mode. To disable the IPv4 unicast address family on all neighbors, use the no form of this command.

Use the neighbor activate address family configuration command for each neighbor you want to run the bgp default ipv4-unicast command for under the IPv4 unicast address family.

Example:

The following example enables IP version 4 unicast address family on all neighbors:

Router(config-router)# bgp default ipv4-unicast

Misconceptions:

None

Related Commands:

None


Command:

bgp default local-preference

Mode:

Router(config-router)#

Syntax:

bgp default local-preference value

no bgp default local-preference value

Syntax Description:

value

Local preference value range from 0 to 4294967295. A higher value is preferred.

Command Description:

To change the default local preference value, use the bgp default local-preference router configuration command. Local preference value from 0 to 429496729. Higher is more preferred.

Example:

The following example raises the default local preference value from the default of 100 to 200:

Router(config)#router bgp 200
Router(config-router)#bgp default local-preference 200

Misconceptions:

None

Related Commands:

None


Command:

bgp deterministic-med

Mode:

Router(config-router)#
Router(config-router-af)#

Syntax:

bgp deterministic med
no bgp deterministic med

Syntax Description:

This command has no arguments or keywords.

Command Description:

To have Cisco IOS software enforce the deterministic comparison of the Multi Exit Discriminator (MED) variable between all paths received from the same autonomous system, use the bgp deterministic-med command in router configuration mode. To disable the comparison, use the no form of this command.

By default, the software does not enforce the deterministic comparison of the MED variable between all paths received from the same autonomous system.

After the bgp always-compare-med command is configured, all paths for the same prefix that are received from different neighbors, which are in the same autonomous system, will be grouped together and sorted by the ascending MED value (received-only paths are ignored and not grouped or sorted). The best path selection algorithm will then pick the best paths using the existing rules; the comparison is made on a per neighbor autonomous system basis and then global basis. The grouping and sorting of paths occurs immediately after this command is entered. For correct results, all routers in the local autonomous system must have this command enabled (or disabled).

Example:

The following example specifies that the BGP router compare MED variables when choosing among routes advertised by the same subautonomous system within a confederation:

Router(config)# router bgp 204
Router(config-router)# bgp deterministic-med

The following example show ip bgp command output illustrates how route selection is affected by the configuration of the bgp deterministic-med command. The order in which routes are received affects how routes are selected for best path selection when the bgp deterministic-med command is not enabled.

The following sample output from the show ip bgp command shows three paths that are received for the same prefix (10.100.0.0), and the bgp deterministic-med command is not enabled:

Router# show ip bgp 10.100.0.0
BGP routing table entry for 10.100.0.0/16, version 40
Paths: (3 available, best #3, advertised over IBGP, EBGP)
  109
    192.168.43.10 from 192.168.43.10 (192.168.43.1)
      Origin IGP, metric 0, localpref 100, valid, internal
  2051
    192.168.43.22 from 192.168.43.22 (192.168.43.2)
      Origin IGP, metric 20, localpref 100, valid, internal
  2051
    192.168.43.3 from 192.168.43.3 (10.4.1.1)
      Origin IGP, metric 30, valid, external, best

If the bgp deterministic-med command is not enabled on the router, the route selection can be affected by the order in which the routes are received. Consider the following scenario in which a router received three paths for the same prefix:

The clear ip bgp * command is entered to clear all routes in the local routing table.

Router#clear ip bgp *

The show ip bgp command is issued again after the routing table has been repopulated. Note that the order of the paths changed after clearing the BGP session. The results of the selection algorithm also changed. This occurred because the order in which the paths were received was different for the second session.

Router#show ip bgp 10.100.0.0
BGP routing table entry for 10.100.0.0/16, version 2
Paths: (3 available, best #3, advertised over EBGP)
  109 192.168.43.10 from 192.168.43.10 (192.168.43.1)
      Origin IGP, metric 0, localpref 100, valid, internal
  2051
    192.168.43.3 from 192.168.43.3 (10.4.1.1)
      Origin IGP, metric 30, valid, external
  2051
    192.168.43.22 from 192.168.43.22 (192.168.43.2)
      Origin IGP, metric 20, localpref 100, valid, internal, best

If the bgp deterministic-med command is enabled, then the result of the selection algorithm will always be the same, regardless of the order in which the paths are received by the local router. The following output is always generated when the bgp deterministic-med command is entered on the local router in this scenario:

Router#show ip bgp 10.100.0.0
BGP routing table entry for 10.100.0.0/16, version 15
Paths: (3 available, best #1, advertised over EBGP)
  109
    192.168.43.10 from 192.168.43.10 (192.168.43.1)
      Origin IGP, metric 0, localpref 100, valid, internal, best 3
    192.168.43.22 from 192.168.43.22 (192.168.43.2)
      Origin IGP, metric 20, localpref 100, valid, internal 3
    192.168.43.3 from 192.168.43.3 (10.4.1.1)
      Origin IGP, metric 30, valid, external

Misconceptions:

None

Related Commands:

clear ip bgp
show ip bgp
show ip bgp neighbors


Command:

bgp fast-external-fallover

Mode:

Router(config-router)#
Router(config-router-af)#

Syntax:

bgp fast-external-fallover
no bgp fast-external-fallover

Syntax Description:

This command has no arguments or keywords.

Command Description:

To immediately reset the BGP sessions of any directly adjacent external peers if the link used to reach them goes down, use the bgp fast-external-fallover command in address family or router configuration mode. To disable this function, use the no form of this command.

The behavior of this command is enabled by default.

Example:

The following example disables the automatic resetting of BGP sessions in router configuration mode:

Router(config)# router bgp 109
Router(config-router)# no bgp fast-external-fallover

Misconceptions:

None

Related Commands:

None


Command:

bgp log-neighbor-changes

Mode:

Router(config-router)#
Router(config-router-af)#

Syntax:

bgp log-neighbor-changes
no bgp log-neighbor-changes

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable logging of BGP neighbor resets, use the bgp log-neighbor-changes command in address family or router configuration mode. To disable the logging of changes in BGP neighbor adjacencies, use the no form of this command.

BGP neighbor changes are logged by default in Cisco IOS Release 12.0(1) and later.

The bgp log-neighbor-changes command enables logging of BGP neighbor status changes (up or down) and resets for troubleshooting network connectivity problems and measuring network stability. Unexpected neighbor resets might indicate high error rates or high packet loss in the network and should be investigated.

Using the bgp log-neighbor-changes command to enable status change message logging does not cause a substantial performance impact, unlike, for example, enabling per BGP update debugging. If the UNIX syslog facility is enabled, messages are sent to the UNIX host running the syslog daemon so that the messages can be stored and archived. If the UNIX syslog facility is not enabled, the status change messages are retained in the internal buffer of the router, and are not stored to disk. You can set the size of this buffer, which is dependent upon the available RAM, using the logging buffered command.

The neighbor status change messages are not tracked if the bgp log-neighbor-changes command is not enabled, except for the reset reason, which is always available as output of the show ip bgp neighbors command.

The eigrp log-neighbor-changes command enables logging of Enhanced IGRP (EIGRP) neighbor adjacencies, but messages for BGP neighbors are logged only if they are specifically enabled with the bgp log-neighbor-changes command.

Use the show logging command to display the log for the BGP neighbor changes.

Example:

The following example logs neighbor changes for BGP in router configuration mode:

Router(config)# bgp router 100
Router(config-router)# bgp log-neighbor-changes

Misconceptions:

None

Related Commands:

logging buffered
show ip bgp ipv4
show ip bgp neighbors


Command:

bgp redistribute-internal

Mode:

Router(config-router)#

Syntax:

bgp redistribute-internal
no bgp redistribute-internal

Syntax Description:

This command has no arguments or keywords.

Command Description:

To allow the redistribution of iBGP routes into an interior gateway protocol such as IS-IS or OSPF, use the bgp redistribute-internal command in router configuration mode. To remove the bgp redistribute-internal command from the configuration file and restore the system to its default condition where the software does not allow the redistribution of iBGP routes into Interior Gateway Protocols (IGPs), use the no form of this command.

By default iBGP routes are not redistributed into IGPs.

Use of the bgp redistribute-internal command requires the clear ip bgp command to be issued to reset BGP connections.

Caution:Redistributing iBGP routes into IGPs may cause routing loops to form within an autonomous system. Use this command with caution.

Example:

The following example shows iBGP routes being redistributed into OSPF:

Router(config)# router ospf 300
Router(config-router)# redistribute bgp 200

Router(config)# router bgp 200
Router(config-router)# bgp redistribute-internal

Router#clear ip bgp *

Misconceptions:

None

Related Commands:

clear ip bgp


Command:

bgp router-id

Mode:

Router(config-router)#

Syntax:

bgp router-id ip-address
no bgp router-id ip-address

Syntax Description:

ip-address IP address of the router.

Command Description:

To configure a fixed router ID for a BGP-speaking router, use the bgp router-id command in router configuration mode. To remove the bgp router-id command from the configuration file and restore the default value of the router ID, use the no form of this command.

By default, the router ID is set to the IP address of a loopback interface if one is configured. If no virtual interfaces are configured, the highest IP address is configured for a physical interface on that router. Peering sessions will be reset if the router ID is changed.

Use this command to configure a fixed router ID as an identifier of the router running BGP. A loopback interface, if one is configured, is more effective than a fixed interface as an identifier because there is no physical link to go down.

Example:

The following example shows the local router configured with the router ID of 192.168.70.24:

Router(config)# router bgp 100
Router(config-router)# no synchronization
Router(config-router)# bgp router-id 192.168.70.24

Misconceptions:

None

Related Commands:

show ip bgp


Command:

bgp rr-group

Mode:

Router(config-router-af)#

Syntax:

bgp rr-group extcom-list-number
no bgp rr-group

Syntax Description:

extcom-list-number Number of a specific extended community-list that will be supported by the route-reflector group. The range of extended community-list numbers that can be specified is from 1 to 199. However, only one extended community-list is specified with the extcom-list-number argument.

Command Description:

To create a route-reflector group and enable automatic inbound filtering for VPN version 4 (VPNv4) updates based on the allowed route target (RT) extended communities, use the bgp rr-group command in address family configuration mode. To disable a route-reflector group or route reflector, use the no form of this command.

The bgp rr-group command can be used with the ip extcommunity-list command. The ip extcommunity-list command is used to create an extended community-list and specify a list of extended community RTs. Only extended community-lists are supported.

Use this command to configure a fixed router ID as an identifier of the router running BGP. A loopback interface, if one is configured, is more effective than a fixed interface as an identifier because there is no physical link to go down.

Example:

The following example configures a route-reflector group that will accept extended community-list number 500:

Router(config)# router bgp 101
Router(config-router)# address-family vpnv4
Router(config-router-af)# bgp rr-group 500

Misconceptions:

None

Related Commands:

None


Command:

clear ip bgp

Mode:

Router#

Syntax:

clear ip bgp {* | address | peer-group-name } [soft [in | out ]]

Syntax Description:

*

Resets all current BGP sessions

neighbor-address

Resets only the identified BGP neighbor.

peer-group-name

Resets the specified BGP peer group.

out

(Optional) Triggers outbound soft reconfiguration. If the in or out option is not specified, both inbound and outbound soft reset are triggered.

in

(Optional) Triggers inbound soft reconfiguration. If the in or out option is not specified, both inbound and outbound soft reset are triggered.

soft

(Optional) Soft reset. Does not reset the session.

Command Description:

To force BGP to clear its table and reset all BGP sessions or to reset individual BGP connections, use the clear ip bgp privileged EXEC command.

Usage Guidelines

If BGP soft reconfiguration is specified, by including the soft keyword, the sessions are not reset and the router sends all routing updates again. To generate new inbound updates without resetting the BGP session, the local BGP speaker should store all received updates without modification regardless of whether it is accepted by the inbound policy, using the neighbor soft-reconfiguration command. This process is memory intensive and should be avoided if possible. Outbound BGP soft configuration does not have any memory overhead. An outbound reconfiguration can be triggered on the other side of the BGP session to make the new inbound policy take effect.

Use this command whenever any of the following changes occur:

  • Additions or changes to the BGP-related access lists
  • Changes to BGP-related weights
  • Changes to BGP-related distribution lists
  • Changes in the BGP timer's specifications
  • Changes to the BGP administrative distance
  • Changes to BGP-related route maps

Example:

The following example resets all current BGP sessions:

Router#clear ip bgp *

The following example resets a specific BGP session:

Router#clear ip bgp 10.0.0.0

Misconceptions:

None

Related Commands:

show ip bgp

neighbor soft-reconfiguration


Command:

clear ip bgp dampening

Mode:

Router#

Syntax:

clear ip bgp dampening [ip-address network-mask]

Syntax Description:

ip-address | (Optional) IP address of the network about which to clear dampening information.
network-mask | (Optional) Network mask applied to the ip-address argument.

Command Description:

To clear BGP route dampening information and unsuppress the suppressed routes, use the clear ip bgp dampening command in Privileged EXEC mode.

Example:

The following example clears route dampening information about the route to network 192.168.0.0 and unsuppresses its suppressed routes. When the address and mask arguments are not specified, the clear ip bgp dampening command clears route dampening information for the entire BGP routing table:

Router#clear ip bgp dampening 192.168.0.0 255.255.0.0

Misconceptions:

None

Related Commands:

bgp dampening
show ip bgp dampened-paths


Command:

clear ip bgp external

Mode:

Router#

Syntax:

clear ip bgp external [in | out]

clear ip bgp external [soft [in | out]]

clear ip bgp external {ipv4 | ipv6 {multicast | unicast [in | out | soft]}}

clear ip bgp external [vpn4 unicast {in | out | soft}}

Syntax Description:

in | out | (Optional) Triggers inbound or outbound soft reconfiguration.
soft | (Optional) Triggers soft reconfiguration.
ipv4 | ipv6 | vpn4 | (Optional) Triggers reset of IPv4, IPv6, or VPNn4 address family session.
multicast | (Optional) Triggers reset of IPv4 or IPv6 multicast address family session.
unicast | (Optional) Triggers reset of IPv4, IPv6, or VPNv4 unicast family session.

Command Description:

To clear external Border Gateway Protocol (eBGP) peers, use the clear ip bgp external command in Privileged EXEC mode.

Using the clear ip bgp external command without the soft keyword will reset the session.

Example:

The following example clears an inbound session with the eBGP peers:

Router# clear ip bgp external in

or

Router# clear ip bgp external soft in

The following examples clear an outbound address family IPv4 multicast session with the eBGP peers:

Router# clear ip bgp external ipv4 multicast out

Misconceptions:

None

Related Commands:

clear ip bgp
show ip bgp


Command:

clear ip bgp flap-statistics

Mode:

Router#

Syntax:

clear ip bgp flap-statistics [{regexp regexp} | {filter-list list-name} | {ip-address network-mask}]

clear ip bgp [ip-address] flap-statistics

Syntax Description:

ip-address | (Optional) Clears flap statistics for a single entry at this IP address. If this argument is placed before flap-statistics, the router clears flap statistics for all paths from the neighbor at this address.
regexp regexp | (Optional) Clears flap statistics for all the paths that match the regular expression.
filter-list list-name | (Optional) Clears flap statistics for all the paths that pass the access list.
network-mask | (Optional) Network mask applied to the address argument.

Command Description:

To clear BGP flap statistics, use the clear ip bgp flap-statistics command in Privileged EXEC mode.

If no arguments or keywords are specified, the router will clear BGP flap statistics for all routes.

The flap statistics for a route are also cleared when a BGP peer is reset. Although the reset withdraws the route, no penalty is applied in this instance even though route flap dampening is enabled.

Example:

The following example clears all of the flap statistics for paths that pass filter list 3:

Router#clear ip bgp flap-statistics filter-list 3

Misconceptions:

None

Related Commands:

bgp dampening


Command:

clear ip bgp peer-group

Mode:

Router#

Syntax:

clear ip bgp peer-group tag

Syntax Description:

tag Name of the BGP peer group to clear.

Command Description:

To clear all the members of a BGP peer group, use the clear ip bgp peer-group command in Privileged EXEC mode.

Example:

The following example clears all members from the BGP peer group named internal:

Router#clear ip bgp peer-group internal

Misconceptions:

None

Related Commands:

neighbor peer-group (assigning members)


Command:

debug ip bgp

Mode:

Router#

Syntax:

debug ip bgp [A.B.C.D. | dampening | events | in | keepalives | out | updates | vpnv4]

no debug ip bgp [A.B.C.D. | dampening | events | in | keepalives | out | updates | vpnv4]

Syntax Description:

A.B.C.D. | (Optional) Displays the BGP neighbor IP address.
dampening | (Optional) Displays BGP dampening.
events | (Optional) Displays BGP events.
in | (Optional) BGP inbound information.
keepalives | (Optional) Displays BGP keepalives.
out | (Optional) Displays BGP outbound information.
updates | (Optional) Displays BGP updates.
vpnv4 | (Optional) Displays Virtual Private Network version 4 (VPNv4) network layer reachability information (NLRI).

Command Description:

To display information related to processing BGPs, use the debug ip bgp privileged EXEC command. To disable the display of BGP information, use the no form of this command.

Example:

The following example displays the output from this command:

Router# debug ip bgp vpnv4
03:47:14:vpn:bgp_vpnv4_bnetinit:100:2:58.0.0.0/8
03:47:14:vpn:bnettable add:100:2:58.0.0.0 / 8
03:47:14:vpn:bestpath_hook route_tag_change for vpn2:58.0.0.0/255.0.0.0(ok)
03:47:14:vpn:bgp_vpnv4_bnetinit:100:2:57.0.0.0/8
03:47:14:vpn:bnettable add:100:2:57.0.0.0 / 8
03:47:14:vpn:bestpath_hook route_tag_change for vpn2:57.0.0.0/255.0.0.0(ok)
03:47:14:vpn:bgp_vpnv4_bnetinit:100:2:14.0.0.0/8
03:47:14:vpn:bnettable add:100:2:14.0.0.0 / 8
03:47:14:vpn:bestpath_hook route_tag_chacle ip bgp *nge for vpn2:14.0.0.0/255.0.0.0(ok)

Misconceptions:

None.

Related Commands:

None.


Command:

debug ip routing

Mode:

Router#

Syntax:

debug ip routing

no debug ip routing

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information on Routing Information Protocol (RIP) routing table updates and route cache updates, use the debug ip routing privileged EXEC command. The no form of this command disables debugging output.

Example:

The following is sample output from the debug ip routing command:

Router# debug ip routing
RT: add 172.25.168.0 255.255.255.0 via 172.24.76.30, igrp metric [100/3020]
RT: metric change to 172.25.168.0 via 172.24.76.30, igrp metric [100/3020]
new metric [100/2930]
IP: cache invalidation from 0x115248 0x1378A, new version 5736
RT: add 172.26.219.0 255.255.255.0 via 172.24.76.30, igrp metric [100/16200]
RT: metric change to 172.26.219.0 via 172.24.76.30, igrp metric [100/16200]
new metric [100/10816]
RT: delete route to 172.26.219.0 via 172.24.76.30, igrp metric [100/10816]
RT: no routes to 172.26.219.0, entering holddown
IP: cache invalidation from 0x115248 0x1378A, new version 5737
RT: 172.26.219.0 came out of holddown
RT: garbage collecting entry for 172.26.219.0
IP: cache invalidation from 0x115248 0x1378A, new version 5738
RT: add 172.26.219.0 255.255.255.0 via 172.24.76.30, igrp metric [100/10816]
RT: delete route to 172.26.219.0 via 172.24.76.30, igrp metric [100/10816]
RT: no routes to 172.26.219.0, entering holddown
IP: cache invalidation from 0x115248 0x1378A, new version 5739
RT: 172.26.219.0 came out of holddown
RT: garbage collecting entry for 172.26.219.0
IP: cache invalidation from 0x115248 0x1378A, new version 5740
RT: add 172.26.219.0 255.255.255.0 via 172.24.76.30, igrp metric [100/16200]
RT: metric change to 172.26.219.0 via 172.24.76.30, igrp metric [100/16200]
new metric [100/10816]
RT: delete route to 172.26.219.0 via 172.24.76.30, igrp metric [100/10816]
RT: no routes to 172.26.219.0, entering holddown
IP: cache invalidation from 0x115248 0x1378A, new version 5741

Misconceptions:

None.

Related Commands:

None.


Command:

default-metric (BGP)

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

default-metric number
no default-metric number

Syntax Description:

number Default metric value appropriate for the specified routing protocol.

Command Description:

To set default metric values for the BGP, use the default-metric command in address family or router configuration mode. To return to the default state, use the no form of this command.

The default-metric command is used in conjunction with the redistribute router configuration command to cause the current routing protocol to use the same metric value for all redistributed routes. A default metric helps solve the problem of redistributing routes with incompatible metrics. Whenever metrics do not convert, using a default metric provides a reasonable substitute and enables the redistribution to proceed.

In BGP, this command sets the Multi Exit Discriminator (MED) metric. (The name of this metric for BGP Versions 2 and 3 is INTER_AS.)

Default: Built-in, automatic metric translations, as appropriate for each routing protocol.

Example:

The following router configuration mode example shows a router in autonomous system 109 using both the BGP and the Open Shortest Path First (OSPF) routing protocols. In the example, OSPF-derived routes are advertised by BGP with a default metric of 10:

Router(config)# router bgp 109
Router(config-router)# default-metric 10
Router(config-router)# redistribute ospf

The following address family configuration mode example shows a router in autonomous system 109 using both the BGP and the OSPF routing protocols. In the example, OSPF-derived routes are advertised by BGP with a default metric of 10:

Router(config)# router bgp 109
Router(config-router)# address-family ipv4 unicast
Router(config-router-af)# default-metric 10
Router(config-router-af)# redistribute ospf

Misconceptions:

None

Related Commands:

None


Command:

distance bgp

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

distance bgp external-distance internal-distance local-distance
no distance bgp

Syntax Description:

external-distance | Administrative distance for BGP external routes. External routes are routes for which the best path is learned from a neighbor external to the autonomous system. Acceptable values are from 1 to 255. The default is 20. Routes with a distance of 255 are not installed in the routing table.
internal-distance | Administrative distance for BGP internal routes. Internal routes are those routes that are learned from another BGP entity within the same autonomous system. Acceptable values are from 1 to 255. The default is 200. Routes with a distance of 255 are not installed in the routing table.
local-distance | Administrative distance for BGP local routes. Local routes are those networks listed with a network router configuration command, often as back doors, for that router or for networks that are being redistributed from another process. Acceptable values are from 1 to 255. The default is 200. Routes with a distance of 255 are not installed in the routing table.

Command Description:

To allow the use of external, internal, and local administrative distances that could be a better route than other external, internal, or local routes to a node, use the distance bgp command in address family or router configuration mode. To return to the default values, use the no form of this command.

Defaults:

external-distance: 20

internal-distance: 200

local-distance: 200

An administrative distance is a rating of the trustworthiness of a routing information source, such as an individual router or a group of routers. Numerically, an administrative distance is a positive integer from 1 to 255. In general, the higher the value, the lower the trust rating. An administrative distance of 255 means the routing information source cannot be trusted at all and should be ignored.

Use this command if another protocol is known to be able to provide a better route to a node than was actually learned via external BGP (eBGP), or if some internal routes should be preferred by BGP.

The distance bgp command replaces the distance mbgp command.

Example:

In the following router configuration mode example, internal routes are known to be preferable to those learned through the Interior Gateway Protocol (IGP), so the administrative distance values are set accordingly:

Router(config)#router bgp 109
Router(config-router)#network 10.108.0.0
Router(config-router)#neighbor 192.168.6.6 remote-as 123
Router(config-router)#neighbor 172.16.1.1 remote-as 47
Router(config-router)#distance bgp 20 20 200

In the following address family configuration mode example, internal routes are known to be preferable to those learned through IGP, so the administrative distance values are set accordingly:

Router(config)#router bgp 109
Router(config-router)#neighbor 192.168.6.6 remote-as 123
Router(config-router)#neighbor 172.16.1.1 remote-as 47
Router(config-router)#address family ipv4 multicast
Router(config-router-af)#network 10.108.0.0
Router(config-router-af)#distance bgp 20 20 200
Router(config-router-af)#neighbor 192.168.6.6 activate
Router(config-router-af)#neighbor 172.16.1.1 activate

Misconceptions:

Changing the administrative distance of BGP internal routes is considered dangerous and is not recommended. One problem that can arise is the accumulation of routing table inconsistencies, which can break routing.

Related Commands:

None


Command:

ip as-path access-list

Mode:

Router(config)#

Syntax:

ip as-path access-list access-list-number {permit | deny } as-regular-expression

no ip as-path access-list access-list-number {permit | deny } as-regular-expression

Syntax Description:

access-list-number

Integer from 1 to 199 that indicates the regular expression access list number.

permit

Permits access for matching conditions.

deny

Denies access to matching conditions.

as-regular-expression

Autonomous system in the access list using a regular expression. See the "Regular Expressions" appendix in the Dial Solutions Command Reference for information about forming regular expressions.

Command Description:

To define a BGP-related access list, use the ip as-path access-list global configuration command. To disable use of the access list, use the no form of this command.

Usage Guidelines:

An access list filter can be spcified on both inbound and outbound BGP routes. In addition, weights can be assigned based on a set of filters. Each filter is an access list based on regular expressions. If the regular expression matches the representation of the autonomous system path of the route as an ASCII string, then the permit or deny condition applies. The autonomous system path does not contain the local autonomous system number. Use the ip as-path access-list global configuration command to define an BGP access list, and the neighbor router configuration command to apply a specific access list.

Example:

The following example specifies that the BGP neighbor with IP address 128.125.1.1 is not sent advertisements about any path through or from the adjacent autonomous system 123:

Router (config)#ip as-path access-list 1 deny _123_
Router (config)#ip as-path access-list 1 deny ^123$

Router (config)#router bgp 109
Router (config-router)#network 131.108.0.0
Router (config-router)#neighbor 129.140.6.6 remote-as 123
Router (config-router)#neighbor 128.125.1.1 remote-as 47
Router (config-router)#neighbor 128.125.1.1 filter-list 1 out

Misconceptions:

None

Related Commands:

neighbor filter-list


Command:

ip bgp-community new-format

Mode:

Router(config)#

Syntax:

ip bgp-community new-format
no ip bgp-community new-format

Syntax Description:

This command has no argument or keywords.

Command Description:

To display BGP communities in the format AA:NN (autonomous system-community number/2-byte number), use the ip bgp-community new-format command in global configuration mode. To reenable the previous display format for BGP communities (one 32-bit number), use the no form of this command.

RFC 1997, BGP Communities Attribute specifies that a BGP community is made up of two parts that are 2 bytes long. The first part is the autonomous system number and the second part is a 2-byte number. In the most recent version of the RFC, a community is of the form AA:NN. The Cisco default community format is one 32-bit number. The ip bgp-community new-format command changes the community format to AA:NN to conform to RFC 1997.

Default: BGP communities are displayed in the Cisco default format, one 32-bit number.

Example:

The following example upgrades a router that uses the 32-bit number community format to the AA:NN format:

Router(config)#ip bgp-community new-format

The following example shows how BGP community numbers are displayed when the ip bgp-community new-format command is enabled:

Router# show ip bgp 10.0.0.0
BGP routing table entry for 10.0.0.0/8, version 4
Paths: (2 available, best #2, table Default-IP-Routing-Table)
Advertised to non peer-group peers:
10.0.33.35
35
10.0.33.35 from 10.0.33.35 (192.168.3.3)
Origin incomplete, metric 10, localpref 100, valid, external
Community: 1:1
Local
0.0.0.0 from 0.0.0.0 (10.0.33.34)
Origin incomplete, metric 0, localpref 100, weight 32768, valid, sourced, best

Misconceptions:

None

Related Commands:

show ip bgp


Command:

ip community-list

Mode:

Router(config)#

Syntax:

ip community-list community-list-number {permit | deny} community-number no ip community-list community-list-number

Syntax Description:

community-list-number | Integer from 1 to 99 that identifies one or more permit or deny groups of communities.
permit | Permits access for a matching condition.
deny | Denies access for a matching condition.
community-number Community number configured by a set community command. Valid value is one of the following:

A number from 1 to 4294967200. You can specify a single number or multiple numbers separated by a space.
internet--The Internet community.
no-export--Routes with this community are sent to peers in other subautonomous systems within a confederation. Do not advertise this route to an eBGP peer. External systems are those outside the confederation. If there is no confederation, an external system is any eBGP peer.
local-as--Do not advertise this route to peers outside the local autonomous system. This route will not be advertised to other autonomous systems or sub-autonomous systems when confederations are configured.
no-advertise--Do not advertise this route to any peer (internal or external).

Command Description:

To create a community list for BGP and control access to it, use the ip community-list command in global configuration mode. To delete the community list, use the no form of this command.

Once you permit a value for the community number, the community list defaults to an implicit deny for everything else that has not been permitted.

Example:

In the following example, Cisco IOS software permits all routes except the routes with the communities 5 and 10 or 10 and 15:

Router(config)#ip community-list 1 deny 5 10
Router(config)#ip community-list 1 deny 10 15
Router(config)#ip community-list 1 permit internet

The following example permits all routes within the local autonomous system:

Router(config)#ip community-list 1 permit local-as

Misconceptions:

None

Related Commands:

set community


Command:

maximum-paths

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

maximum-paths maximum

no maximum-paths

Syntax Description:

maximum

Maximum number of parallel routes an IP routing protocol installs in a routing table, in the range 1 to 6.

Command Description:

To control the maximum number of parallel routes an IP routing protocol can support, use the maximum-paths command in address family or router configuration mode. To restore the default value, use the no form of this command. The default for Border Gateway Protocol (BGP) is one path.

Examples:

The following router configuration example allows a maximum of two paths to a destination:

Router(config)#router bgp 5
Router(config-router)#maximum-paths 2

The following address family configuration example allows a maximum of two paths to a destination:

Router(config)#router bgp 5
Router(config-router)#address-family ipv4 multicast
Router(config-router-af)#maximum-paths 2

Misconceptions:

None

Related Commands:

address-family ipv4


 Command:

neighbor advertisement-interval

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

neighbor {ip-address | peer-group-name} advertisement-interval seconds

no neighbor {ip-address | peer-group-name} advertisement-interval seconds

Syntax Description:
ip-address | Neighbor's IP address
peer-group-name | Name of a BGP peer group
seconds | Time (in seconds) is specified by an integer from 0 to 600.

Command Description:

To set the minimum interval between the sending of BGP routing updates, use the neighbor advertisement-interval command in address family or router configuration mode. To remove an entry, use the no form of this command.

Example:

The following router configuration mode example sets the minimum time between sending BGP routing updates to 240 seconds:

Router(config)#router bgp 5
Router(config-router)#neighbor 172.25.21.5 advertisement-interval  240

The following address family configuration mode example sets the minimum time between sending BGP routing updates to 10 seconds:

Router(config)#router bgp  5
Router(config-router)#address-family ipv4 unicast
Router(config-router-af)#neighbor  4.4.4.4  advertisement-interval 10

Misconceptions:
None

Related Commands:
address-family ipv4


 Command:

neighbor database-filter

Mode:

Router(config-router)#

Syntax:

neighbor ip-address database-filter all out

no neighbor ip-address database-filter all out

Syntax Description:
ip-address IP address of the neighbor to which outgoing LSAs are blocked.

Command Description:

To filter outgoing LSAs to an OSPF neighbor, use the neighbor database-filter router configuration command. To restore the forwarding of LSAs to the neighbor, use the no form of this command.

Example:

The following example prevents flooding of OSPF LSAs to the neighbor at IP address 1.2.3.4:

Router(config)#router ospf 109
Router(config-router)#neighbor 1.2.3.4  database-filter  all  out

Misconceptions:
None

Related Commands:
None


 Command:

neighbor ebgp-multihop

Mode:

Router(config-router)#

Syntax:

neighbor {ip-address | peer-group-name} ebgp-multihop [ttl]

no neighbor {ip-address | peer-group-name} ebgp-multihop [ttl]

Syntax Description:

ip-address

IP address of the BGP-speaking neighbor

peer-group-name

Name of a BGP peer group

ttl

(Optional) Time-to-live in the range 1 to 255 hops

Command Description:

To accept and attempt BGP connections to external peers residing on networks that are not directly connected, use the neighbor ebgp-multihop router configuration command. To return to the default (allow peering with only directly connected neighbors), use the no form of this command.

Usage Guidelines:

If you specify a BGP peer group by using the peer-group-name argument, all the members of the peer group will inherit the characteristic configured with this command. To prevent the creation of loops through oscillating routes, the multihop will not be established if the only route to the multihop peer is the default route (0.0.0.0).

Example:

The following example allows connections to or from neighbor 131.108.1.1, which resides on a network that is not directly connected:

Router(config)#router bgp 109
Router(config-router)#neighbor 131.108.1.1 ebgp-multihop

Misconceptions:
None

Related Commands:
router bgp
neighbor peer-group
neighbor remote-as


Command:

neighbor filter-list

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

neighbor {ip-address | peer-group-name} filter-list access-list-number {in | out | weight weight}

Syntax Description:

ip-address

IP address of the neighbor

peer-group-name

Name of a BGP peer group

access-list-number

Number of an autonomous system path access list. You define this access list with the ip as-path access-list command.

in

Access list applied to incoming routes

out

Access list applied to outgoing routes

weight

Assigns a relative importance to incoming routes matching autonomous system paths. Acceptable values are 0 to 65535. (The weight keyword was removed in Release 12.1)

Command Description:

To set up a BGP filter, use the neighbor filter-list command in address family or router configuration mode. To disable this function, use the no form of this command.

Example:

In the following router configuration mode example, the BGP neighbor with IP address 128.125.1.1 is not sent advertisements about any path through or from the adjacent autonomous system 123:

 Router(config)#ip as-path access-list 1 deny _123_

 Router(config)#ip as-path access-list 1 deny ^123$

 Router(config)#router bgp 109

 Router(config-router)#network 131.108.0.0

 Router(config-router)#neighbor 129.140.6.6 remote-as 123

 Router(config-router)#neighbor 128.125.1.1 remote-as 47

 outer(config-router)#neighbor 128.125.1.1 filter-list 1 out

In the following address family configuration mode example, the BGP neighbor with IP address 128.125.1.1 is not sent advertisements about any path through or from the adjacent autonomous system 123:

   Router(config)#ip as-path access-list    1 deny _123_
   Router(config)#ip as-path access-list    1 deny ^123$
   Router(config)#router bgp 109
   Router(config-router)#address-family ipv4 unicast
   Router(config-router-af)#network 131.108.0.0
   Router(config-router-af)#neighbor 129.140.6.6 remote-as 123
   Router(config-router-af)#neighbor 128.125.1.1 remote-as 47
   Router(config-router-af)#neighbor 128.125.1.1 filter-list 1 out

Misconceptions:

None

Related Commands:

address-family ipv4

ip as-path access-list


 Command:

neighbor maximum-prefix

Mode:

Router(config-router)#

Syntax:

neighbor {ip-address | peer-group-name} maximum-prefix maximum [threshold]  [warning-only]

no neighbor {ip-address | peer-group-name} maximum-prefix maximum

Syntax Description:

ip-address

IP address of the neighbor

peer-group-name

Name of a BGP peer group

maximum

Maximum number of prefixes allowed from this neighbor

threshold

(Optional) Integer specifying at what percentage of maximum the router starts to generate a warning message. The range is from 1 to 100 percent. The default is 75 (percent).

warning-only

(Optional) Allows the router to generate a log message when the maximum is exceeded, instead of terminating the peering

Command Description:

To control how many prefixes can be received from a neighbor, use the neighbor maximum-prefix router configuration command. To disable this function, use the no form of this command.

Usage Guidelines:

When the number of received prefixes exceeds the maximum number configured, the router terminates the peering (by default). However, if the keyword warning-only is configured, the router sends only a log message instead and continues peering with the sender. If the peer is terminated, the peer stays down until the clear ip bgp command is issued.

Example:

The following example sets the maximum number of prefixes allowed from the neighbor at 129.140.6.6 to 1000:

Router(config)#router bgp 109
Router(config-router)#network 131.108.0.0
Router(config-router)#neighbor 129.140.6.6 maximum-prefix 1000

Misconceptions:
None

Related Commands:
clear ip bgp


 Command:

neighbor next-hop-self

Mode:

Router(config-router)#

Syntax:
neighbor {ip-address | peer-group-name} next-hop-self

no neighbor {ip-address | peer-group-name} next-hop-self

Syntax Description:
ip-address | IP address of the BGP-speaking neighbor
peer-group-name | Name of a BGP peer group

Command Description:

To configure the router as the next hop for a BGP-speaking neighbor or peer group, use the neighbor next-hop-self router configuration command. To disable this feature, use the no form of this command. This command is useful in nonmeshed networks (such as Frame Relay or X.25) where BGP neighbors may not have direct access to all other neighbors on the same IP subnet.

Example:

The following example forces all updates destined for 131.108.1.1 to advertise this router as the next hop:
Router(config)#router bgp 109
Router(config-router)#neighbor 131.108.1.1 next-hop-self

Misconceptions:
None

Related Commands:
neighbor peer-group (creating)


Command:

neighbor peer-group (assigning members)

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

neighbor ip-address peer-group peer-group-name
no neighbor ip-address peer-group peer-group-name

Syntax Description:

ip-address | IP address of the BGP neighbor that belongs to the peer group specified by the peer-group-name argument.
peer-group-name | Name of the BGP peer group to which this neighbor belongs.

Command Description:

To configure a BGP neighbor to be a member of a peer group, use the neighbor peer-group command in address family or router configuration mode. To remove the neighbor from the peer group, use the no form of this command.

The neighbor at the IP address indicated inherits all the configured options of the peer group.

Example:

The following router configuration mode example assigns three neighbors to the peer group named internal:

Router(config)# router bgp 100
Router(config-router)# neighbor internal peer-group
Router(config-router)# neighbor internal remote-as 100
Router(config-router)# neighbor internal update-source loopback 0
Router(config-router)# neighbor internal route-map set-med out
Router(config-router)# neighbor internal filter-list 1 out
Router(config-router)# neighbor internal filter-list 2 in
Router(config-router)# neighbor 172.16.232.53 peer-group internal
Router(config-router)# neighbor 172.16.232.54 peer-group internal
Router(config-router)# neighbor 172.16.232.55 peer-group internal
Router(config-router)# neighbor 172.16.232.55 filter-list 3 in

The following address family configuration mode example assigns three neighbors to the peer group named internal:

Router(config)# router bgp 100
Router(config-router)# address-family ipv4 unicast
Router(config-router-af)# neighbor internal peer-group
Router(config-router-af)# neighbor internal remote-as 100
Router(config-router-af)# neighbor internal update-source loopback 0
Router(config-router-af)# neighbor internal route-map set-med out
Router(config-router-af)# neighbor internal filter-list 1 out
Router(config-router-af)# neighbor internal filter-list 2 in
Router(config-router-af)# neighbor 172.16.232.53 peer-group internal
Router(config-router-af)# neighbor 172.16.232.54 peer-group internal
Router(config-router-af)# neighbor 172.16.232.55 peer-group internal
Router(config-router-af)# neighbor 172.16.232.55 filter-list 3 in

Misconceptions:

None

Related Commands:

address-family ipv4
neighbor peer-group (creating)


Command:

neighbor peer-group (creating)

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

neighbor peer-group-name peer-group
no neighbor peer-group-name peer-group

Syntax Description:

peer-group-name Name of the BGP peer group.

Command Description:

To create a BGP or multiprotocol BGP peer group, use the neighbor peer-group command in address family or router configuration mode. To remove the peer group and all of its members, use the no form of this command.

Often in a BGP or multiprotocol BGP speaker, many neighbors are configured with the same update policies (that is, same outbound route maps, distribute lists, filter lists, update source, and so on). Neighbors with the same update policies can be grouped into peer groups to simplify configuration and make update calculation more efficient.

Once a peer group is created with the neighbor peer-group command, it can be configured with the neighbor commands. By default, members of the peer group inherit all the configuration options of the peer group. Members also can be configured to override the options that do not affect outbound updates.

Peer group members will always inherit the following configuration options: remote-as (if configured), version, update-source, out-route-map, out-filter-list, out-dist-list, minimum-advertisement-interval, and next-hop-self. All the peer group members will inherit changes made to the peer group.

If a peer group is not configured with a remote-as option, the members can be configured with the neighbor {ip-address | peer-group-name} remote-as command. This command allows you to create peer groups containing external BGP (eBGP) neighbors.

Example:

The following example configurations show how to create these types of neighbor peer group:

internal Border Gateway Protocol (iBGP) peer group
eBGP peer group
Multiprotocol BGP peer group
iBGP Peer Group

In the following example, the peer group named internal configures the members of the peer group to be iBGP neighbors. By definition, this is an iBGP peer group because the router bgp command and the neighbor remote-as command indicate the same autonomous system (in this case, autonomous system 100). All the peer group members use loopback 0 as the update source and use set-med as the outbound route map. The neighbor internal filter-list 2 in command shows that, except for 171.69.232.55, all the neighbors have filter list 2 as the inbound filter list.

Router(config)# router bgp 100
Router(config-router)# neighbor internal peer-group
Router(config-router)# neighbor internal remote-as 100
Router(config-router)# neighbor internal update-source loopback 0
Router(config-router)# neighbor internal route-map set-med out
Router(config-router)# neighbor internal filter-list 1 out
Router(config-router)# neighbor internal filter-list 2 in
Router(config-router)# neighbor 171.69.232.53 peer-group internal
Router(config-router)# neighbor 171.69.232.54 peer-group internal
Router(config-router)# neighbor 171.69.232.55 peer-group internal
Router(config-router)# neighbor 171.69.232.55 filter-list 3 in

eBGP Peer Group

The following example defines the peer group named external-peers without the neighbor remote-as command. By definition, this is an eBGP peer group because each individual member of the peer group is configured with its respective autonomous system number separately. Thus the peer group consists of members from autonomous systems 200, 300, and 400. All the peer group members have the set-metric route map as an outbound route map and filter list 99 as an outbound filter list. Except for neighbor 171.69.232.110, all of them have 101 as the inbound filter list.

router bgp 100
Router(config-router)# neighbor external-peers peer-group
Router(config-router)# neighbor external-peers route-map set-metric out
Router(config-router)# neighbor external-peers filter-list 99 out
Router(config-router)# neighbor external-peers filter-list 101 in
Router(config-router)# neighbor 171.69.232.90 remote-as 200
Router(config-router)# neighbor 171.69.232.90 peer-group external-peers
Router(config-router)# neighbor 171.69.232.100 remote-as 300
Router(config-router)# neighbor 171.69.232.100 peer-group external-peers
Router(config-router)# neighbor 171.69.232.110 remote-as 400
Router(config-router)# neighbor 171.69.232.110 peer-group external-peers
Router(config-router)# neighbor 171.69.232.110 filter-list 400 in

Multiprotocol BGP Peer Group

In the following example, all members of the peer group are multicast-capable:

Router(config-router)# router bgp 100
Router(config-router)# neighbor 10.1.1.1 remote-as 1
Router(config-router)# neighbor 172.16.2.2 remote-as 2
Router(config-router)# address-family ipv4 multicast
Router(config-router-af)# neighbor mygroup peer-group
Router(config-router-af)# neighbor 10.1.1.1 peer-group mygroup
Router(config-router-af)# neighbor 172.16.2.2 peer-group mygroup
Router(config-router-af)# neighbor 10.1.1.1 activate
Router(config-router-af)# neighbor 172.16.2.2 activate

Misconceptions:

Peer group members can span multiple logical IP subnets, and can transmit, or pass along, routes from one peer group member to another.

Related Commands:

address-family ipv4
neighbor peer-group (assigning members)


Command:

neighbor prefix-list

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

neighbor {ip-address | peer-group-name} prefix-list prefix-listname {in | out}

no neighbor {ip-address | peer-group-name} prefix-list prefix-listname {in | out}

Syntax Description:

prefix-list-name

Name of a prefix list

peer-group-name

Name of a BGP peer group

ip-address

IP address of neighbor

in

Filter incoming updates

out

Filter outgoing updates

Command Description:

To distribute BGP neighbor information as specified in a prefix list, use the neighbor prefix-list command in address family or router configuration mode. To remove an entry, use the no form of this command.

Example:

The following router configuration mode example applies the prefix list named abc to incoming advertisements to neighbor 120.23.4.1:

Router(config)#router bgp 109

Router(config-router)#network 131.108.0.0

Router(config-router)#neighbor 120.23.4.1 prefix-list abc in

The following address family configuration mode example applies the prefix list named abc to incoming advertisements to neighbor 120.23.4.1:

Router(config)#router bgp 109

Router(config-router)#address-family ipv4 unicast

Router(config-router-af)#network 131.108.0.0

Router(config-router-af)#neighbor 120.23.4.1 prefix-list abc in

Misconceptions:

None

Related Commands:

neighbor filter-list

ip as-path access-list


Command:

neighbor remote-as

Mode:

Router(config-router)#

Syntax:

neighbor {ip-address | peer-group-name} remote-as as-number

no neighbor {ip-address | peer-group-name} remote-as as-number

Syntax Description:

ip-address

Neighbor's IP address

peer-group-name

Name of a BGP peer group

as-number

Autonomous system to which the neighbor belongs

Command Description:

To add an entry to the BGP or multiprotocol BGP neighbor table, use the neighbor remote-as router configuration command. To remove an entry from the table, use the no form of this command.

Usage Guidelines:

Specifying a neighbor with an autonomous system number that matches the autonomous system number specified in the router bgp global configuration command identifies the neighbor as internal to the local autonomous system. Otherwise, the neighbor is considered external. If you specify a BGP peer group by using the peer-group-name argument, all the members of the peer group will inherit the characteristic configured with this command.

Example:

The following example specifies that a router at the address 131.108.1.2 is a neighbor in autonomous system number 109:

Router(config)#router bgp 110

Router(config-router)#network 131.108.0.0

Router(config-router)#neighbor 131.108.1.2 remote-as 109

Misconceptions:

None

Related Commands:

router bgp

neighbor peer-group


Command:

neighbor route-map

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

neighbor {ip-address | peer-group-name} route-map map-name {in | out}

no neighbor {ip-address | peer-group-name} route-map map-name {in | out }

Syntax Description:

ip-address

Neighbor's IP address

peer-group-name

Name of a BGP or multiprotocol BGP peer group

map-name

Name of route map

in

Apply to incoming updates

out

Apply to outgoing updates

Command Description:

To apply a route map to incoming or outgoing routes, use the neighbor route-map command in address family or router configuration mode. To remove a route map, use the no form of this command.

Usage Guidelines:

When specified in address family configuration mode, this command applies a route map to that particular address family only. When specified in router configuration mode, this command applies a route map to IP Version 4 unicast routes only. If an outbound route map is specified, it is proper behavior to only advertise routes that match at least one section of the route map.

If a BGP or multiprotocol BGP peer group is specified by using the peer-group-name argument, all the members of the peer group will inherit the characteristic configured with this command. Specifying the command for a neighbor overrides the inbound policy that is inherited from the peer group.

Example:

The following router configuration mode example applies a route map named internal-map to a BGP incoming route from 198.92.70.24:

Router(config)#router bgp 5

Router(config-router)#neighbor 198.92.70.24 route-map internal-map in

The following address family configuration mode example applies a route map named internal-map to a multiprotocol BGP incoming route from 198.92.70.24:

Router (config)#router bgp 5

Router (config-router)#address-family ipv4 multicast

Router (config-router-af)#neighbor 198.92.70.24 route-map internal-map in

Misconceptions:

None

Related Commands:

address-family ipv4

neighbor remote-as

route-map


Command:

neighbor route-reflector-client

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

neighbor ip-address route-reflector-client

no neighbor ip-address route-reflector-client

Syntax Description:

ip address

IP address of the BGP neighbor being identified as a client

Command Description:

To configure the router as a BGP route reflector and configure the specified neighbor as its client, use the neighbor route-reflector-client command in address family or router configuration mode. To indicate that the neighbor is not a client, use the no form of this command.

Usage Guidelines:

By default, all internal BGP (iBGP) speakers in an autonomous system must be fully meshed, and neighbors do not readvertise iBGP learned routes to neighbors, thus preventing a routing information loop. When all the clients are disabled, the local router is no longer a route reflector.

If you use route reflectors, all iBGP speakers need not be fully meshed. In the route reflector model, an Interior BGP peer is configured to be a route reflector responsible for passing iBGP learned routes to iBGP neighbors. This scheme eliminates the need for each router to talk to every other router.

Example:

In the following router configuration mode example, the local router is a route reflector. It passes learned iBGP routes to the neighbor at 198.92.70.24.

Router(config)#router bgp 5

Router(config-router)#neighbor 198.92.70.24 route-reflector-client

In the following address family configuration mode example, the local router is a route reflector. It passes learned iBGP routes to the neighbor at 198.92.70.24.

Router(config)#router bgp 5
Router(config-router)#address-family ipv4 unicast
Router(config-router-af)#neighbor 198.92.70.24 route-reflector-client

Misconceptions:

None

Related Commands:

neighbor ebgp-multihop

show ip bgp

address-family ipv4

router bgp

neighbor remote-as


Command:

neighbor shutdown

Mode:

Router(config-router)#

Syntax:

neighbor {ip-address | peer-group-name} shutdown

no neighbor {ip-address | peer-group-name} shutdown

Syntax Description:

ip-address

Neighbor's IP address

peer-group-name

Name of a BGP peer group

Command Description:

To disable a neighbor or peer group, use the neighbor shutdown router configuration command. To reenable the neighbor or peer group, use the no form of this command.

Example:

The following example disables any active session for the neighbor 171.34.23.22:

Router(config-router)#neighbor 171.34.23.22 shutdown

The following example disables all peering sessions for the peer group named internal:

Routere(config-router)#neighbor internal shutdown

Misconceptions:

None

Related Commands:

None


 Command:

neighbor soft-reconfiguration

Mode:

Router(config-router)#

Syntax:

neighbor {ip-address | peer-group-name} soft-reconfiguration [inbound]

no neighbor {ip-address | peer-group-name} soft-reconfiguration [inbound]

Syntax Description:

ip-address

IP address of the BGP-speaking neighbor

peer-group-name

Name of a BGP peer group

inbound

(Optional) Indicates that the update to be stored is an incoming update.

Command Description:

To configure the Cisco IOS software to start storing updates, use the neighbor soft-reconfiguration router configuration command. To not store received updates, use the no form of this command.

Example:

The following example enables inbound soft reconfiguration for the neighbor 131.108.1.1. All the updates received from this neighbor will be stored unmodified, regardless of the inbound policy. When inbound soft reconfiguration is done later, the stored information will be used to generate a new set of inbound updates.

Router (config)#router bgp 100

Router (config-router)#neighbor 131.108.1.1 remote-as 200

Router (config-router)#neighbor 131.108.1.1 soft-reconfiguration inbound
Misconceptions:
None

Related Commands:
neighbor remote-as
clear ip bgp


 Command:

neighbor timers

Mode:

Router(config-router)#

Syntax:

neighbor [ip-address | peer-group-name] timers keepalive holdtime

no neighbor [ip-address | peer-group-name] timers keepalive holdtime

Syntax Description:

ip-address

(Optional) A BGP peer or peer group IP address

peer-group-name

(Optional) Name of the BGP peer group

keepalive

Frequency, in seconds, with which the Cisco IOS software sends keepalive messages to its peer. The default is 60 seconds.

holdtime

Interval, in seconds, after not receiving a keepalive message that the software declares a peer dead. The default is 180 seconds.

Command Description:

To set the timers for a specific BGP peer or peer group, use the neighbor timers router configuration command. To clear the timers for a specific BGP peer or peer group, use the no form of this command.

Example:

The following example changes the keepalive timer to 70 seconds and the hold-time timer to 210 seconds for the BGP peer 192.98.47.0:

Router (config)#router bgp 109

Router (config-router)#neighbor 192.98.47.0 timers 70 210
Misconceptions:
None

Related Commands:

None


 Command:

neighbor update-source

Mode:

Router(config-router)#

Syntax:

neighbor {ip-address | peer-group-name} update-source interface-type

no neighbor {ip-address | peer-group-name} update-source interface-type

Syntax Description:

ip-address

IP address of the BGP-speaking neighbor

peer-group-name

Name of a BGP peer group

interface-type

Interface to be used as the source

Command Description:

To have the Cisco IOS software allow Border Gateway Protocol (BGP) sessions to use a specific operational interface for TCP connections, use the neighbor update-source router configuration command. To restore the interface assignment to the closest interface, which is called the best local address, use the no form of this command. This feature works in conjunction with any specified interface on the router. The loopback interface is the interface that is most commonly used.

Example:

The following example sources BGP TCP connections for the specified neighbor with the IP address of the loopback interface rather than the best local address:

Router (config)#router bgp 110

Router (config-router)#network 160.89.0.0

Router (config-router)#neighbor 160.89.2.3 remote-as 110

Router (config-router)#neighbor 160.89.2.3 update-source loopback0
Misconceptions:
None

Related Commands:
neighbor remote-as


 Command:

neighbor weight

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

neighbor {ip-address | peer-group-name} weight number

no neighbor {ip-address | peer-group-name} weight number

Syntax Description:

ip-address

Neighbor's IP address.

peer-group-name

Name of a BGP peer group.

number

Weight to assign. Acceptable values are 0 to 65535.

Command Description:

To assign a weight to a neighbor connection, use the neighbor weight command in address family or router configuration mode. To remove a weight assignment, use the no form of this command.

Example:
The following router configuration mode example sets the weight of all routes learned via 151.23.12.1 to 50:
Router (config)#router bgp 109

Router(config-router)#neighbor 151.23.12.1 weight 50

The following address family configuration mode example sets the weight of all routes learned via 151.23.12.1 to 50:

Router (config)#router bgp 109

Router (config-router)#address-family ipv4 multicast

Router (config-router-af)#neighbor 151.23.12.1 weight 50

Misconceptions:

None

Related Commands:
address-family ipv4
neighbor filter-list
router bgp
neighbor remote-as
neighbor prefix-list
neighbor route-map


Command:

network backdoor

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

network ip-address backdoor
no network ip-address backdoor

Syntax Description:

ip-address IP address of the network to which you want a backdoor route.

Command Description:

To specify a backdoor route to a BGP-learned prefix that provides better information about the network, use the network backdoor command in address family or router configuration mode. To remove an address from the list, use the no form of this command.

No network is marked as having a back door by default.

A backdoor network is assigned an administrative distance of 200. The objective is to make Interior Gateway Protocol (IGP) learned routes preferred. A back door network is treated as a local network, except that it is not advertised. A network that is marked as a backdoor is not sourced by the local router, but should be learned from external neighbors. The BGP best path selection algorithm does not change when a network is configured as a back door.

Example:

The following address family configuration example configures network 10.108.0.0 as a local network and network 192.168.7.0 as a backdoor network:

Router(config)#router bgp 109
Router(config-router)#address-family ipv4 multicast
Router(config-router-af)#network 10.108.0.0
 Router(config-router-af)#network 192.168.7.0 backdoor

The following router configuration example configures network 10.108.0.0 as a local network and network 192.168.7.0 as a backdoor network:

Router(config)#router bgp 109
Router(config-router)#network 10.108.0.0
Router(config-router)#network 192.168.7.0 backdoor

Misconceptions:

None

Related Commands:

address-family ipv4
distance bgp
router bgp


Command:

network (BGP)

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

network network-number [mask network-mask]

no network network-number [mask network-mask]

Syntax Description:

network-number

Network that BGP or multiprotocol BGP will advertise

network-mask

(Optional) Network mask address

mask

(Optional) Network or subnetwork mask. If the mask keyword is configured, then an exact match must exist in the routing table.

Command Description:

To specify the networks to be advertised by the BGP and multiprotocol BGP routing processes, use the network command in address family or router configuration mode. To remove an entry, use the no form of this command.

Example:

The following router configuration mode example sets up network 131.108.0.0 to be included in the BGP updates:

  Router(config)#router bgp 120

  Router(config-router)#network 131.108.0.0

The following address-family mode configuration example sets up network 131.108.0.0 to be included in the multiprotocol BGP updates:

  Router (config)#router bgp 120

  Router (config-router)#address family ipv4 multicast

  Router (config-router-af)#network 131.108.0.0

Misconceptions:

None

Related Commands:

router bgp

address-family ipv4

show ip route


 Command:

router bgp

Mode:

Router(config)#

Syntax:

router bgp as-number

no router bgp as-number

Syntax Description:

as-number

Number of an autonomous system that identifies the router to other BGP routers and tags the routing information passed along

Command Description:

To configure the Border Gateway Protocol (BGP) routing process, use the router bgp global configuration command. To remove a routing process, use the no form of this command.

This command allows you to set up a distributed routing core that automatically guarantees the loop-free exchange of routing information between autonomous systems.

Example:
The following example configures a BGP process for autonomous system 120:
Router(config)#router bgp 120

Misconceptions:

None

Related Commands:
network (BGP)


Command:

route-map

Mode:

Router(config)#

Syntax:

route-map map-tag [permit | deny] [sequence-number]

no route-map map-tag [permit | deny] [sequence-number]

Syntax Description:

map-tag

Defines a meaningful name for the route map. The redistribute router configuration command uses this name to reference this route map. Multiple route maps may share the same map tag name.

permit

(Optional) If the match criteria are met for this route map, and permit is specified, the route is redistributed as controlled by the set actions. In the case of policy routing, the packet is policy routed.

If the match criteria are not met, and permit is specified, the next route map with the same map tag is tested. If a route passes none of the match criteria for the set of route maps sharing the same name, it is not redistributed by that set.

The permit keyword is the default.

deny

(Optional) If the match criteria are met for the route map, and deny is specified, the route is not redistributed. In the case of policy routing, the packet is not policy routed, and no further route maps sharing the same map tag name will be examined. If the packet is not policy-routed, it reverts to the normal forwarding algorithm.

sequence-number

(Optional) Number that indicates the position a new route map is to have in the list of route maps already configured with the same name. If given with the no form of this command, it specifies the position of the route map that should be deleted.

Command Description:

To define the conditions for redistributing routes from one routing protocol into another, or to enable policy routing, use the route-map global configuration command. To enable policy routing, the route-map command can be combined with the match and set route-map configuration commands.

Example:

The following example shows how you can use route maps to modify incoming data from a neighbor. Any route received from 140.222.1.1 that matches the filter parameters set in autonomous system access list 200 will have its weight set to 200 and its local preference set to 250, and it will be accepted.

  Router(config)#router bgp 100

  Router(config-router)#neighbor 140.222.1.1 route-map fix-weight in

  Router(config-router)#neighbor 140.222.1.1 remote-as 1

  Router(config-router)#exit

  Router(config)#ip as-path access-list 200 permit ^690$

  Router(config)#ip as-path access-list 200 permit ^1800

  Router(config)#route-map fix-weight permit 10

  Router(config-route-map)#match as-path 200

  Router(config-route-map)#set local-preference 250

  Router(config-route-map)#set weight 200

The following example applies a route map named internal-map to incoming route from 198.92.70.24:

Router(config)#router bgp 5
Router(config-router)#neighbor 198.92.70.24 route-map internal-map in
Router(config)#route-map internal-map
Router(config-route-map)#match as-path 1

Router(config-route-map)#set local-preference 100

Misconceptions:

None

Related Commands:

None


Command:

set-overload-bit

Mode:

Router(config-router)#

Syntax:

set-overload-bit [on-startup {seconds | wait-for-bgp}] [suppress {[interlevel] [external]}]
no set-overload-bit

Syntax Description:

on-startup | (Optional) Sets the overload bit upon the system starting up. The overload bit remains set for the number of seconds configured or until BGP has converged, depending on the subsequent argument or keyword specified.
number | (Optional) When the on-startup keyword is configured, causes the overload bit to be set upon system startup and remain set for this number of seconds.
seconds | (Optional) When the on-startup keyword is configured, causes the overload bit to be set upon system startup and remain set until BGP has converged. If BGP does not signal IS-IS that it is converged, IS-IS will turn off the overload bit after 10 minutes.
suppress | (Optional) Causes the type of prefix identified by the subsequent keyword or keywords to be suppressed.
interlevel | (Optional) When the suppress keyword is configured, prevents the IP prefixes learned from another IS-IS level from being advertised.
external | (Optional) When the suppress keyword is configured, prevents the IP prefixes learned from other protocols from being advertised.

Command Description:

To configure the router to signal other routers not to use it as an intermediate hop in their shortest path first (SPF) calculations, use the set-overload-bit command in router configuration mode. To remove the designation, use the no form of this command.

The overload bit is not set by default.

This command forces the router to set the overload bit (also known as the hippity bit) in its nonpseudonode link-state packets (LSPs). Normally, the setting of the overload bit is allowed only when a router runs into problems. For example, when a router is experiencing a memory shortage, it might be that the link-state database is not complete, resulting in an incomplete or inaccurate routing table. By setting the overload bit in its LSPs, other routers can ignore the unreliable router in their SPF calculations until the router has recovered from its problems.

The result will be that no paths through this router are seen by other routers in the IS-IS area. However, IP and Connectionless Network Service (CLNS) prefixes directly connected to this router will still be reachable.

This command can be useful when you want to connect a router to an IS-IS network but do not want real traffic flowing through it under any circumstances. Examples situations are as follows:

A test router in the lab, connected to a production network.
A router configured as an LSP flooding server, for example, on a nonbroadcast multiaccess (NBMA) network, in combination with the mesh group feature.
A router that is aggregating virtual circuits (VCs) used only for network management. In this case, the network management stations must be on a network directly connected to the router with the set-overload-bit command configured.

Unless you specify the on-startup keyword, this command sets the overload bit immediately.

In addition to setting the overload bit, you might want to suppress certain types of IP prefix advertisements from LSPs. For example, allowing IP prefix propagation between Level 1 and Level 2 effectively makes a node a transit node for IP traffic, which might be undesirable. The suppress keyword used with the interlevel or external keyword (or both) accomplishes that suppression while the overload bit is set.

Example:

The following example sets the overload bit upon startup and until BGP has converged, and suppresses redistribution between IS-IS levels and suppresses redistribution from external routing protocols while the overload bit is set:

Router(config)# interface Ethernet0
Router(config-if)# ip address 10.1.1.1 255.255.255.0
Router(config-if)# ip router isis

Router(config)# router isis
Router(config-router)# net 49.0001.0000.0000.0001.00
Router(config-router)# set-overload-bit on-startup wait-for-bgp suppress interlevel external
Router(config-router)# router bgp 100

Misconceptions:

None

Related Commands:

None


 Command:

show ip bgp

Mode:

Router>

Router#

Syntax:

show ip bgp [network] [network-mask] [longer-prefixes]

Syntax Description:

network

(Optional) Network number, entered to display a particular network in the BGP routing table

network-mask

(Optional) Displays all BGP routes matching the address/mask pair

longer-prefixes

(Optional) Displays route and more specific routes

Command Description:

To display entries in the BGP routing table, use the show ip bgp EXEC command.

Examples:

The following is a sample of output from the show ip bgp command:

Router#show ip bgp

BGP table version is 716977, local router ID is 193.0.32.1
Status codes: s suppressed, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop          Metric LocPrf Weight Path
* i3.0.0.0          193.0.22.1             0    100      0 1800 1239 ?
*>i                 193.0.16.1             0    100      0 1800 1239 ?
* i6.0.0.0          193.0.22.1             0    100      0 1800 690 568 ?
*>i                 193.0.16.1             0    100      0 1800 690 568 ?
* i7.0.0.0          193.0.22.1             0    100      0 1800 701 35 ?
*>i                 193.0.16.1             0    100      0 1800 701 35 ?
*                   198.92.72.24                         0 1878 704 701 35 ?
* i8.0.0.0          193.0.22.1             0    100      0 1800 690 560 ?
*>i                 193.0.16.1             0    100      0 1800 690 560 ?
*                   198.92.72.24                         0 1878 704 701 560 ?
* i13.0.0.0         193.0.22.1             0    100      0 1800 690 200 ?
*>i                 193.0.16.1             0    100      0 1800 690 200 ?
*                   198.92.72.24                         0 1878 704 701 200 ?
* i15.0.0.0         193.0.22.1             0    100      0 1800 174 ?
*>i                 193.0.16.1             0    100      0 1800 174 ?
* i16.0.0.0         193.0.22.1             0    100      0 1800 701 i
*>i                 193.0.16.1             0    100      0 1800 701 i
*                   198.92.72.24                         0 1878 704 701 i

The following table describes the significant fields in the display:

Table: show ip bgp Field Descriptions

Field Description

BGP table version

This shows the internal version number of the table. This number is incremented whenever the table changes.

local router ID

IP address of the router

Status codes

Status of the table entry. The status is displayed at the beginning of each line in the table. It can be one of the following values:

s—The table entry is suppressed.

*—The table entry is valid.

>—The table entry is the best entry to use for that network.

i—The table entry was learned via an internal BGP session.

Origin codes

This field indicates the origin of the entry. The origin code is placed at the end of
each line in the table. It can be one of the following values:

i—Entry originated from IGP and was advertised with a network router
configuration command.

e—Entry originated from EGP.

?—Origin of the path is not clear Usually, this is a router that is
redistributed into BGP from an IGP.

Network

IP address of a network entity

Next Hop

The IP address of the next system that is used when forwarding a packet to the destination network. An entry of 0.0.0.0 indicates that the router has some non-BGP routes to this network.

Metric

If shown, this is the value of the interautonomous system metric. This field is frequently not used.

LocPrf

This displays the local preference value as set with the set local-preference route-map configuration command. The default value is 100.

Weight

Weight of the route as set via autonomous system filters

Path

This shows the autonomous system paths to the destination network. There can be one entry in this field for each autonomous system in the path.

The following is a sample of output from the show ip bgp command when you specify longer-prefixes:

Router#show ip bgp 198.92.0.0 255.255.0.0 longer-prefixes

BGP table version is 1738, local router ID is 198.92.72.24
Status codes: s suppressed, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop          Metric LocPrf Weight Path
*> 198.92.0.0       198.92.72.30        8896         32768 ?
*                   198.92.72.30                         0 109 108 ?
*> 198.92.1.0       198.92.72.30        8796         32768 ?
*                   198.92.72.30                         0 109 108 ?
*> 198.92.11.0      198.92.72.30       42482         32768 ?
*                   198.92.72.30                         0 109 108 ?
*> 198.92.14.0      198.92.72.30        8796         32768 ?
*                   198.92.72.30                         0 109 108 ?
*> 198.92.15.0      198.92.72.30        8696         32768 ?
*                   198.92.72.30                         0 109 108 ?
*> 198.92.16.0      198.92.72.30        1400         32768 ?
*                   198.92.72.30                         0 109 108 ?
*> 198.92.17.0      198.92.72.30        1400         32768 ?
*                   198.92.72.30                         0 109 108 ?
*> 198.92.18.0      198.92.72.30        8876         32768 ?
*                   198.92.72.30                         0 109 108 ?
*> 198.92.19.0      198.92.72.30        8876         32768 ?
*                   198.92.72.30                         0 109 108 ?

The following is a sample of output from the show ip bgp command, showing information for prefix 3.0.0.0:

Router#show ip bgp 3.0.0.0
BGP routing table entry for 3.0.0.0/8, version 628
Paths: (1 available, best #1)
Advertised to peer-groups:
 ebgp
Advertised to non peer-group peers:
 171.69.232.162
109 65000 297 701 80
 171.69.233.56 from 171.69.233.56 (172.19.185.32)
  Origin incomplete, localpref 100, valid, external, best, ref 2

Misconceptions:
None

Related commands:
None


Command:

show ip bgp cidr-only

Mode:

Router>

Syntax:

show ip bgp cidr-only

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display routes with nonnatural network masks (that is, classless interdomain routing, or CIDR), use the show ip bgp cidr-only command in EXEC mode.

Example:

The following is sample output from the show ip bgp cidr-only command in privileged EXEC mode:

Router# show ip bgp cidr-only
BGP table version is 220, local router ID is 172.16.73.131
Status codes: s suppressed, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 192.168.0.0/8    172.16.72.24 0 1878 ?
*> 172.16.0.0/16 172.16.72.30 0 108 ?

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp community-list

Mode:

Router#

Syntax:

show ip bgp community-list community-list-number [exact]

Syntax Description:

community-list-number | Community list number in the range from 1 to 99.
exact | (Optional) Displays only routes that have an exact match.

Command Description:

To display routes that are permitted by the BGP community list, use the show ip bgp community-list command in EXEC mode.

Example:

The following is sample output of the show ip bgp community-list command in privileged EXEC mode:

Router# show ip bgp community-list 20
BGP table version is 716977, local router ID is 193.0.32.1
Status codes: s suppressed, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
* i3.0.0.0 193.0.22.1 0 100 0 1800 1239 ?
*>i 193.0.16.1 0 100 0 1800 1239 ?
* i6.0.0.0 193.0.22.1 0 100 0 1800 690 568 ?
*>i 193.0.16.1 0 100 0 1800 690 568 ?
* i7.0.0.0 193.0.22.1 0 100 0 1800 701 35 ?
*>i 193.0.16.1 0 100 0 1800 701 35 ?
* 172.16.72.24 0 1878 704 701 35 ?
* i8.0.0.0 193.0.22.1 0 100 0 1800 690 560 ?
*>i 193.0.16.1 0 100 0 1800 690 560 ?
* 172.16.72.24 0 1878 704 701 560 ?
* i13.0.0.0 193.0.22.1 0 100 0 1800 690 200 ?
*>i 193.0.16.1 0 100 0 1800 690 200 ?
* 172.16.72.24 0 1878 704 701 200 ?
* i15.0.0.0 193.0.22.1 0 100 0 1800 174 ?
*>i 193.0.16.1 0 100 0 1800 174 ?
* i16.0.0.0 193.0.22.1 0 100 0 1800 701 i
*>i 193.0.16.1 0 100 0 1800 701 i
* 172.16.72.24 0 1878 704 701 i

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp dampened-paths

Mode:

Router>

Syntax:

show ip bgp dampened-paths

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display BGP dampened routes, use the show ip bgp dampened-paths command in EXEC mode.

Example:

The following is sample output from the show ip bgp dampened-paths command in privileged EXEC mode:

Router# show ip bgp dampened-paths
BGP table version is 10, local router ID is 171.69.232.182
Status codes: s suppressed, d damped, h history, * valid, > best, i -
internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network From Reuse Path
*d 10.0.0.0 171.69.232.177 00:18:4 100 ?
*d 12.0.0.0 171.69.232.177 00:28:5 100 ?

Misconceptions:

None.

Related Commands:

bgp dampening

clear ip bgp dampening

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp filter-list

Mode:

Router>

Syntax:

show ip bgp filter-list access-list-number

Syntax Description:

access-list-number Number of an autonomous system path access list. It can be a number from 1 to 199.

Command Description:

To display routes that conform to a specified filter list, use the show ip bgp filter-list command in EXEC mode.

Example:

The following is sample output from the show ip bgp filter-list command in privileged EXEC mode:

Router# show ip bgp filter-list 2
BGP table version is 1738, local router ID is 172.16.72.24
Status codes: s suppressed, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
* 172.16.0.0 172.16.72.30 0 109 108 ?
* 172.16.1.0 172.16.72.30 0 109 108 ?
* 172.16.11.0 172.16.72.30 0 109 108 ?
* 172.16.14.0 172.16.72.30 0 109 108 ?
* 172.16.15.0 172.16.72.30 0 109 108 ?
* 172.16.16.0 172.16.72.30 0 109 108 ?
* 172.16.17.0 172.16.72.30 0 109 108 ?
* 172.16.18.0 172.16.72.30 0 109 108 ?
* 172.16.19.0 172.16.72.30 0 109 108 ?
* 172.16.24.0 172.16.72.30 0 109 108 ?
* 172.16.29.0 172.16.72.30 0 109 108 ?
* 172.16.30.0 172.16.72.30 0 109 108 ?
* 172.16.33.0 172.16.72.30 0 109 108 ?
* 172.16.35.0 172.16.72.30 0 109 108 ?
* 172.16.36.0 172.16.72.30 0 109 108 ?
* 172.16.37.0 172.16.72.30 0 109 108 ?
* 172.16.38.0 172.16.72.30 0 109 108 ?
* 172.16.39.0 172.16.72.30 0 109 108 ?

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp flap-statistics

Mode:

Router>

Syntax:

show ip bgp flap-statistics [{regexp regexp} | {filter-list access-list} | {ip-address mask [longer-prefix]}]

Syntax Description:

regexp regexp | (Optional) Clears flap statistics for all the paths that match the regular expression.
filter-list access-list | (Optional) Clears flap statistics for all the paths that pass the access list.
ip-address | (Optional) Clears flap statistics for a single entry at this IP address.
mask | (Optional) Network mask applied to the value.
longer-prefix | (Optional) Displays flap statistics for more specific entries.

Command Description:

To display BGP flap statistics, use the show ip bgp flap-statistics command in EXEC mode.

If no arguments or keywords are specified, the router displays flap statistics for all routes.

Example:

The following is sample output from the show ip bgp flap-statistics command in privileged EXEC mode:

Router# show ip bgp flap-statistics
BGP table version is 10, local router ID is 171.69.232.182
Status codes: s suppressed, d damped, h history, * valid, > best, i -
internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network From Flaps Duration Reuse Path
*d 10.0.0.0 171.69.232.177 4 00:13:31 00:18:10 100
*d 12.0.0.0 171.69.232.177 4 00:02:45 00:28:20 100

Misconceptions:

None.

Related Commands:

bgp dampening

clear ip bgp flap-statistics

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp inconsistent-as

Mode:

Router>

Syntax:

show ip bgp inconsistent-as

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display routes with inconsistent originating autonomous systems, use the show ip bgp inconsistent-as command in EXEC mode.

Example:

The following is sample output from the show ip bgp inconsistent-as command in privileged EXEC mode:

Router# show ip bgp inconsistent-as
BGP table version is 87, local router ID is 172.19.82.53
Status codes: s suppressed, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
* 11.0.0.0 171.69.232.55 0 0 300 88 90 99 ?
*> 171.69.232.52 2222 0 400 ?
* 171.69.0.0 171.69.232.55 0 0 300 90 99 88 200 ?
*> 171.69.232.52 2222 0 400 ?
* 200.200.199.0 171.69.232.55 0 0 300 88 90 99 ?
*> 171.69.232.52 2222 0 400 ?

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp ipv4

Mode:

Router>

Syntax:

show ip bgp ipv4 {multicast | unicast}

Syntax Description:

multicast | Displays entries for multicast routes.
unicast | Displays entries for unicast routes.

Command Description:

To display entries in the IP version 4 (IPv4) Border Gateway Protocol (BGP) routing table, use the show ip bgp ipv4 command in EXEC mode.

Example:

The following is sample output from the show ip bgp ipv4 unicast command:

Router#show ip bgp ipv4 unicast
 BGP table version is 4, local router ID is 10.0.40.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 10.10.10.0/24   172.16.10.1              0            0  300 i
*> 10.10.20.0/24   172.16.10.1              0    0  300 i
* 10.20.10.0/24   172.16.10.1              0            0  300 i

The following is sample output from the show ip bgp ipv4 multicast command:

Router#show ip bgp ipv4 multicast
 BGP table version is 4, local router ID is 10.0.40.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 10.10.10.0/24   172.16.10.1              0            0  300 i
*> 10.10.20.0/24   172.16.10.1              0    0  300 i
* 10.20.10.0/24   172.16.10.1              0            0  300 i

Misconceptions:

None.

Related Commands:

show ip bgp

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp neighbors

Mode:

Router>

Syntax:

show ip bgp neighbors [neighbor-address] [received-routes | routes | advertised-routes | {paths regexp} | dampened-routes]

Syntax Description:

neighbor-address | (Optional) Address of the neighbor whose routes you have learned from. If you omit this argument, all neighbors are displayed.
received-routes | (Optional) Displays all received routes (both accepted and rejected) from the specified neighbor.
routes | (Optional) Displays all routes that are received and accepted. This is a subset of the output from the received-routes keyword.
advertised-routes | (Optional) Displays all the routes the router has advertised to the neighbor.
paths regexp | (Optional) Regular expression that is used to match the paths received.
dampened-routes | (Optional) Displays the dampened routes to the neighbor at the IP address specified.

Command Description:

To display information about the TCP and BGP connections to neighbors, use the show ip bgp neighbors command in EXEC mode.

Example:

The following is sample output from the show ip bgp neighbors command in privileged EXEC mode:

Router#show ip bgp neighbors 172.16.232.178
BGP neighbor is 172.16.232.178, remote AS 35, external link
BGP version 4, remote router ID 192.168.3.3
BGP state = Established, up for 1w1d
Last read 00:00:53, hold time is 180, keepalive interval is 60 seconds
Neighbor capabilities:
Route refresh: advertised and received
Address family IPv4 Unicast: advertised and received
Address family IPv4 Multicast: advertised and received
Received 12519 messages, 0 notifications, 0 in queue
Sent 12523 messages, 0 notifications, 0 in queue
Route refresh request: received 0, sent 0
Minimum time between advertisement runs is 30 seconds
For address family: IPv4 Unicast
BGP table version 5, neighbor version 5
Index 1, Offset 0, Mask 0x2
Community attribute sent to this neighbor
Inbound path policy configured
Outbound path policy configured
Route map for incoming advertisements is uni-in
Route map for outgoing advertisements is uni-out
3 accepted prefixes consume 108 bytes
Prefix advertised 6, suppressed 0, withdrawn 0
For address family: IPv4 Multicast
BGP table version 5, neighbor version 5
Index 1, Offset 0, Mask 0x2
Inbound path policy configured
Outbound path policy configured
Route map for incoming advertisements is mul-in
Route map for outgoing advertisements is mul-out
3 accepted prefixes consume 108 bytes
Prefix advertised 6, suppressed 0, withdrawn 0
Connections established 2; dropped 1
Last reset 1w1d, due to Peer closed the session
Connection state is ESTAB, I/O status: 1, unread input bytes: 0
Local host: 172.16.232.178, Local port: 179
Foreign host: 172.16.232.179, Foreign port: 11002
Enqueued packets for retransmit: 0, input: 0 mis-ordered: 0 (0 bytes)
Event Timers (current time is 0x2CF49CF8):
Timer Starts Wakeups Next
Retrans 12518 0 0x0
TimeWait 0 0 0x0
AckHold 12514 12281 0x0
SendWnd 0 0 0x0
KeepAlive 0 0 0x0
GiveUp 0 0 0x0
PmtuAger 0 0 0x0
DeadWait 0 0 0x0
iss: 273358651 snduna: 273596614 sndnxt: 273596614 sndwnd: 15434
irs: 190480283 rcvnxt: 190718186 rcvwnd: 15491 delrcvwnd: 893
SRTT: 300 ms, RTTO: 607 ms, RTV: 3 ms, KRTT: 0 ms
minRTT: 0 ms, maxRTT: 300 ms, ACK hold: 200 ms
Flags: passive open, nagle, gen tcbs
Datagrams (max data segment is 1460 bytes):
Rcvd: 24889 (out of order: 0), with data: 12515, total data bytes: 237921
Sent: 24963 (retransmit: 0), with data: 12518, total data bytes: 237981

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp paths

Mode:

Router>

Syntax:

show ip bgp paths

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display all the BGP paths in the database, use the show ip bgp paths command in EXEC mode.

Example:

The following is sample output from the show ip bgp paths command in privileged EXEC mode:

Router#show ip bgp paths
Address Hash Refcount Metric Path
0x60E5742C 0 1 0 i
0x60E3D7AC 2 1 0 ?
0x60E5C6C0 11 3 0 10 ?
0x60E577B0 35 2 40 10 ?

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp peer-group

Mode:

Router>

Syntax:

show ip bgp peer-group [peer-group-name] [summary]

Syntax Description:

peer-group-name | (Optional) Displays information about that specific peer group.
summary | (Optional) Displays a summary of the status of all the members of a peer group.

Command Description:

To display information about BGP peer groups, use the show ip bgp peer-group command in EXEC mode.

Example:

The following is sample output from show ip bgp peer-group command for a peer group named internal in privileged EXEC mode:

Router#show ip bgp peer-group internal
BGP peer-group is internal, remote AS 100
BGP version 4
Minimum time between advertisement runs is 5 seconds
For address family:IPv4 Unicast
BGP neighbor is internal, peer-group internal, members:
10.1.1.1 10.1.1.2
Index 3, Offset 0, Mask 0x8
Incoming update AS path filter list is 53
Outgoing update AS path filter list is 54
Route map for incoming advertisements is MAP193
Route map for outgoing advertisements is MAP194
Update messages formatted 0, replicated 0

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp regexp

Mode:

Router>

Syntax:

show ip bgp regexp regexp

no debug ip eigrp

Syntax Description:

regexp Regular expression to match the BGP autonomous system paths.

Command Description:

To display routes matching the autonomous system path regular expression, use the show ip bgp regexp command in EXEC mode.

Example:

The following is sample output from the show ip bgp regexp command in privileged EXEC mode:

Router#show ip bgp regexp 108$
BGP table version is 1738, local router ID is 172.16.72.24
Status codes: s suppressed, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
* 172.16.0.0 172.16.72.30 0 109 108 ?
* 172.16.1.0 172.16.72.30 0 109 108 ?
* 172.16.11.0 172.16.72.30 0 109 108 ?
* 172.16.14.0 172.16.72.30 0 109 108 ?
* 172.16.15.0 172.16.72.30 0 109 108 ?
* 172.16.16.0 172.16.72.30 0 109 108 ?
* 172.16.17.0 172.16.72.30 0 109 108 ?
* 172.16.18.0 172.16.72.30 0 109 108 ?
* 172.16.19.0 172.16.72.30 0 109 108 ?
* 172.16.24.0 172.16.72.30 0 109 108 ?
* 172.16.29.0 172.16.72.30 0 109 108 ?
* 172.16.30.0 172.16.72.30 0 109 108 ?
* 172.16.33.0 172.16.72.30 0 109 108 ?
* 172.16.35.0 172.16.72.30 0 109 108 ?
* 172.16.36.0 172.16.72.30 0 109 108 ?
* 172.16.37.0 172.16.72.30 0 109 108 ?
* 172.16.38.0 172.16.72.30 0 109 108 ?
* 172.16.39.0 172.16.72.30 0 109 108 ?

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip bgp summary

Mode:

Router>

Syntax:

show ip bgp summary

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the status of all BGP connections, use the show ip bgp summary command in EXEC mode.

Example:

The following is sample output from the show ip bgp summary command in privileged EXEC mode:

Router# show ip bgp summary
BGP router identifier 172.16.1.1, local AS number 100
BGP table version is 199, main routing table version 199
37 network entries and 59 paths using 5713 bytes of memory
18 BGP path attribute entries using 936 bytes of memory
10 BGP AS-PATH entries using 240 bytes of memory
7 BGP community entries using 168 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
36 received paths for inbound soft reconfiguration
BGP activity 37/2849 prefixes, 60/1 paths, scan interval 15 secs
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
10.100.1.1  4 200 26 22 199 0 0 00:14:23 23
10.200.1.1  4 300 21 51 199 0 0 00:13:40 0

Misconceptions:

None.

Related Commands:

neighbor maximum-prefix

neighbor shutdown

© Cisco Systems, Inc. 2001, 2002


 Command:

show ip prefix-list

Mode:

Router>

Syntax:

show ip prefix-list [detail | summary] prefix-list-name [network/length] [seq sequence-number] [longer] [first-match]

Syntax Description:
detail | summary | (Optional) Displays detailed or summarized information about all prefix lists.
seq | (Optional) Applies the sequence number to the prefix list entry.
sequence-number | (Optional) The sequence number of the prefix list entry
prefix-list-name | (Optional) The name of a specific prefix list
network/length | (Optional) The network number and length (in bits) of the network mask
longer | Displays all entries of a prefix list that are more specific than the given network/length.
first-match | Displays the entry of a prefix list that matches the given network/length.

Command Description:

To display information about a prefix list or prefix list entries, use the show ip prefix-list command in user and privileged EXEC mode.

Example:
The following example shows the output of the show ip prefix-list command with details about the prefix list named test in privileged EXEC mode:

Router#show ip prefix-list detail test
ip prefix-list test:
Description: test-list
cont: 1, range entries: 0, sequences: 10 - 10, refcount: 3
seq 10 permit 35.0.0.0/8 (hit count: 0, refcount: 1)

Misconceptions:

When troubleshooting a prefix list, a technician may want to reset the hit count. The number of hits related to a prefix list can be cleared using the clear ip prefix-list command.

Related commands:
ip prefix-list
distribute-list


 Command:

show ip protocols

Mode:

Router>

Syntax:

show ip protocols

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the parameters and current state of the active routing protocol process, use the show ip protocols EXEC command.

The information displayed by show ip protocols is useful in debugging routing operations. Information in the Routing Information Sources field of the show ip protocols output can help you identify a router suspected of delivering bad routing information.

Examples:

The following is a sample of output from the show ip protocols command, showing IGRP processes:

Router#show ip protocols

Routing Protocol is "igrp 109"
  Sending updates every 90 seconds, next due in 44 seconds
  Invalid after 270 seconds, hold down 280, flushed after 630
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Default networks flagged in outgoing updates
  Default networks accepted from incoming updates
  IGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  IGRP maximum hopcount 100
  IGRP maximum metric variance 1
  Redistributing: igrp 109
  Routing for Networks:
    198.92.72.0
  Routing Information Sources:
    Gateway         Distance      Last Update
    198.92.72.18         100      0:56:41
    198.92.72.19         100      6d19
    198.92.72.22         100      0:55:41
    198.92.72.20         100      0:01:04
    198.92.72.30         100      0:01:29
  Distance: (default is 100)

Routing Protocol is "bgp 1878"
  Sending updates every 60 seconds, next due in 0 seconds
  Outgoing update filter list for all interfaces is 1
  Incoming update filter list for all interfaces is not set
  Redistributing: igrp 109
  IGP synchronization is disabled
  Automatic route summarization is enabled
  Neighbor(s):
    Address          FiltIn FiltOut DistIn DistOut Weight RouteMap
    192.108.211.17                1
    192.108.213.89                1
    198.6.255.13                  1
    198.92.72.18                  1
    198.92.72.19
    198.92.84.17                  1
  Routing for Networks:
    192.108.209.0
    192.108.211.0
    198.6.254.0
  Routing Information Sources:
    Gateway         Distance      Last Update
    198.92.72.19          20      0:05:28
  Distance: external 20 internal 200 local 200

The following table describes significant fields shown in the IGRP display:

Table: Show IP Protocols Field Descriptions for IGRP Processes
Field Description

Routing Protocol is "igrp 109"

Specifies the routing protocol used

Sending updates every 90 seconds

Specifies the time between sending updates

next due in 44 seconds

Precisely when the next update is due to be sent

Invalid after 270 seconds

Specifies the value of the invalid parameter

hold down for 280

Specifies the current value of the hold-down parameter

flushed after 630

Specifies the time in seconds after which the individual routing information will be thrown (flushed) out

Outgoing update ...

Specifies whether the outgoing filtering list has been set

Incoming update ...

Specifies whether the incoming filtering list has been set

Default networks

Specifies how these networks will be handled in both incoming and outgoing updates

IGRP metric

Specifies the value of the K0-K5 metrics, as well as the maximum hopcount

Redistributing

Lists the protocol that is being redistributed

Routing

Specifies the networks for which the routing process is currently injecting routes

Routing Information Sources

Lists all the routing sources the Cisco IOS software is using to build its routing table. For each source, you will see the following displayed:

  • IP address
  • Administrative distance
  • Time the last update was received from this source.

The following is a sample of output from the show ip protocols command, showing EIGRP processes:

Router#show ip protocols

Routing Protocol is "eigrp 77"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Redistributing: eigrp 77
  Automatic network summarization is in effect
  Routing for Networks:
    160.89.0.0
  Routing Information Sources:
    Gateway         Distance      Last Update
    160.89.81.28          90      0:02:36
    160.89.80.28          90      0:03:04
    160.89.80.31          90      0:03:04
  Distance: internal 90 external 170

The table describes the fields that might be shown in the display.

Table: show ip protocols Field Descriptions for EIGRP Processes
Field Description

Routing Protocol is "eigrp 77"

Name and autonomous system number of the currently running routing protocol.

Outgoing update filter list for all interfaces...

Indicates whether a filter for outgoing routing updates has been specified with the distribute-list out command.

Incoming update filter list for all interfaces...

Indicates whether a filter for incoming routing updates has been specified with the distribute-list in command.

Redistributing: eigrp 77

Indicates whether route redistribution has been enabled with the redistribute command.

Automatic network summarization...

Indicates whether route summarization has been enabled with the auto-summary command.

Routing for Networks:

Networks for which the routing process is currently injecting routes.

Routing Information Sources:

Lists all the routing sources that the Cisco IOS software is using to build its routing table. The following is displayed for each source: IP address, administrative distance, and time the last update was received from this source.

Distance: internal 90 external 170

Internal and external distances of the router. Internal distance is the degree of preference given to EIGRP internal routes. External distance is the degree of preference given to EIGRP external routes.

The following is a sample of output from the show ip protocols command, showing IS-IS processes:

Router#show ip protocols

Routing Protocol is "isis"
  Sending updates every 0 seconds
  Invalid after 0 seconds, hold down 0, flushed after 0
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Redistributing: isis
  Address Summarization:
    None
  Routing for Networks:
    Serial0
  Routing Information Sources:
  Distance: (default is 115)

The following is a sample of output from the show ip protocols command, showing RIP processes:

Router#show ip protocols

Routing Protocol is "rip"
  Sending updates every 30 seconds, next due in 2 seconds
  Invalid after 180 seconds, hold down 180, flushed after 240
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Redistributing: rip
  Default version control: send version 2, receive version 2
    Interface        Send  Recv   Key-chain
    Ethernet0        2     2      trees
    Fddi0            2     2
  Routing for Networks:
    172.19.0.0
    2.0.0.0
    3.0.0.0
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 120)

Misconceptions:

None

Related commands:
None


Command:

show ip route

Mode:

Router>

Syntax:

show ip route [address [mask] [longer-prefixes]] | [protocol [process-id]] | [list access-list-number | access-list-name]

Syntax Description:

address | (Optional) Address about which routing information should be displayed.
mask | (Optional) Argument for a subnet mask.
longer-prefixes | (Optional) The address and mask pair becomes a prefix and any routes that match that prefix are displayed.
protocol | (Optional) Name of a routing protocol, or the keyword connected, static, or summary. If you specify a routing protocol, use one of the following keywords: bgp, egp, eigrp, hello, igrp, isis, ospf, or rip.
process-id | (Optional) Number used to identify a process of the specified protocol.
list | (Optional) The list keyword is required to filter output by an access list name or number.
access-list-name | (Optional) Filters the displayed output of the routing table based on the specified access list name.
access-list-number | (Optional) Filters the displayed output of the routing table based on the specified access list number.

Command Description:

Use the show ip route EXEC command to display the current state of the routing table.

Example:

Router#show ip route

  Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
  D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
  N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
  E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
  i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
  U - per-user static route, o - ODR

  Gateway of last resort is not set

  C 1.0.0.0/8 is directly connected, Serial0
  O 2.0.0.0/8 [110/128] via 1.1.1.2, 00:07:11, Serial0
  3.0.0.0/32 is subnetted, 1 subnets
  O 3.1.1.1 [110/129] via 1.1.1.2, 00:07:11, Serial0

Misconceptions:

None

Related commands:

ip route

ip default-network


Command:

synchronization

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

synchronization
no synchronization

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the synchronization between BGP and your Interior Gateway Protocol (IGP) system, use the synchronization command in address family or router configuration mode. To enable the Cisco IOS software to advertise a network route without waiting for the IGP, use the no form of this command.

The behavior of this command is enabled by default.

Usually, a BGP speaker does not advertise a route to an external neighbor unless that route is local or exists in the IGP. The no synchronization command allows the Cisco IOS software to advertise a network route without waiting for the IGP. This feature allows routers and access servers within an autonomous system to have the route before BGP makes it available to other autonomous systems.

Use the synchronization command if routers in the autonomous system do not speak BGP.

Example:

The following router configuration mode example enables a router to advertise a network route without waiting for IGP:

Router(config)#router bgp 120
Router(config-router)#no synchronization

The following address family configuration mode example enables a router to advertise a network route without waiting for IGP:

Router(config)#router bgp 120
Router(config-router)#address-family ipv4 unicast
Router(config-router-af)#no synchronization

Misconceptions:

None

Related Commands:

address-family ipv4


Command:

table-map

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

table-map map-name
no table-map map-name

Syntax Description:

This command has no arguments or keywords.

Command Description:

To modify metric and tag values when the IP routing table is updated with BGP learned routes, use the table-map command in address family or router configuration mode. To disable this function, use the no form of the command.

This command is disabled by default.

This command adds the route map name defined by the route-map command to the IP routing table. This command is used to set the tag name and the route metric to implement redistribution.

You can use match clauses of route maps in the table-map command. IP access list, autonomous system paths, and next hop match clauses are supported.

Example:

In the following router configuration mode example, the Cisco IOS software is configured to automatically compute the tag value for the BGP learned routes and to update the IP routing table:

Router(config)#route-map tag
Router(config-route-map)#match as path 10
Router(config-route-map)#set automatic-tag

Router(config)#router bgp 100
Router(config-router)#table-map tag

In the following address family configuration mode example, the Cisco IOS software is configured to automatically compute the tag value for the BGP learned routes and to update the IP routing table:

Router(config)#route-map tag
Router(config-route-map)#match as path 10
Router(config-route-map)#set automatic-tag

Router(config)#router bgp 100
Router(config-router)#address-family ipv4 unicast
Router(config-router-af)#table-map tag

Misconceptions:

None

Related Commands:

address-family ipv4
match as-path
match ip address
match ip next-hop
route-map


Command:

timers bgp

Mode:

Router(config-router)#

Syntax:

timers bgp keepalive holdtime
no timers bgp

Syntax Description:

keepalive | Frequency (in seconds) with which the Cisco IOS software sends keepalive messages to its peer. The default is 60 seconds.
holdtime | Interval (in seconds) after not receiving a keepalive message that the software declares a peer dead. The default is 180 seconds.

Command Description:

To adjust BGP network timers, use the timers bgp command in router configuration mode. To reset the BGP timing defaults, use the no form of this command.

Defaults:

keepalive: 60 seconds

holdtime: 180 seconds

Example:

The following example changes the keepalive timer to 70 seconds and the hold-time timer to 210 seconds:

Router(config-router)#timers bgp 70 210

Misconceptions:

None

Related Commands:

router bgp


Command:

configure

Mode:

Router#

Syntax:

configure {terminal | memory | network | overwrite-network}

Syntax Description:

terminal

Enters global configuration mode to allow you to configure the system from the terminal.

network

Configure from a TFTP network host

overwrite-network

Overwrite NVRAM from TFTP network host

memory

Configures the system with the commands found in the default NVRAM configuration file.

For the Class A Flash file system platforms, configures the system with the configuration file specified by the CONFIG_FILE environment variable.

Command Description:

This command is used to switch from enable mode to one of the configuration modes.

Example:

The following will put the router into the configuration mode with the changes being done through the terminal session.

Router#configure terminal

Router(config)#

Misconceptions:

None

Related Commands:

exit


Command:

disable

Mode:

Router#

Router>

Syntax:

disable [privilege-level]

Syntax Description:

privilege-level

You can specify up to 16 privilege levels, using numbers 0 through 15. Level 1 is normal EXEC-mode user privileges. If this argument is not specified, the privilege level defaults to level 15 (traditional enable privileges).

Command Description:

To exit privileged EXEC mode and return to user EXEC mode, enter the disable EXEC command. Use this command with the level option to reduce the user-privilege level. If a level is not specified, it defaults to the user EXEC mode, which is level 1.

Example:

Router#disable

Misconceptions:

The disable and exit commands are often confused. Exit is thought to return to the previous prompt. However from the privilege exec prompt, exit will terminate the session. To return to the previous mode (user exec), use disable.

Related Commands:

enable


Command:

enable

Mode:

Router>

Syntax:

enable [privilege-level]

Syntax Description:

privilege-level

You can specify up to 16 privilege levels, using numbers 0 through 15. Level 1 is normal EXEC-mode user privileges. If this argument is not specified, the privilege level defaults to level 15 (traditional enable privileges).

Command Description:

To enter privileged EXEC mode, use the enable EXEC command. Since many of the privileged commands set operating parameters, privileged access should be password-protected to prevent unauthorized use. If the system administrator has set a password with the enable password global configuration command, a prompt to enter the password will appear before being allowed access to privileged EXEC mode. If an enable password has not been set, enable mode can only be accessed from the router console. If a level is not specified, it defaults to the privileged EXEC mode, which is level 15.

Example:

The following command will enter the privilege exec mode from the user exec mode:

Router>enable
Router#

Misconceptions:

None

Related Commands:

exit

disable


 Command:

exit

Mode:

Router>
Router#
Router(config)#
Router(config-if)#
Router(config-line)#
Router(config-router)#
...

Syntax:

exit

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the exit command at the EXEC levels to exit the EXEC mode. Use the exit command at the configuration level to return to privileged EXEC mode. Use the exit command in interface, line, router, IPX-router, and route-map command modes to return to global configuration mode. Use the exit command in subinterface configuration mode to return to interface configuration mode. You also can press Ctrl-Z, or use the end command, from any configuration mode to return to privileged EXEC mode.

Example:

The following command will return the router session from the global config mode to the privilege exec mode.

Router(config)#exit
Router#

Misconceptions:

The disable and exit commands are often confused. Exit is thought to return to the previous prompt. However from the privilege exec prompt, exit will terminate the session. To return to the previous mode (user exec), use disable.

Related Commands:
disable


Command:

access-class

Mode:

Router(config-line)#

Syntax:

access-class access-list-number {in | out}

no access-class number

Syntax Description:

access-list-number

Specifies an integer between 1 and 199 that defines the access-list.

in

Controls which nodes can make LAT connections into the server.

out

Defines the access checks made on outgoing connections. (A user who types a node name at the system prompt to initiate a LAT connection is making an outgoing connection.)

Command Description:

To define restrictions on incoming and outgoing connections, use the access-class line configuration command. To remove the access-list number, use the no form of this command. This command defines access list numbers that will then be used with the lat access-list command to specify the access conditions.

The value supplied for the access-list-number argument is used for all protocols supported by the Cisco IOS software. If you are already using an IP access list, you must define LAT (and possibly X.25) access lists permitting connections to everything, to emulate the behavior of previous software versions.

When both IP and LAT connections are allowed from a terminal line and an IP access list is applied to that line with the access-class line command, a LAT access list must also be created with the same number if any LAT connections from that terminal are going to be allowed. Only one incoming and one outgoing access list number can be specified for each terminal line. When checking LAT access lists, if the specified list does not exist, the system denies all LAT connections.

Example:

The following example configures an incoming access class on virtual terminal line 4:

Router(config)#line vty 4
Router(config-line)#access-class 4 in

Misconceptions:

None

Related Commands:

None


Command:

exec-timeout

Mode:

Router(config-line)#

Syntax:

exec-timeout minutes [seconds]

no exec-timeout

Syntax Description:

minutes

Integer that specifies the number of minutes

seconds

(Optional) Additional time intervals in seconds

Command Description:

To set the interval that the EXEC command interpreter waits until user input is detected, use the exec-timeout line configuration command. To remove the timeout definition, use the no form of this command.

If no input is detected during the interval, the EXEC facility resumes the current connection. If no connections exist, the EXEC facility returns the terminal to the idle state and disconnects the incoming session. To specify no timeout, enter the exec-timeout 0 0 command.

Examples:

The following example sets a time interval of 2 minutes, 30 seconds:

Router(config)#line console
Router(config-time)#exec-timeout 2 30

The following example sets a time interval of 10 seconds:
Router(config)#line console
Router(config)#exec-timeout 0 10

Misconceptions:

None

Related Commands:

None


 Command:

line

Mode:

Router(config)#

Syntax:

line [aux | console | tty | vty ] line-number [ending-line-number]

Syntax Description:

aux

(Optional) This represents the auxiliary EIA/TIA-232 DTE port. Must be addressed as relative line 0. The auxiliary port can be used for modem support and asynchronous connections.

console

(Optional) This represents the console terminal line. The console port is DCE.

tty

(Optional) Standard asynchronous line

vty

(Optional) Virtual terminal for remote console access

line-number

The relative number of the terminal line (or the first line in a contiguous group) that you want to configure when the line type is specified. Numbering begins with zero.

ending-line-number

(Optional) The relative number of the last line in a contiguous group that you want to configure. If you omit the keyword, then line-number and ending-line-number are absolute rather than relative line numbers.

Command Description:

To identify a specific line for configuration and begin the line configuration command collection mode, use the line global configuration command. Entering the line command with the optional line type (aux , console , tty , or vty ) designates the line number as a relative line number. Relative line numbers always begin numbering at zero and define the type of line. Addressing the second virtual terminal line as line VTY 1, for example, is easier than remembering it as line 143, its absolute line number. Entering the line command without specifying a line type causes the line number to be treated as an absolute line number.

Example:

The following example configures 5 virtual terminal sessions for remote access.

Router(config)#line vty 0 4

The following example configures line parameters for line 65, which can be of any type:

Router(config)#line 65

Misconceptions:
None

Related Commands:
show line


 Command:

lockable

Mode:

Router(config-line)#

Syntax:

lockable

no lockable

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the lock EXEC command, use the lockable global configuration command. This command enables a terminal-locking mechanism that allows a terminal to be temporarily locked. Use the no form of this command to reinstate the default. This allows a user to lock a privilege exec session using the lock command. A locked session allows the user to leave a privilege exec session and not leave it available for someone to change. When a lock command is issued, the user will be prompted for a password and a conformation of that password. When the password and conformation is entered, the session is locked. The user must press the Enter key and enter this password to resume the session.

Example:

The following example is the dialog of the use of the lockable and lock commands

Router#conf t
Router(config)#line console 0
Router(config-line)#lock
Router(config-line)#lockable
Router(config-line)#^z
Router#lock

Password:

Again:

Locked

Password:

Misconceptions:
None

Related Commands:
lock
line


 Command:

login

Mode:

Router#(config-line)#

Syntax:

login [local | tacacs]

no login [local | tacacs]

Syntax Description:
local This key word selects local password checking. Authentication is based on the username specified with the username global configuration command.
tacacs

Selects the TACACS-style user ID and password-checking mechanism

Command Description:

To enable password checking at login, use the login line configuration command. Use the no form of this command to disable password checking and allow connections without a password. Virtual terminals (VTYs) require a password. If you do not set a password for a virtual terminal, it responds to attempted connections by displaying an error message and closing the connection. If you specify the login command without the local or tacacs option, authentication is based on the password specified with the password line configuration command.

Example:

The following example show a sequence of commands that creates a local user and sets up console 0 for local login.

Router#conf t
Router(config)#username  mark  password kram
Router(config)#line console  0
Router(config-line)#login local
Router(config-line)#^Z
Router#exit
Router con0 is now available

Press RETURN to get started.

User Access Verification

Username:

Misconceptions:
None

Related Commands:
login
username


Command:

password

Mode:

Router(config-line)#

Syntax:

password password

no password password

Syntax Description:

password

The password to assign to the line

Command Description:

To specify a password on a line, use the password line configuration command. Use the no form of this command to remove the password.

Examples:

The following example sets a password for virtual terminal sessions 0 through 4.

Router(config)#line vty 0 4
Router(config-line)#password 12345

The following example will set a password of 1234 on console 0.

Router(config)#line console 0
  Router(config-line)#password 1234
  Router(config-line)#^Z
  Router#

Misconceptions:

None

Related Commands:

None


Command:

session limit

Mode:

Router(config-line)#

Syntax:

session limit session-number

no session limit

Syntax Description:

session-number

Specifies the maximum number of sessions.

Defaults

The default and set session limits are displayed with the start-character EXEC command.

Command Description:

To set the maximum number of terminal sessions per line, use the session-limit command in line configuration mode. To remove any specified session limit, use the no form of this command.

Example:

The following example limits the number of sessions to eight on a ten-line range:

line 2 12

 session-limit 8

Misconceptions:

None.

Related Commands:

line vty


 Command:

show line

Mode:

Router>

Syntax:

show line [line-number | aux number | console number | tty number | vty number]

Syntax Description:
aux | Auxiliary line
console | Primary terminal line
tty | Terminal controller
vty | Virtual terminal
line-number | The line number to be shown

Command Description:

To display the parameters of a terminal line, use the show line EXEC command.

Example:

The following sample output from the show line command shows that line 17 is a virtual terminal line with a transmit and receive rate of 9600 bps. Also shown is the modem state, terminal screen width and length, and so on.

Router#show line 17

Tty Typ     Tx/Rx     A Modem  Roty AccO AccI  Uses    Noise   Overruns
A 17 VTY   9600/9600   -    -      -    -    -     1        0        0/0

Line 17, Location: "", Type: ""
Length: 24 lines, Width: 80 columns
Baud rate (TX/RX) is 9600/9600
Status: Ready, Connected, Active, No Exit Banner, Async interface active
Capabilities: Line usable as async interface
Modem state: Ready
Special Chars: Escape  Hold  Stop  Start  Disconnect  Activation
                ^^x    none   -     -       none
Timeouts:      Idle EXEC    Idle Session   Modem Answer  Session   Dispatch
                never         never                        none     not set
Session limit is not set.
Time since activation: never
Editing is enabled.
History is enabled, history size is 10.
Full user help is disabled
Allowed transports are lat telnet rlogin mop.  Preferred is lat.
No output characters are padded
No special data dispatching characters

Line is running SLIP routing for address 1.0.0.2.
0 output packets queued, 0 input packets.
Group codes:    0

The table describes the fields in the show line output.

Table: Show Line Field Descriptions

Field Description

Tty

Line number. In this case, 17.

Typ

Type of line. In this case, a virtual terminal line (VTY), which is active, in asynchronous mode denoted by the preceding `A.' Other possible values are:

  • CTY---console
  • AUX---auxiliary port
  • TTY---asynchronous terminal port
  • lpt---parallel printer

Tx/Rx

Transmit rate/receive rate of the line.

A

Indicates whether autobaud has been configured for the line. A value of F indicates that autobaud has been configured; a hyphen indicates that it has not been configured.

Modem

Types of modem signals that have been configured for the line. Possible values include

  • callin
  • callout
  • cts-req
  • DTR-Act
  • inout
  • RIisCD

Roty

Rotary group configured for the line.

AccO, AccI

Output or Input access list number configured for the line.

Uses

Number of connections established to or from the line since the system was restarted.

Noise

Number of times noise has been detected on the line since the system restarted.

Overruns

Hardware (UART) overruns and/or software buffer overflows, both defined as the number of overruns or overflows that have occurred on the specified line since the system was restarted. Hardware overruns are buffer overruns; the UART chip has received bits from the software faster than it can process them. A software overflow occurs when the software has received bits from the hardware faster than it can process them.

Line

Current line.

Location

Location of the current line.

Type

Type of line, as specified by the line global configuration command.

Length

Length of the terminal or screen display.

Width

Width of the terminal or screen display.

Baud rate (TX/RX)

Transmit rate/receive rate of the line.

Status

State of the line: Ready or not, connected or disconnected, active or inactive, exit banner or no exit banner, async interface active or inactive.

Capabilities

Current terminal capabilities. In this case, the line is usable as an asynchronous interface.

Modem state

Modem control state. This field should always read READY.

Special Chars

Current settings of special characters that were input by the user (or taken by default) from the following global configuration commands:

  • escape-character
  • hold-character
  • stop-character
  • start-character
  • disconnect-character
  • activation-character

Timeouts

Current settings that were input by the user (or taken by default) from the following global configuration commands:

  • exec-timeout
  • session-timeout
  • dispatch-timeout
  • modem answer-timeout

Session limit

Maximum number of sessions.

Time since activation

Last time start_process was run.

Editing

Whether or not command line editing is enabled.

History

Current history length, set by the user (or taken by default) from the history configuration command.

Full user help

Whether or not full user help has been set by the user with the terminal full-help command or by the administrator with the full-help line configuration command.

Allowed transports are...

Current set transport method, set by the user (or taken by default) from the transport preferred line configuration command.

characters are padded

Current set padding, set by the user (or taken by default) from the padding line configuration command.

data dispatching characters

Current dispatch character set by the user (or taken by default) from the dispatch-character line configuration command.

Line

Definition of the specified line's protocol and address.

output, input packets

Number of output and input packets queued on this line.

Group codes

AT group codes.

Misconceptions:
None

Related commands:
clear line


Command:

show users

Mode:

Router#

Syntax:

show users [all]

Syntax Description:

all

(Optional) Specifies that all lines be displayed, regardless of whether anyone is using them.

Command Description:

To display information about the active lines on the router, use the show users command in EXEC mode. This command displays the line number, connection name, idle time, hosts (including virtual access interfaces), and terminal location. An asterisk (*) indicates the current terminal session.

Example:

The following is sample output from the show users command:

Router# show users

      Line           User            Host(s)        Idle Location

      0 con 0                        idle

*     2 vty 0        rose            idle            0   BASHFUL.CISCO.COM

The following is sample output identifying an active virtual access interface:

Router# show users

Line         User      Host(s)                 Idle    Location

*  0 con 0             idle                    01:58

  10 vty 0             Virtual-Access2          0      1212321

The following is sample output from the show users all command:

Router# show users all

   Line       User          Host(s)      Idle  Location

*   0 vty 0    rose          idle         0    BASHFUL.CISCO.COM

    1 vty 1

   2 con 0

   3 aux 0

   4 vty 2

Table 30 describes the significant fields shown in the displays.

Table 30 show users Field Descriptions

Field

Description

Line

Contains three subfields:

  • The first subfield (0 in the sample output) is the absolute line number.
  • The second subfield (vty) indicates the type of line. Possible values follow:

con—console

aux—auxiliary port

tty—asynchronous terminal port

vty—virtual terminal

  • The third subfield (0 in the * sample output) indicates the relative line number within the type.

User

User using the line. If no user is listed in this field, no one is using the line.

Host(s)

Host to which the user is connected (outgoing connection). A value of idle means that there is no outgoing connection to a host.

Idle

Interval (in minutes) since the user has entered something.

Location

Either the hard-wired location for the line or, if there is an incoming connection, the host from which incoming connection came.

Misconceptions:

None.

Related Commands:

line
show line


Command:

bandwidth

Mode:

Router(config-if)#

Syntax:

bandwidth kilobits

no bandwidth

Syntax Description:

kilobits

Intended bandwidth in kilobits per second

Command Description:

To set a bandwidth value for an interface, use the bandwidth command in interface configuration mode. The bandwidth command sets an informational parameter to communicate only the current bandwidth to the higher-level protocols.

Example:

The following command sequence will set the bandwidth of serial 0/0 to 1.54 megabits per second.

Router(config)#interface serial 0/0
Router(config-if)#bandwidth 1540

Misconceptions:

The bandwidth is occasionally misinterpreted as a command to modify the bandwidth rate of an interface. You cannot adjust the actual bandwidth of an interface with this command.

Related Commands:

None


Command:

cdp enable

Mode:

Router(config-if)#

Syntax:

cdp enable

no cdp enable

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable Cisco Discovery Protocol (CDP) on an interface, use the cdp enable interface configuration command. Use the no form of this command to disable CDP on an interface. CDP is enabled by default on all supported interfaces.

Example:

The following commands enables CDP on serial 0/0:

Router(config)#interface serial 0/0
Router(config-if)#cdp enable

Misconceptions:

None

Related Commands:

show cdp neighbors

show cdp

cdp run


Command:

cdp holdtime

Mode:

Router(config)#

Syntax:

cdp holdtime seconds

no cdp holdtime

Syntax Description:

seconds

Specifies the hold time to be sent in the CDP update packets.

Defaults

180 seconds

Command Description:

To specify the amount of time the receiving device should hold a Cisco Discovery Protocol (CDP) packet from your router before discarding it, use the cdp holdtime global configuration command. To revert to the default setting, use the no form of this command.

CDP packets are sent with a time to live, or hold time, value. The receiving device will discard the CDP information in the CDP packet after the hold time has elapsed.

You can set the hold time lower than the default setting of 180 seconds if you want the receiving devices to update their CDP info more rapidly.

The CDP hold time must be set to a higher number of seconds than the time between CDP transmissions, which is set using the cdp timer command.

Example:

In the following example, the CDP packets being sent from the router are configured with a hold time of 60 seconds:

Router(config)#cdp holdtime 60

Misconceptions:

None.

Related Commands:

cdp timer
show cdp


clear cdp counters

Command:

clear cdp counters

Mode:

Router#

Syntax:

clear cdp counters

Syntax Description:

This command has no arguments or keywords.

Command Description:

To reset Cisco Discovery Protocol (CDP) traffic counters to zero, use the clear cdp counters Privileged EXEC command.

Example:

The following example clears the CDP counters. The show cdp traffic output shows that all of the traffic counters have been reset to zero:

Router#clear cdp counters
Router#show cdp traffic
CDP counters:
Packets output: 0, Input: 0
Hdr syntax: 0, Chksum error: 0, Encaps failed: 0
No memory: 0, Invalid packet: 0, Fragmented: 0

Misconceptions:

None.

Related commands:

clear cdp table
show cdp traffic


Command:

clear cdp table

Mode:

Router#

Syntax:

clear cdp table

Syntax Description:

This command has no arguments or keywords.

Command Description:

To clear the table that contains Cisco Discovery Protocol (CDP) information about neighbors, use the clear cdp table Privileged EXEC command.

Example:

The following example clears the CDP table. The output of the show cdp neighbors command shows that all information has been deleted from the table:

Router# clear cdp table

CDP-AD: Deleted table entry for neon.cisco.com, interface Ethernet0

CDP-AD: Deleted table entry for neon.cisco.com, interface Serial0

Router# show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP

 Device ID Local Intrfce Holdtme Capability  Platform  Port ID

Misconceptions:

None.

Related Commands:

show cdp neighbors


Command:

clock rate

Mode:

Router(config-if)#

Syntax:

clock rate speed-in-bits-per-second

no clock rate

Syntax Description:

speed-in-bits-per-second

Speed of line measured in bits per second

Command Description:

Use the clock rate (or clockrate) interface configuration command to configure the clock rate for the hardware connections on serial interfaces such as network interface modules (NIMs) and interface processors to an acceptable bit rate. Use the no form of this command to remove the clock rate if you change the interface from a DCE to a DTE device. Using the no form of this command on a DCE interface sets the clock rate to the hardware-dependent default value. bps (bits per second) values are physical-layer dependent (i.e. RS232, V.35, etc.) and can be any of the following:

1200
2400
4800
9600
19200
38400
56000
64000
72000
125000
148000
250000
500000
800000
1000000
1300000
2000000
4000000

Example:

The following a sets a clock of 56000 on interface serial 0/0.

Router(config)#interface serial 0/0
Router(config-if)#clock rate 56000
! or
Router(config-if)#clockrate 56000

Misconceptions:

None

Related Commands:

interface


controller

Command:

controller

Mode:

Router(config)#

Syntax:

Cisco 7200 Series and Cisco 7500 Series Routers
controller {t1 | e1} slot/port

Cisco AS5200 and AS5300 Access Servers and Cisco 4000 Series Routers
controller {t1 | e1} number

Cisco AS5800 Access Servers
controller t1 dial-shelf/slot/t3-port:t1-num

Cisco AS5800 Access Servers with Channelized T3 Interface Processor (CT3IP)
controller t3 dial-shelf/slot/t3-port

Cisco 7500 Series Cisco 7500 Series Routers with Channelized T3 Interface Processor (CT3IP)
controller t3 slot/port-adapter/port

Syntax Description:

t1 | T1 controller
e1 | E1 controller
slot/port | Backplane slot number and port number on the interface. See your hardware installation manual for the specific values and slot numbers.
number | Network processor module (NPM) number, in the range 0 through 2.
dial-shelf | Dial shelf chassis in the Cisco AS5800 access server containing the interface card.
t3-port | T3 port number. The only valid value is 0.
:t1-num | T1 timeslot in the T3 line. The value can be from 1 to 28.

Command Description:

To configure a T1 or E1 controller and enter controller configuration mode, use the controller command in global configuration mode.

T1 or E1 Fractional Data Lines:

This command is used in configurations where the router or access server is intended to communicate with a T1 or E1 fractional data line. Additional parameters for the T1 or E1 line must be configured for the controller before the T1 or E1 circuits can be configured by means of the interface global configuration command.

CT3IP Channel Interface Cards:

This command is used to configure the CT3IP and the 28 T1 channels. After the T1 channels are configured, continue to configure each T1 channel as a serial interface by using the interface serial global configuration command. Defaults: No T1, E1, or T3 controller is configured.

Example:

Cisco 7500 Series Router as a T1 Controller
The following example configures the MIP in slot 4, port 0 of a Cisco 7500 series router as a T1 controller:

Router(config)#controller t1 4/0
Router(config-controller)#

Cisco 4000 Series Router
The following example configures NIM 0 of a Cisco 4000 series router as a T1 controller:

Router(config)#controller t1 0
Router(config-controller)#

Cisco AS5800 Access Server with Dial Shelf
The following example configures the T1 controller in shelf 1, slot 0, port 0:

Router(config)#controller t1 1/0/0
Router(config-controller)#

Cisco 7500 Series
The following example configures the CT3IP in slot 3:

Router(config)# controller t3 3/0/0
Router(config-controller)#

Cisco AS5800 Access Server
The following example shows the status of the T1 controllers connected to the Cisco AS5800:

Router#show controller T1
T1 1/0/0:1 is up.
No alarms detected.
Framing is ESF, Line Code is
AMI, Clock Source is Line.
Data in current interval (770 seconds elapsed):
5 Line Code Violations, 8 Path Code Violations
0 Slip Secs, 0 Fr Loss Secs, 7 Line Err Secs, 0 Degraded Mins
0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 7 Unavail Secs
Total Data (last 81 15 minute intervals):
7 Line Code Violations, 4 Path Code Violations,
6 Slip Secs, 20 Fr Loss Secs, 2 Line Err Secs, 0 Degraded Mins,
0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 2 Unavail Secs
T1 1/0/1:5 is down.
Transmitter is sending remote alarm.
Receiver has loss of frame.
Framing is SF, Line Code is AMI, Clock Source is Line.
Data in current interval (770seconds elapsed):
50 Line Code Violations, 5 Path Code Violations
0 Slip Secs, 7 Fr Loss Secs, 7 Line Err Secs, 0 Degraded Mins
0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 7 Unavail Secs
Total Data (last 81 15 minute intervals):
27 Line Code Violations, 22 Path Code Violations,
0 Slip Secs, 13 Fr Loss Secs, 13 Line Err Secs, 0 Degraded Mins,
0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 13 Unavail Secs

Misconceptions:

None.

Related commands:

channel-group
framing
linecode
show controllers t1


 Command:

description

Mode:

Router(config-if)#

Syntax:

description string

no description

Syntax Description:

string

Comment that describes the use or tracks the attachment of a particular interface.

Command Description:

To add a description to an interface configuration, use the description interface configuration command. Use the no form of this command to remove the description.

The description command is meant solely as a comment to be put in the configuration to help you remember the use of certain interfaces. The description appears in the output of the following EXEC commands: more nvram:startup-config, show interfaces, and more system:running-config.

Example:

The following commands adds a description to serial interface 0/0.

Router(config)#interface serial 0/0
Router(config-if)#description 128k connected to SJ site

Misconceptions:
None

Related Commands:
None


 Command:

encapsulation frame-relay

Mode:

Router(config-if)#

Syntax:

encapsulation frame-relay [cisco | ietf]

no encapsulation frame-relay [ietf]

Syntax Description:

cisco

(Optional) Uses Cisco's own encapsulation, which is a 4-byte header, with 2 bytes to identify the data-link connection identifier (DLCI) and 2 bytes to identify the packet type.

ietf

(Optional) Sets the encapsulation method to comply with the Internet Engineering Task Force (IETF) standard (RFC 1490). Use this keyword when connecting to another vendor's equipment across a Frame Relay network.

Command Description:

To enable Frame Relay encapsulation, use the encapsulation frame-relay interface configuration command. To disable Frame Relay encapsulation, use the no form of this command.

Usage Guidelines

Use this command with no keywords to restore the default Cisco encapsulation, which is a 4-byte header with 2 bytes for the DLCI and 2 bytes to identify the packet type.

You should shut down the interface prior to changing encapsulation types. Although this is not required, shutting down the interface ensures the interface is reset for the new encapsulation.

Example:

The following example configures Cisco Frame Relay encapsulation on interface serial 1:

Router(config)#interface serial 1
Router(config-if)#encapsulation frame-relay

Use the ietf keyword if your router or access server is connected to another vendor's equipment across a Frame Relay network to conform with RFC 1490:

Router(config)#interface serial 1
Router(config-if)#encapsulation frame-relay ietf
Misconceptions:
None

Related Commands:
None


 Command:

encapsulation ppp

Mode:

Router(config-if)#

Syntax:

encapsulation ppp

Syntax Description:

This command has no arguments or keywords.

Command Description:

This command is used to set the encapsulation type of a serial interface interface to PPP (Point-to-Point Protocol).

Example:
Router(config)#interface serial  0
Router(config-if)#encapsulation ppp

Misconceptions:
None

Related Commands:
ppp pap
ppp multilink
ppp chap hostname


 Command:

encapsulation slip

Mode:

Router(config-if)#

Syntax:

encapsulation slip

Syntax Description:

This command has no arguments or keywords.

Command Description:

This command is used to set the encapsulation type of the current interface to Serial Line Internet Protocol. SLIP is the predecessor of ppp.

Example:

Router(config)#interface serial  0
Router(config-if)#encapsulation slip

Misconceptions:
None

Related Commands:
None


Command:

encapsulation x25

Mode:

Router(config-if)#

Syntax:

encapsulation x25 [dte  | dce ] [ddn  | bfe ] |  [ietf ]

Syntax Description:

dte

(Optional) Specifies operation as a DTE. This is the default X.25 mode.

dce

(Optional) Specifies operation as a DCE.

ddn

(Optional) Specifies DDN encapsulation on an interface using DDN X.25 Standard Service.

bfe

(Optional) Specifies BFE encapsulation on an interface attached to a BFE device.

ietf

(Optional) Specifies that the interface's datagram encapsulation defaults to use of the Internet Engineering Task Force (IETF) standard method, as defined by RFC 1356.

Command Description:

To specify a serial interface's operation as an X.25 device, use the encapsulation x25 interface configuration command.

One end of an X.25 link must be a logical DCE and the other end a logical DTE. (This assignment is independent of the interface's hardware DTE or DCE identity.) Typically, when connecting to a public data network (PDN), the customer equipment acts as the DTE and the PDN attachment acts as the DCE.

Cisco has long supported the encapsulation of a number of datagram protocols, using a standard means when available and a proprietary means when necessary. Recently the IETF adopted a standard, RFC 1356, for encapsulating most types of datagram traffic over X.25. By default, X.25 interfaces use Cisco's traditional encapsulation method. To use RFC 1356 encapsulation, specify the ietf keyword. For details see the x25 map command.

To correctly interoperate with the Defense Data Network (DDN) or a Blacker Front End (BFE) device, Cisco X.25 interfaces must derive their X.121 address from the IP address assigned to that interface. To use the appropriate algorithm for deriving the X.121 address, specify either the ddn or the bfe keyword. Use the ddn keyword when connecting to the Defence Data Network (DDN), or the bfe keyword when connecting to a Blacker Front End (BFE) device. For proper operation, the derived X.121 address must not be changed.

A router DDN attachment can operate as either a DTE or a DCE device. A BFE attachment can operate only as a DTE device. The ietf option is not available if either the ddn or bfe option is selected.

Example:

The following example configures the interface for connection to a BFE device:

Router(config)#interface serial 0/0

Router(config-if)#encapsulation x25 bfe

Misconceptions:

None

Related Commands:

x25 map


 Command:

interface

Mode:

Router(config)#

Syntax:

interface type number
interface type slot/port
interface [type slot/port-adapter/port] [ethernet | serial]  (for ports on VIP cards in the Cisco 7500 series routers)
interface serial slot/port:channel-group  (for channelized T1 or E1 on Cisco 7500 series  routers)
interface serial number:channel-group  (for channelized T1 or E1 on the Cisco 4000 series routers and the Cisco MC3810)

To configure a subinterface, use this form of the interface global configuration commands:

interface type slot/port-adapter/port.subinterface-number {multipoint | point-to-point}
(for ports on VIP cards in the Cisco 7500 series routers)
interface type slot/port.subinterface-number {multipoint | point-to-point} (for the Cisco  7200
series routers)
interface type slot/port-adapter.subinterface-number {multipoint | point-to-point}  (for the Cisco  7500 series)
Syntax Description:

type

Type of interface to be configured

number

This specifies a port, connector, or interface card number. On a Cisco 4000 series router, it specifies the NPM number. The numbers are assigned at the factory at the time of installation or when added to a system, and can be displayed with the show interfaces command.

slot

Refer to the appropriate hardware manual for slot and port information.

port

Refer to the appropriate hardware manual for slot and port information.

port-adapter

Refer to the appropriate hardware manual for information about port adapter compatibility.

:channel-group

The Cisco 4000 series routers specifies the T1 channel group number in the range of 0 to 23 defined with the channel-group controller configuration command. On a dual port card, it is possible to run channelized on one port and primary rate on the other port.

The Cisco MC3810 specifies the T1/E1 channel group number in the range of 0 to 23 defined with the channel-group controller configuration command.

.subinterface-number

This specifies the subinterface number in the range 1 to 4294967293. The number that precedes the period (.) must match the interface number to which this subinterface belongs.

multipoint | point-to-point

(Optional) This specifies a multipoint or point-to-point subinterface. There is no default.

Command Description:

Use the interface global configuration command to configure an interface type and enter interface configuration mode.

Example:

The following will move the router prompt from the global config to the interface config mode.

Router(config)#interface ethernet  0

Misconceptions:
None

Related Commands:
description
bandwidth
ip address
clock rate


Command:

ip address

Mode:

Router(config-if)#

Syntax:

ip address ip-address mask [secondary]

no ip address

Syntax Description:

ip-address mask

Value that indicates the division of network, subnetworks and host addresses

secondary

Designates an IP address as an auxiliary address

Command Description:

To set IP addresses for an interface, use the ip address interface configuration command. The secondary keyword designates an IP address as an auxiliary address. To remove the specified addresses, use the no form of this command.

Example:

The following example assigns an interface an IP address of 194.123.12.3:

Router(config-if)#ip address 194.123.12.3 255.255.255.0

Misconceptions:

None

Related Commands:

interface

clock rate


 Command:

ip cgmp

Mode:

Router(config-if)#

Syntax:

ip cgmp[proxy]

no ip cgmp

Syntax Description:

proxy

(Optional) Enables CGMP and the CGMP proxy function.

Command Description:

To enable Cisco Group Management Protocol (CGMP) on an interface of a router connected to a Catalyst 5000 switch, use the ip cgmp interface configuration command. To disable CGMP routing, use the no form of this command. By default CGMP is disabled.

Usage Guidelines:

When enabled on an interface, this command triggers a CGMP Join message. When a no ip cgmp command is issued, a triggered CGMP Leave message is sent for the routers MAC address on the interface for group 0000.0000.0000 (all groups). CGMP can run on an interface only if Protocol Independent Multicast (PIM) is configured on the same interface.

When the proxy keyword is specified, the CGMP proxy function is also enabled. That is, any router that is not CGMP-capable will be advertised by the proxy router. The proxy router advertises the existence of other non CGMP-capable routers by sending a CGMP Join message with the non-CGMP-capable router's MAC address and a group address of 0000.0000.0000. To perform CGMP proxy, a Cisco router must be the IGMP querier. If you configure ip cgmp proxy, you must manipulate the IP addresses so that a Cisco router will be the IGMP querier, which might be the highest or lowest IP address, depending on which version of IGMP is being run on the network.

When multiple Cisco routers are connected to a switched network and ip cgmp [proxy] is needed, it is recommended that all of them be configured:
  • With the same CGMP option
  • To have precedence of becoming IGMP querier over non-Cisco routers

Example:

The following example enables CGMP:

Router(config-if)#ip cgmp

The following example enables CGMP and CGMP proxy:

Router(config-if)#ip cgmp proxy

Misconceptions:
None

Related Commands:

None


Command:

ip redirects

Mode:

Router(config-if)#

Syntax:

ip redirects

no ip redirects

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the sending of Internet Control Message Protocol (ICMP) redirect messages if the Cisco IOS

software is forced to resend a packet through the same interface on which it was received, use the ip

redirects interface configuration command. To disable the sending of redirect messages, use the no form

of this command.

Previously, if the Hot Standby Router Protocol (HSRP) was configured on an interface, ICMP redirect

messages were disabled by default for the interface. With Cisco IOS Release 12.1(3)T, ICMP redirect

messages are enabled by default if HSRP is configured.

Example:

The following example enables the sending of ICMP redirect messages on Ethernet interface 0:

interface ethernet 0

ip redirects

Misconceptions:

None.

Related Commands:

ip default-gateway


 Command:

ppp chap hostname

Mode:

Router(config-if)#

Syntax:

ppp chap hostname hostname

no ppp chap hostname hostname

Syntax Description:

hostname Used to specify an alternate username/hostname that will be used for authentication

Command Description:

Use the ppp chap hostname interface configuration command to create a pool of dialup routers that all appear to be the same host when authenticating with CHAP. The hostname that is sent with chap is normally the host name of the router. This command allows the CHAP username that is sent to be independent of the routers host name. This will useful if you have a situation where any number of routers may be making a connection to a remote router and be authenticated with CHAP. They need to send the same username for several reasons. First you may wish to limit the number of concurrent connections to the remote site from any specific site. Second, DDR will need to know that the location is connected in order to use a current connection rather than attempting to bring up another connection.

Example:

The following example will cause the router to send the CHAP username BHM instead of the routers name of BHM6.

BHM6(config-if)#ppp chap hostname BHM

Misconceptions:

None

Related Commands:
encapsulation ppp
ppp chap password
ppp authentication


 Command:

ppp chap password

Mode:

Router(config-if)#

Syntax:

ppp chap password password

no ppp chap password password

Syntax Description:

password Actual password required for authentication of remote router

Command Description:

Use the ppp chap password interface configuration command to configure a common CHAP secret password to be used in response to challenges from an unknown remote peer. This command is useful when there is a collection of routers that do not support this command (such as routers running older Cisco IOS software images). To disable this function, use the no form of this command.

Example:

Router(config)#interface serial  1
Router(config-if)#ppp chap password 7 cisco

Misconceptions:

none

Related Commands:
encapsulation ppp
ppp chap hostname
ppp authentication


Command:

shutdown

Mode:

Router(config-if)#

Syntax:

shutdown

no shutdown

Syntax Description:

This command has no arguments or keywords

Command Description:

To disable an interface, use the shutdown configuration command. To restart a disabled interface, use the no form of this command. This should be done on all interfaces in use as they are shutdown by default.

Example:

The following example will disable an interface.

Router(config-if)#shutdown

Misconceptions:

None

Related commands:

interface


Command:

debug cdp ip

Mode:

Router#

Syntax:

debug cdp ip

no debug cdp ip

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable debug output for the IP routing information that is carried and processed by the Cisco Discovery Protocol (CDP), use the debug cdp ip privileged EXEC command. The no form of this command disables debugging output.

CDP is a media- and protocol-independent device-discovery protocol that runs on all Cisco routers.

You can use the debug cdp ip command to determine the IP network prefixes CDP is advertising and whether CDP is correctly receiving this information from neighboring routers.

Use the debug cdp ip command with the debug ip routing command to debug problems that occur when on-demand routing (ODR) routes are not installed in the routing table at a hub router. You can also use the debug cdp ip command with the debug cdp packets and debug cdp adjacency commands along with encapsulation-specific debug commands to debug problems that occur in the receipt of CDP IP information.

Example:

The following is sample output from the debug cdp ip command. This example shows the transmission of IP-specific information in a CDP update. In this case, three network prefixes are being sent, each with a different network mask.

Router# debug cdp ip

CDP-IP:
Writing prefix 172.1.69.232.112/28
CDP-IP:
Writing prefix 172.19.89.0/24
CDP-IP:
Writing prefix 11.0.0.0/8

In addition to these messages, you might see the following messages:

This message indicates that CDP is attempting to install the prefix 172.16.1.0/24 into the IP routing table:

CDP-IP: Updating prefix 172.16.1.0/24 in routing table

This message indicates a protocol error occurred during an attempt to decode an incoming CDP packet:

CDP-IP: IP TLV length (3) invalid

This message indicates the receipt of the IP prefix 172.16.1.0/24 from a CDP neighbor connected via Ethernet interface 0/0. The neighbor IP address is 10.0.01.

CDP-IP: Reading prefix 172.16.1.0/24 source 10.0.0.1 via Ethernet0/0

Misconceptions:

None.

Related Commands:

debug ip routing


Command:

debug cdp

Mode:

Router#

Syntax:

debug cdp {packets | adjacency | events}

no debug cdp {packets | adjacency | events}

Syntax Description:

packets | Enables packet-related debugging output.
adjacency | Enables adjacency-related debugging output.
events

Enables output related to error messages, such as detecting a bad checksum.

Command Description:

To enable debugging of the Cisco Discovery Protocol (CDP), use the debug cdp privileged EXEC

command. The no form of this command disables debugging output.

Use debug cdp commands to display information about CDP packet activity, activity between CDP

neighbors, and various CDP events.

Example:

The following is sample output from debug cdp packets, debug cdp adjacency, and debug cdp events

commands:

Router# debug cdp packets

CDP packet info debugging is on

Router# debug cdp adjacency

CDP neighbor info debugging is on

Router# debug cdp events

CDP events debugging is on

CDP-PA: Packet sent out on Ethernet0

CDP-PA: Packet received from gray.cisco.com on interface Ethernet0

CDP-AD: Deleted table entry for violet.cisco.com, interface Ethernet0

CDP-AD: Interface Ethernet2 coming up

CDP-EV: Encapsulation on interface Serial2 failed

Misconceptions:

None.

Related Commands:

None.


Command:

debug serial interface

Mode:

Router#

Syntax:

debug serial interface

no debug serial interface

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information on a serial connection failure, use the debug serial interface privileged EXEC

command. The no form of this command disables debugging output.

If the show interface serial EXEC command shows that the line and protocol are down, you can use the

debug serial interface command to isolate a timing problem as the cause of a connection failure. If the

keepalive values in the mineseq, yourseen, and myseen fields are not incrementing in each subsequent

line of output, there is a timing or line problem at one end of the connection.

Caution Although the debug serial interface command typically does not generate a substantial amount of

output, nevertheless use it cautiously during production hours. When SMDS is enabled, for example,

it can generate considerable output.

The output of the debug serial interface command can vary, depending on the type of WAN configured

for an interface: Frame Relay, HDLC, HSSI, SMDS, or X.25. The output also can vary depending on the

type of encapsulation configured for that interface. The hardware platform also can affect debug serial

interface output.

Example:

The following sections show and describe sample debug serial interface output for various

configurations.

Debug Serial Interface for Frame Relay Encapsulation

The following message is displayed if the encapsulation for the interface is Frame Relay (or HDLC) and

the router attempts to send a packet containing an unknown packet type:

Illegal serial link type code xxx

Debug Serial Interface for HDLC

The following is sample output from the debug serial interface command for an HDLC connection

when keepalives are enabled. This output shows that the remote router is not receiving all the keepalives

the router is sending. When the difference in the values in the myseq and mineseen fields exceeds three,

the line goes down and the interface is reset.

Table 160 describes the significant fields.

router# debug serial interface

Serial1: HDLC myseq 636119, mineseen 636119, yourseen 515032, line up

Serial1: HDLC myseq 636120, mineseen 636120, yourseen 515033, line up

Serial1: HDLC myseq 636121, mineseen 636121, yourseen 515034, line up

Serial1: HDLC myseq 636122, mineseen 636122, yourseen 515035, line up

Serial1: HDLC myseq 636123, mineseen 636123, yourseen 515036, line up

Serial1: HDLC myseq 636124, mineseen 636124, yourseen 515037, line up

Serial1: HDLC myseq 636125, mineseen 636125, yourseen 515038, line up

Serial1: HDLC myseq 636126, mineseen 636126, yourseen 515039, line up

Serial1: HDLC myseq 636127, mineseen 636127, yourseen 515040, line up

Serial1: HDLC myseq 636128, mineseen 636127, yourseen 515041, line up

Serial1: HDLC myseq 636129, mineseen 636129, yourseen 515042, line up

Serial1: HDLC myseq 636130, mineseen 636130, yourseen 515043, line up

Serial1: HDLC myseq 636131, mineseen 636130, yourseen 515044, line up

Serial1: HDLC myseq 636132, mineseen 636130, yourseen 515045, line up

Serial1: HDLC myseq 636133, mineseen 636130, yourseen 515046, line down

Serial1: HDLC myseq 636127, mineseen 636127, yourseen 515040, line up

Serial1: HDLC myseq 636128, mineseen 636127, yourseen 515041, line up

Serial1: HDLC myseq 636129, mineseen 636129, yourseen 515042, line up

Misconceptions:

None.

Related Commands:

None.


 Command:

show controllers bri

Mode:

Router#

Syntax:
show controllers bri slot/port

show controllers bri number

Syntax Description:

number

Interface number. The value is 0 through 7 if the router has one 8-port BRI network interface module (NIM), or 0 through 15 if the router has two 8-port BRI NIMs. Interface number values will vary depending on the hardware platform used. The Cisco 3600 series router for example, can have up to 48 interfaces.

slot/port

Backplane slot number and port number on the interface. See your hardware installation manual for the specific slot and port numbers.

Command Description:

To display information about the ISDN Basic Rate Interface (BRI), use the show controllers bri privileged EXEC command.

Examples:

The following is a sample of output from the show controllers bri command:

Router#show controllers bri 0

BRI unit 0
D Chan Info:
Layer 1 is ACTIVATED
idb 0x32089C, ds 0x3267D8, reset_mask 0x2
buffer size 1524
RX ring with 2 entries at 0x2101600 : Rxhead 0
00 pak=0x4122E8 ds=0x412444 status=D000 pak_size=0
01 pak=0x410C20 ds=0x410D7C status=F000 pak_size=0
TX ring with 1 entries at 0x2101640: tx_count = 0, tx_head = 0, tx_tail = 0
00 pak=0x000000 ds=0x000000 status=7C00 pak_size=0
0 missed datagrams, 0 overruns, 0 bad frame addresses
0 bad datagram encapsulations, 0 memory errors
0 transmitter underruns
B1 Chan Info:
Layer 1 is ACTIVATED
idb 0x3224E8, ds 0x3268C8, reset_mask 0x0
buffer size 1524
RX ring with 8 entries at 0x2101400 : Rxhead 0
00 pak=0x421FC0 ds=0x42211C status=D000 pak_size=0
01 pak=0x4085E8 ds=0x408744 status=D000 pak_size=0
02 pak=0x422EF0 ds=0x42304C status=D000 pak_size=0
03 pak=0x4148E0 ds=0x414A3C status=D000 pak_size=0
04 pak=0x424D50 ds=0x424EAC status=D000 pak_size=0
05 pak=0x423688 ds=0x4237E4 status=D000 pak_size=0
06 pak=0x41AB98 ds=0x41ACF4 status=D000 pak_size=0
07 pak=0x41A400 ds=0x41A55C status=F000 pak_size=0
TX ring with 4 entries at 0x2101440: tx_count = 0, tx_head = 0, tx_tail = 0
00 pak=0x000000 ds=0x000000 status=5C00 pak_size=0
01 pak=0x000000 ds=0x000000 status=5C00 pak_size=0
02 pak=0x000000 ds=0x000000 status=5C00 pak_size=0
03 pak=0x000000 ds=0x000000 status=7C00 pak_size=0
0 missed datagrams, 0 overruns, 0 bad frame addresses
0 bad datagram encapsulations, 0 memory errors
0 transmitter underruns
B2 Chan Info:
Layer 1 is ACTIVATED
idb 0x324520, ds 0x3269B8, reset_mask 0x2
buffer size 1524
RX ring with 8 entries at 0x2101500 : Rxhead 0
00 pak=0x40FCF0 ds=0x40FE4C status=D000 pak_size=0
01 pak=0x40E628 ds=0x40E784 status=D000 pak_size=0
02 pak=0x40F558 ds=0x40F6B4 status=D000 pak_size=0
03 pak=0x413218 ds=0x413374 status=D000 pak_size=0
04 pak=0x40EDC0 ds=0x40EF1C status=D000 pak_size=0
05 pak=0x4113B8 ds=0x411514 status=D000 pak_size=0
06 pak=0x416ED8 ds=0x417034 status=D000 pak_size=0
07 pak=0x416740 ds=0x41689C status=F000 pak_size=0
TX ring with 4 entries at 0x2101540: tx_count = 0, tx_head = 0, tx_tail = 0
00 pak=0x000000 ds=0x000000 status=5C00 pak_size=0
01 pak=0x000000 ds=0x000000 status=5C00 pak_size=0
02 pak=0x000000 ds=0x000000 status=5C00 pak_size=0
03 pak=0x000000 ds=0x000000 status=7C00 pak_size=0
0 missed datagrams, 0 overruns, 0 bad frame addresses
0 bad datagram encapsulations, 0 memory errors
0 transmitter underruns

The following table describes the significant fields in the display.

Table: Show Controllers BRI Field Descriptions
Field Description

BRI unit 0

Interface type and unit number

Chan Info

D and B channel numbers

Layer 1 is ACTIVATED

Status can be DEACTIVATED, PENDING ACTIVATION, or ACTIVATED

idb
ds
reset_mask

Information about internal data structures and parameters

buffer size

Number of bytes allocated for buffers

RX ring with - entries at -

Information about the Receiver Queue

Rxhead

Start of the Receiver Queue

pak
ds
status
pak_size

Information about internal data structures and parameters

TX ring with - entries at -

Information about the Transmitter Queue

tx_count

Number of packets to transmit

tx_head

Start of the transmit list

tx_tail

End of the transmit list

missed datagrams

Incoming packets missed due to internal errors

overruns

Number of times the receiver hardware was unable to hand received data to a hardware buffer because the input rate exceeded the receiver's ability to handle the data.

bad frame addresses

Frames received with a cyclic redundancy check (CRC) error and noninteger number of octets

bad datagram encapsulations

Packets received with bad encapsulation

memory errors

Internal direct memory access (DMA) memory errors

transmitter underruns

Number of times that the transmitter has been running faster than the router can handle

The following is a partial sample output from the show controllers bri command on a Cisco 7200 series router:

BRI slot 2 interface 0 with integrated NT1
Layer 1 is ACTIVATED. (ISDN L1 State F7)
Master clock for slot 2 is bri interface 0.
Total chip configuration successes: 193, failures: 0, timeouts: 0
D Channel Information:
  Channel state: UP  Channel IDB: 6092AC64
  RX ring entries: 5, buffer size 512
  RX descriptor ring: head = 165F4D8, tail = 165F508
  RX buffer ring: head = 6093A260, tail = 6093A290
  00 params=0x2000000 status=0x0 data ptr=0x1650F84 next ptr=0x165F4D8
  01 params=0x2000000 status=0xC0080000 data ptr=0x1651884 next ptr=0x165F4E8
  02 params=0x2000000 status=0xC0080000 data ptr=0x1651644 next ptr=0x165F4F8
  03 params=0x2000000 status=0x0 data ptr=0x1651404 next ptr=0x165F508
  04 params=0x42000000 status=0x0 data ptr=0x16511C4 next ptr=0x165F4C8
  TX ring entries: 5, in use: 0, buffer size 512
  TX descriptor ring: head = 3C2049C0, tail = 3C2049C0
  TX buffer ring: head = 608EC0C4, tail = 608EC0C4
  00 params=0x80000000 data ptr=0x0000000 next ptr=0x4D0049A8
  01 params=0x80000000 data ptr=0x0000000 next ptr=0x4D0049B4
  02 params=0x80000000 data ptr=0x0000000 next ptr=0x4D0049C0
  03 params=0xC0000000 data ptr=0x0000000 next ptr=0x4D0049CC
  04 params=0x0 data ptr=0x0000000 next ptr=0x4D00499C
  List of timeslots (sw): 2

The following table describes the significant fields in the display.

Table: Show Controllers BRI Field Descriptions
Field Description

BRI slot 2 interface 0 with integrated NTI

Interface type and slot and port number

Layer 1 is ACTIVATED

Status can be DEACTIVATED, PENDING ACTIVATION, or ACTIVATED

Master clock

The first interface that comes up on an MBRI port adapter holds the master clock. This clock is used for all interfaces on that port adapter. If the master clock interface goes down, the second interface that came up becomes the master clock interface.

Total chip configuration successes

Counters of successful chip configuration

failures

Counters of bad chip configuration

timeouts

Counters of failing to initialize chip

D Channel Information

Information related to D-channel status

Channel state

Channel state can be UNUSED, IDLE, DOWN, STANDBY, UP, THROTTLED, ILLEGAL

Channel IDB

Internal interface channel description

RX (or TX) ring entries

Internal receive queue

RX (or TX) descriptor ring

Internal receive queue to manage hardware chip

RX (or TX) buffer ring

Internal receive queue to hold inbound packets

Rxhead

Start of the receiver queue

params, status, data ptr, next ptr

Information about internal data structures and params

List of timeslots (sw)

Timeslots assigned to this channel

Misconceptions:
None

Related Commands:
show controllers serial
show controllers ethernet


Command:

show controllers cbus

Mode:

Router#

Syntax:

show controllers cbus

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display all information under the cBus controller card, use the show controllers cbus command in privileged EXEC mode on the Cisco 7500 series routers. This command also shows the capabilities of the card and reports controller-related failures.

Example:

The following is partial sample output from the show controller cbus command:

Router# show controllers cbus

Switch Processor 3, hardware version 11.1, microcode version 215.1

Microcode loaded from system

512 Kbytes of main memory, 128 Kbytes cache memory

16 256 byte buffers, 4 1024 byte buffers, 130 1520 byte buffers, 63 4484 byte buffers

Restarts: 0 line down, 0 hung output, 0 controller error

FSIP 0, hardware version 1.1, microcode version 10.13

Microcode loaded from system

Controller Sync: 56 timeouts, 56 resyncs 0 failures, 1 max phase count

Interface 0 - Serial 0/0, electrical interface is V.35 DTE

31 buffer RX queue threshold, 10 buffer TX queue limit, buffer size 1520

TX queue length is 1

ift 0001, rql 14, tq 0000 04E0, tql 3

Transmitter delay is 0 microseconds

Interface Processors (IPs) must respond to cBus commands within the prescribed time. Sometimes the IPs may not respond within this time due to heavy traffic or some problem in the IP's hardware or firmware. Then the IP's response to cBus commands may be out of sync. When this situation occurs, the Route Processor (RP) must resync the IP. Currently CIP, FSIP, FEIP, RVIP, and SVIP support the resync mechanism.

Table 17 describes significant fields shown in the display.

Table 17 show controllers cbus Field Descriptions

Field

Description

timeouts

Number of times the IP did not respond to a cBus command within the allotted time.

resyncs

If the IP supports the resync mechanism, then this count is the same as the timeouts value.

failures

Number of resynchronization failures.

max phase count

High count of phase synchronization; that is, the maximum attempts tried before the sync was successful. Maximum number of resync attempts is 16 before the failures counter is incremented.

Note The timeouts, resyncs, and max phase count values do not imply any problem in the IP. The failures value implies a problem and usually end in a console error message.

The following is a partial output display from the show controllers cbus command on a Cisco 7500 series router with one VIP2 interface processor. This example does not show output from additional interface processors that are usually installed in a Cisco 7500 series router.

Router# show controller cbus

MEMD at 40000000, 2097152 bytes (unused 2752, recarves 1, lost 0)

RawQ 48000100, ReturnQ 48000108, EventQ 48000110

BufhdrQ 48000138 (2849 items), LovltrQ 48000150 (42 items, 1632 bytes)

IpcbufQ 48000158 (32 items, 4096 bytes)

3570 buffer headers (48002000 - 4800FF10)

pool0: 15 buffers, 256 bytes, queue 48000140

pool1: 368 buffers, 1536 bytes, queue 48000148

pool2: 260 buffers, 4544 bytes, queue 48000160

pool3: 4 buffers, 4576 bytes, queue 48000168

slot1: VIP2, hw 2.2, sw 200.50, ccb 5800FF30, cmdq 48000088, vps 8192

software loaded from system

FLASH ROM version 255.255

Fast Ethernet1/0/0, addr 0000.0c41.6c20 (bia 0000.0c41.6c20)

gfreeq 48000148, lfreeq 480001D0 (1536 bytes), throttled 0

rxlo 4, rxhi 30, rxcurr 0, maxrxcurr 0

txq 48001A00, txacc 48001A02 (value 0), txlimit 20

Ethernet1/1/0, addr 0000.0c41.6c28 (bia 0000.0c41.6c28)

gfreeq 48000148, lfreeq 480001D8 (1536 bytes), throttled 0

rxlo 4, rxhi 30, rxcurr 0, maxrxcurr 0

txq 48001A08, txacc 48001A0A (value 0), txlimit 20

Ethernet1/1/1, addr 0000.0c41.6c29 (bia 0000.0c41.6c29)

gfreeq 48000148, lfreeq 480001E0 (1536 bytes), throttled 0

rxlo 4, rxhi 30, rxcurr 0, maxrxcurr 0

txq 48001A10, txacc 48001A12 (value 0), txlimit 20

Ethernet1/1/2, addr 0000.0c41.6c2a (bia 0000.0c41.6c2a)

gfreeq 48000148, lfreeq 480001E8 (1536 bytes), throttled 0

rxlo 4, rxhi 30, rxcurr 0, maxrxcurr 0

txq 48001A18, txacc 48001A1A (value 0), txlimit 20

Ethernet1/1/3, addr 0000.0c41.6c2b (bia 0000.0c41.6c2b)

gfreeq 48000148, lfreeq 480001F0 (1536 bytes), throttled 0

rxlo 4, rxhi 30, rxcurr 0, maxrxcurr 0

txq 48001A20, txacc 48001A22 (value 0), txlimit 20

Ethernet1/1/4, addr 0000.0c41.6c2c (bia 0000.0c41.6c2c)

gfreeq 48000148, lfreeq 480001F8 (1536 bytes), throttled 0

rxlo 4, rxhi 30, rxcurr 0, maxrxcurr 0

txq 48001A28, txacc 48001A2A (value 0), txlimit 20

Ethernet1/1/5, addr 0000.0c41.6c2d (bia 0000.0c41.6c2d)

gfreeq 48000148, lfreeq 48000200 (1536 bytes), throttled 0

rxlo 4, rxhi 30, rxcurr 0, maxrxcurr 0

txq 48001A30, txacc 48001A32 (value 0), txlimit 20

Ethernet1/1/6, addr 0000.0c41.6c2e (bia 0000.0c41.6c2e)

gfreeq 48000148, lfreeq 48000208 (1536 bytes), throttled 0

rxlo 4, rxhi 30, rxcurr 0, maxrxcurr 0

txq 48001A38, txacc 48001A3A (value 0), txlimit 20

Ethernet1/1/7, addr 0000.0c41.6c2f (bia 0000.0c41.6c2f)

gfreeq 48000148, lfreeq 48000210 (1536 bytes), throttled 0

rxlo 4, rxhi 30, rxcurr 0, maxrxcurr 0

txq 48001A40, txacc 48001A42 (value 0), txlimit 20

The following is a partial ouput display of the show controllers cbus command for a Packet-over-SONET Interface Processor (POSIP) in slot 0; its single Packet OC-3 interface is Posi0/0:

Router# show controllers cbus

slot0: POSIP, hw 2.1, sw 200.01, ccb 5800FF30, cmdq 48000080, vps 8192

software loaded from flash slot0:rsp_posip.new

FLASH ROM version 160.4, VPLD version 2.2

Posi0/0, applique is SONET

gfreeq 48000148, lfreeq 48000158 (4480 bytes), throttled 0

rxlo 4, rxhi 226, rxcurr 0, maxrxcurr 186

txq 48000160, txacc 48000082 (value 150), txlimit 150

The following is partial output display from the show controllers cbus command for a Multichannel Interface Processor (MIP). Not all of the 23 channels defined on serial interface 1/0 are shown.

slot1: MIP, hw 1.1, sw 205.03, ccb 5800FF40, cmdq 48000088, vps 8192

software loaded from system

T1 1/0, applique is Channelized T1

gfreeq 48000130, lfreeq 480001B0 (1536 bytes), throttled 0

rxlo 4, rxhi 360, rxcurr 0, maxrxcurr 3

Serial1/0:0, txq 480001B8, txacc 48000082 (value 3), txlimit 3

Serial1/0:1, txq 480001B8, txacc 4800008A (value 3), txlimit 3

Serial1/0:2, txq 480001B8, txacc 48000092 (value 3), txlimit 3

Serial1/0:3, txq 480001B8, txacc 4800009A (value 3), txlimit 3

Serial1/0:4, txq 480001B8, txacc 480000A2 (value 3), txlimit 3

Serial1/0:5, txq 480001B8, txacc 480000AA (value 3), txlimit 3

Serial1/0:6, txq 480001B8, txacc 480000B2 (value 3), txlimit 3

Serial1/0:7, txq 480001B8, txacc 480000BA (value 3), txlimit 3

Table 18 describes significant fields in the per-slot part of these displays.

Table 18 show controllers cbus Command—Per-Slot Field Descriptions

Field

Description

slot1:

Slot location of the specific interface processor (in this case Packet-over-SONET Interface Processor).

hw

Version number of the card.

sw

Version number of the card's internal software (in ROM).

software loaded from

Source device and file name from which the router software was loaded.

FLASH ROM version VPLD version

Version of Flash ROM.

Pos1/0, applique is SONET

Location of the specific interface and the hardware applique type (in this case a Packet OC-3 interface).

gfreeq

Location of the global free queue that is shared among similar interfaces.

lfreeq

Location of the local free queue, which is a private queue of MEMD buffers.

throttled

Number of times input packet processing has been throttled on this interface.

rxlo

Minimum number of MEMD buffers held on local free queue. When idle, the interface returns buffers from its local queue to the global free queue until only this number of buffers remain in the local queue.

rxhi

Maximum number of MEMD buffers that the interface can remove from the global free queue in order to populate its local queue.

rxcurr

Number of MEMD buffers currently on the local free queue.

maxrxcurr

Maximum number of MEMD buffers that were enqueued on the local free queue.

txq

Address of the transmit queue.

txacc

Address of the transmit queue accumulator.

txlimit

Maximum number of buffers allowed in the transmit queue.

The following is a sample output display from the show controllers cbus command on a Cisco 7500 series router:

Router# show controllers cbus

cBus 1, controller type 3.0, microcode version 2.0

128 Kbytes of main memory, 32 Kbytes cache memory

40 1520 byte buffers, 14 4484 byte buffers

Restarts: 0 line down, 0 hung output, 0 controller error

HSCI 1, controller type 10.0, microcode version 129.3

Interface 6 - Hssi0, electrical interface is Hssi DTE

5 buffer RX queue threshold, 7 buffer TX queue limit, buffer size 1520

ift 0004, rql 2, tq 0000 0000, tql 7

Transmitter delay is 0 microseconds

MEC 3, controller type 5.1, microcode version 130.6

Interface 18 - Ethernet2, station address 0000.0c02.a03c (bia 0000.0c02.a03c)

10 buffer RX queue threshold, 7 buffer TX queue limit, buffer size 1520

ift 0000, rql 10, tq 0000 0000, tql 7

Transmitter delay is 0 microseconds

Interface 19 - Ethernet3, station address 0000.0c02.a03d (bia 0000.0c02.a03d)

10 buffer RX queue threshold, 7 buffer TX queue limit, buffer size 1520

ift 0000, rql 10, tq 0000 0000, tql 7

Transmitter delay is 0 microseconds

Table 19 describes the fields shown in the following lines of output from the display.

cBus 1, controller type 3.0, microcode version 2.0

128 Kbytes of main memory, 32 Kbytes cache memory

40 1520 byte buffers, 14 4484 byte buffers

Restarts: 0 line down, 0 hung output, 0 controller error

Table 19 show controllers cbus Field Descriptions—Part 1

Field

Description

cBus 1

Card type and number (varies depending on card).

controller type 3.0

Version number of the card.

microcode version 2.0

Version number of the card's internal software (in ROM).

128 Kbytes of main memory

Amount of main memory on the card.

32 Kbytes cache memory

Amount of cache memory on the card.

40 1520 byte buffers

Number of buffers of this size on the card.

14 4484 byte buffers

Number of buffers of this size on the card.

Restarts

  • 0 line down

  • 0 hung output

  • 0 controller error

Count of restarts for the following conditions:

  • Communication line down

  • Output unable to transmit

  • Internal error

Table 20 describes the fields shown in the following lines of output from the display:

HSCI 1, controller type 10.0, microcode version 129.3

Interface 6 - Hssi0, electrical interface is Hssi DTE

5 buffer RX queue threshold, 7 buffer TX queue limit, buffer size 1520

ift 0004, rql 2, tq 0000 0000, tql 7

Transmitter delay is 0 microseconds

Table 20 show controllers cbus Field Descriptions—Part 2

Field

Description

HSCI 1

Card type and number (varies depending on card).

controller type 10.0

Version number of the card.

microcode version 129.3

Version number of the card's internal software (in ROM).

Interface 6

Physical interface number.

Hssi 0

Logical name for this interface.

electrical interface is Hssi DTE

Self-explanatory.

5 buffer RX queue threshold

Maximum number of buffers allowed in the receive queue.

7 buffer TX queue limit

Maximum number of buffers allowed in the transmit queue.

buffer size 1520

Size of the buffers on this card (in bytes).

ift 0004

Interface type code:

  • 0 = EIP

  • 1 = FSIP

  • 4 = HIP

  • 5 = TRIP

  • 6 = FIP

  • 7 = AIP

rql 2

Receive queue limit. Current number of buffers allowed for the receive queue. It is used to limit the number of buffers used by a particular inbound interface. When equal to 0, all of that interface's receive buffers are in use.

tq 0000 0000

Transmit queue head and tail pointers.

tql 7

Transmit queue limit. Current number of buffers allowed for transmit queue. It limits the maximum cBus buffers allowed to sit on a particular interface's transmit queue.

Transmitter delay is 0 microseconds

Transmitter delay between the packets.

The following is a sample output display from the show controllers cbus command for an AIP installed in IP slot 4. The running AIP microcode is Version 170.30, the PLIM type is 4B/5B, and the available bandwidth is 100 Mbps:

Router# show controllers cbus

Switch Processor 5, hardware version 11.1, microcode version 170.46

Microcode loaded from system

512 Kbytes of main memory, 128 Kbytes cache memory

60 1520 byte buffers, 91 4496 byte buffers

Restarts: 0 line down, 0 hung output, 0 controller error

AIP 4, hardware version 1.0, microcode version 170.30

Microcode loaded from system

Interface 32 - ATM4/0, PLIM is 4B5B(100Mbps)

15 buffer RX queue threshold, 36 buffer TX queue limit, buffer size 4496

ift 0007, rql 12, tq 0000 0620, tql 36

Transmitter delay is 0 microseconds

The following is a sample output display from the show controllers cbus command for SMIP:

Router# show controllers cbus

SMIP 2, hardware version 1.0, microcode version 10.0
 Microcode loaded from system
 Interface 16 - T1 2/0, electrical interface is Channelized T1
   10 buffer RX queue threshold, 14 buffer TX queue limit, buffer size 1580 ift 0001, rql    7, tq 0000 05B0, tql 14
   Transmitter delay is 0 microseconds

Misconceptions:

None.

Related Commands:

None.


 Command:

show controllers ethernet

Mode:

Router#

Syntax:

show controllers ethernet number (2500 series)

show controllers ethernet slot/port

Syntax Description:
slot/port Interface slot and port number of the Ethernet interface.

number

Interface port number of the Ethernet interface.

Command Description:

Use the show controllers ethernet EXEC command to display information on the Cisco 2500, Cisco 2600, Cisco 3000, or Cisco 4000 series.

Example:

The following is sample output from the show controllers ethernet command on Cisco 4000 series routers:

Router#show controllers ethernet 0

LANCE unit 0, NIM slot 1, NIM type code 4, NIM version 1
Media Type is 10BaseT, Link State is Up, Squelch is Normal
idb 0x4060, ds 0x5C80, regaddr = 0x8100000
IB at 0x600D7AC: mode=0x0000, mcfilter 0000/0001/0000/0040
station address 0000.0c03.a14f  default station address 0000.0c03.a14f
buffer size 1524
RX ring with 32 entries at 0xD7E8
Rxhead = 0x600D8A0 (12582935), Rxp = 0x5CF0(23)
00 pak=0x60336D0 ds=0x6033822 status=0x80 max_size=1524 pak_size=98
01 pak=0x60327C0 ds=0x6032912 status=0x80 max_size=1524 pak_size=98
02 pak=0x6036B88 ds=0x6036CDA status=0x80 max_size=1524 pak_size=98
03 pak=0x6041138 ds=0x604128A status=0x80 max_size=1524 pak_size=98
04 pak=0x603FAA0 ds=0x603FBF2 status=0x80 max_size=1524 pak_size=98
05 pak=0x600DC50 ds=0x600DDA2 status=0x80 max_size=1524 pak_size=98
06 pak=0x6023E48 ds=0x6023F9A status=0x80 max_size=1524 pak_size=1506
07 pak=0x600E3D8 ds=0x600E52A status=0x80 max_size=1524 pak_size=1506
08 pak=0x6020990 ds=0x6020AE2 status=0x80 max_size=1524 pak_size=386
09 pak=0x602D4E8 ds=0x602D63A status=0x80 max_size=1524 pak_size=98
10 pak=0x603A7C8 ds=0x603A91A status=0x80 max_size=1524 pak_size=98
11 pak=0x601D4D8 ds=0x601D62A status=0x80 max_size=1524 pak_size=98
12 pak=0x603BE60 ds=0x603BFB2 status=0x80 max_size=1524 pak_size=98
13 pak=0x60318B0 ds=0x6031A02 status=0x80 max_size=1524 pak_size=98
14 pak=0x601CD50 ds=0x601CEA2 status=0x80 max_size=1524 pak_size=98
15 pak=0x602C5D8 ds=0x602C72A status=0x80 max_size=1524 pak_size=98
16 pak=0x60245D0 ds=0x6024722 status=0x80 max_size=1524 pak_size=98
17 pak=0x6008328 ds=0x600847A status=0x80 max_size=1524 pak_size=98
18 pak=0x601EB70 ds=0x601ECC2 status=0x80 max_size=1524 pak_size=98
19 pak=0x602DC70 ds=0x602DDC2 status=0x80 max_size=1524 pak_size=98
20 pak=0x60163E0 ds=0x6016532 status=0x80 max_size=1524 pak_size=98
21 pak=0x602CD60 ds=0x602CEB2 status=0x80 max_size=1524 pak_size=98
22 pak=0x6037A98 ds=0x6037BEA status=0x80 max_size=1524 pak_size=98
23 pak=0x602BE50 ds=0x602BFA2 status=0x80 max_size=1524 pak_size=98
24 pak=0x6018988 ds=0x6018ADA status=0x80 max_size=1524 pak_size=98
25 pak=0x6033E58 ds=0x6033FAA status=0x80 max_size=1524 pak_size=98
26 pak=0x601BE40 ds=0x601BF92 status=0x80 max_size=1524 pak_size=98
27 pak=0x6026B78 ds=0x6026CCA status=0x80 max_size=1524 pak_size=98
28 pak=0x6024D58 ds=0x6024EAA status=0x80 max_size=1524 pak_size=74
29 pak=0x602AF40 ds=0x602B092 status=0x80 max_size=1524 pak_size=98
30 pak=0x601FA80 ds=0x601FBD2 status=0x80 max_size=1524 pak_size=98
31 pak=0x6038220 ds=0x6038372 status=0x80 max_size=1524 pak_size=98
TX ring with 8 entries at 0xDA20, tx_count = 0
tx_head = 0x600DA58 (12582919), head_txp = 0x5DC4 (7)
tx_tail = 0x600DA58 (12582919), tail_txp = 0x5DC4 (7)
00 pak=0x000000 ds=0x600CF12 status=0x03 status2=0x0000 pak_size=118
01 pak=0x000000 ds=0x602126A status=0x03 status2=0x0000 pak_size=60
02 pak=0x000000 ds=0x600CF12 status=0x03 status2=0x0000 pak_size=118
03 pak=0x000000 ds=0x600CF12 status=0x03 status2=0x0000 pak_size=118
04 pak=0x000000 ds=0x600CF12 status=0x03 status2=0x0000 pak_size=118
05 pak=0x000000 ds=0x600CF12 status=0x03 status2=0x0000 pak_size=118
06 pak=0x000000 ds=0x600CF12 status=0x03 status2=0x0000 pak_size=118
07 pak=0x000000 ds=0x6003ED2 status=0x03 status2=0x0000 pak_size=126
0 missed datagrams, 0 overruns, 2 late collisions, 2 lost carrier events
0 transmitter underruns, 0 excessive collisions,  0 tdr, 0 babbles
0 memory errors, 0 spurious initialization done interrupts
0 no enp status, 0 buffer errors, 0 overflow errors
10 one_col, 10 more_col, 22 deferred, 0 tx_buff
0 throttled, 0 enabled
Lance csr0 = 0x73

Misconceptions:

None

Related Commands:

show controllers bri
show controllers serial


 Command:

show controllers serial

Mode:

Router#

Syntax:

show controllers serial [number]     (2500 series)

show controllers serial [slot/port]

show controllers serial [slot/port-adapter/port]     (Cisco  7500 series and Cisco 7000 series routers with the RSP7000 and RSP7000CI)

Syntax Description:

number (Optional) Interface number of the serial interface

slot

(Optional) Slot number of the interface.

port

(Optional) Port number on the interface. The port value is always 0.

port-adapter

(Optional) On Cisco 7500 series routers and Cisco 7000 series routers with the RSP7000 and RSP7000CI, the location of the port adapter on a VIP. The value can be 0 or 1.

Command Description:

Use the show controllers serial privileged EXEC command to display information that is specific to the interface hardware.

The information displayed is generally useful for diagnostic tasks performed by technical support personnel only. For the PA-E3 or PA-T3, the show controllers serial command also displays configuration information such as the framing, clock source, bandwidth limit, whether scrambling is enabled, the national bit, the international bits, and DSU mode configured on the interface. Also displayed is the performance statistics for the current interval and last 15-minute interval and whether any alarms exist.

Examples:

Sample output of the show controllers serial command on the Cisco 4000 follows:

Router#show controllers serial
MK5 unit 0, NIM slot 1, NIM type code 7, NIM version 1
idb = 0x6150, driver structure at 0x34A878, regaddr = 0x8100300
IB at 0x6045500: mode=0x0108, local_addr=0, remote_addr=0
N1=1524, N2=1, scaler=100, T1=1000, T3=2000, TP=1
buffer size 1524
DTE V.35 serial cable attached
RX ring with 32 entries at 0x45560 : RLEN=5, Rxhead 0
00 pak=0x6044D78  ds=0x6044ED4 status=80 max_size=1524 pak_size=0
01 pak=0x60445F0  ds=0x604474C status=80 max_size=1524 pak_size=0
02 pak=0x6043E68  ds=0x6043FC4 status=80 max_size=1524 pak_size=0
03 pak=0x60436E0  ds=0x604383C status=80 max_size=1524 pak_size=0
04 pak=0x6042F58  ds=0x60430B4 status=80 max_size=1524 pak_size=0
05 pak=0x60427D0  ds=0x604292C status=80 max_size=1524 pak_size=0
06 pak=0x6042048  ds=0x60421A4 status=80 max_size=1524 pak_size=0
07 pak=0x60418C0  ds=0x6041A1C status=80 max_size=1524 pak_size=0
08 pak=0x6041138  ds=0x6041294 status=80 max_size=1524 pak_size=0
09 pak=0x60409B0  ds=0x6040B0C status=80 max_size=1524 pak_size=0
10 pak=0x6040228  ds=0x6040384 status=80 max_size=1524 pak_size=0
11 pak=0x603FAA0  ds=0x603FBFC status=80 max_size=1524 pak_size=0
12 pak=0x603F318  ds=0x603F474 status=80 max_size=1524 pak_size=0
13 pak=0x603EB90  ds=0x603ECEC status=80 max_size=1524 pak_size=0
14 pak=0x603E408  ds=0x603E564 status=80 max_size=1524 pak_size=0
15 pak=0x603DC80  ds=0x603DDDC status=80 max_size=1524 pak_size=0
16 pak=0x603D4F8  ds=0x603D654 status=80 max_size=1524 pak_size=0
17 pak=0x603CD70  ds=0x603CECC status=80 max_size=1524 pak_size=0
18 pak=0x603C5E8  ds=0x603C744 status=80 max_size=1524 pak_size=0
19 pak=0x603BE60  ds=0x603BFBC status=80 max_size=1524 pak_size=0
20 pak=0x603B6D8  ds=0x603B834 status=80 max_size=1524 pak_size=0
21 pak=0x603AF50  ds=0x603B0AC status=80 max_size=1524 pak_size=0
22 pak=0x603A7C8  ds=0x603A924 status=80 max_size=1524 pak_size=0
23 pak=0x603A040  ds=0x603A19C status=80 max_size=1524 pak_size=0
24 pak=0x60398B8  ds=0x6039A14 status=80 max_size=1524 pak_size=0
25 pak=0x6039130  ds=0x603928C status=80 max_size=1524 pak_size=0
26 pak=0x60389A8  ds=0x6038B04 status=80 max_size=1524 pak_size=0
27 pak=0x6038220  ds=0x603837C status=80 max_size=1524 pak_size=0
28 pak=0x6037A98  ds=0x6037BF4 status=80 max_size=1524 pak_size=0
29 pak=0x6037310  ds=0x603746C status=80 max_size=1524 pak_size=0
30 pak=0x6036B88  ds=0x6036CE4 status=80 max_size=1524 pak_size=0
31 pak=0x6036400  ds=0x603655C status=80 max_size=1524 pak_size=0
TX ring with 8 entries at 0x45790 : TLEN=3, TWD=7
tx_count = 0, tx_head = 7, tx_tail = 7
00 pak=0x000000 ds=0x600D70C status=0x38 max_size=1524 pak_size=22
01 pak=0x000000 ds=0x600D70E status=0x38 max_size=1524 pak_size=2
02 pak=0x000000 ds=0x600D70E status=0x38 max_size=1524 pak_size=2
03 pak=0x000000 ds=0x600D70E status=0x38 max_size=1524 pak_size=2
04 pak=0x000000 ds=0x600D70E status=0x38 max_size=1524 pak_size=2
05 pak=0x000000 ds=0x600D70E status=0x38 max_size=1524 pak_size=2
06 pak=0x000000 ds=0x600D70E status=0x38 max_size=1524 pak_size=2
07 pak=0x000000 ds=0x6000000 status=0x38 max_size=1524 pak_size=0
XID/Test TX desc at 0xFFFFFF, status=0x30, max_buffer_size=0, packet_size=0
XID/Test RX desc at 0xFFFFFF, status=0x0, max_buffer_size=0, packet_size=0
Status Buffer at 0x60459C8: rcv=0, tcv=0, local_state=0, remote_state=0
phase=0, tac=0, currd=0x00000, curxd=0x00000
bad_frames=0, frmrs=0, T1_timeouts=0, rej_rxs=0, runts=0
0 missed datagrams, 0 overruns, 0 bad frame addresses
0 bad datagram encapsulations, 0 user primitive errors
0 provider primitives lost, 0 unexpected provider primitives
0 spurious primitive interrupts, 0 memory errors, 0 tr
%LINEPROTO-5-UPDOWN: Linansmitter underruns
mk5025 registers: csr0 = 0x0E00, csr1 = 0x0302, csr2 = 0x0704
                  csr3 = 0x5500, csr4 = 0x0214, csr5 = 0x0008

The following is a sample of output from the show controllers serial command for a PA-E3 serial port installed in slot 2:

router#show controllers serial 2/0
M1T-E3 pa: show controller:
PAS unit 0, subunit 0, f/w version 2-55, rev ID 0x2800001, version 2
idb = 0x6080D54C, ds = 0x6080F304, ssb=0x6080F4F4
Clock mux=0x30, ucmd_ctrl=0x0, port_status=0x1
Serial config=0x8, line config=0x1B0202
maxdgram=4474, bufpool=128Kb, 256 particles
   rxLOS inactive, rxLOF inactive, rxAIS inactive
   txAIS inactive, rxRAI inactive, txRAI inactive
line state: up
E3 DTE cable, received clockrate 50071882
base0 registers=0x3D000000, base1 registers=0x3D002000
mxt_ds=0x608BA654, rx ring entries=128, tx ring entries=256
rxring=0x4B01F480, rxr shadow=0x6081081C, rx_head=26
txring=0x4B01F960, txr shadow=0x60810E48, tx_head=192, tx_tail=192, tx_count=0
throttled=0, enabled=0, disabled=0
rx_no_eop_err=0, rx_no_stp_err=0, rx_no_eop_stp_err=0
rx_no_buf=0, rx_soft_overrun_err=0, dump_err= 1
tx_underrun_err=0, tx_soft_underrun_err=0, tx_limited=0
tx_fullring=0, tx_started=11504
   Framing is g751, Clock Source is Line, Bandwidth limit is 34010.
   Scrambling is enabled
   National Bit is 0, Internaltional Bits are: 0 0
   DSU mode 1
   Data in current interval (213 seconds elapsed):
     0 Line Code Violations, 0 P-bit Coding Violation
     0 C-bit Coding Violation
     0 P-bit Err Secs, 0 P-bit Severely Err Secs
     0 Severely Err Framing Secs, 0 Unavailable Secs
     0 Line Errored Secs, 0 C-bit Errored Secs, 0 C-bit Severely Errored Secs
   Total Data (last 24 hours)
     0 Line Code Violations, 0 P-bit Coding Violation,
     0 C-bit Coding Violation,
     0 P-bit Err Secs, 0 P-bit Severely Err Secs,
     0 Severely Err Framing Secs, 0 Unavailable Secs,
     0 Line Errored Secs, 0 C-bit Errored Secs, 0 C-bit Severely Errored Secs
   No alarms detected.
PIO A: 639, PIO B: 303, Gapper register: 50DE
Framer register information:
reg 0: E0       reg 1: 0        reg 2: 0        reg 3: 0
reg 4: 0        reg 5: 8        reg 6: 0        reg 7: 0

The following is a sample of output from the show controllers serial command that shows serial port 1/0/0 on a 1-port PA-T3 serial port adapter installed on a VIP2 in chassis slot 1:

router#show controllers serial 2/0/1
Serial1/0/0 -
   Mx T3(1) HW Revision 0x3, FW Revision 2.55
   Framing is c-bit, Clock Source is Line
   Bandwidth limit is 35000, DSU mode 1, Cable length is 50
   Data in current interval (325 seconds elapsed):
     0 Line Code Violations, 0 P-bit Coding Violation
     0 C-bit Coding Violation
     0 P-bit Err Secs, 0 P-bit Sev Err Secs
     0 Sev Err Framing Secs, 0 Unavailable Secs
     0 Line Errored Secs, 0 C-bit Errored Secs, 0 C-bit Sev Err Secs
   Total Data (last 24 hours)
     0 Line Code Violations, 0 P-bit Coding Violation,
     0 C-bit Coding Violation,
     0 P-bit Err Secs, 0 P-bit Sev Err Secs,
     0 Sev Err Framing Secs, 0 Unavailable Secs,
     0 Line Errored Secs, 0 C-bit Errored Secs, 0 C-bit Sev Err Secs
No alarms detected.

Misconceptions:
None

Related Commands:
show controllers bri
show controllers ethernet


Command:

show controllers t1

Mode:

Router#

Syntax:

Cisco 7500 Series

show controllers t1 [slot/port]

Cisco 4000 Series

show controllers t1 number

Cisco AS5800 Access Servers

show controller t1 dial-shelf/slot/t3-port:t1-num

Syntax Description:

slot/port | (Optional) Backplane slot number and port number on the interface. Refer to your hardware installation manual for the specific slot and port numbers.
number | Network processor number (NPM) number, in the range 0 through 2.
dial-shelf | Dial shelf chassis in the Cisco AS5800 access server containing the CT3 interface card.
slot | Location of the CT3 interface card in the dial shelf chassis.
t3-port | T3 port number. The only valid value is 0.
:t1-num | T1 time slot in the T3 line. The value can be from 1 to 28.

Command Description:

To display information about the T1 links or to display the hardware and software driver information for the T1 controller, use the show controllers t1 command in privileged EXEC mode.

Cisco 7500 Series and Cisco 4000 Series Routers

This command displays controller status that is specific to the controller hardware. The information displayed is generally useful for diagnostic tasks performed by technical support personnel only.

The NPM or MIP can query the port adapters to determine their current status. Issue a show controllers t1 command to display statistics about the T1 link.

If you specify a slot and port number, each 15 minute period will be displayed.

Example:

Cisco 7500 Series and Cisco 4000 Series Routers

The following is a sample output display from the show controllers t1 command on the Cisco 7500 series routers:

Router# show controllers t1
T1 4/1 is up.
No alarms detected.
  Framing is ESF, Line Code is AMI, Clock Source is line
Data in current interval (0 seconds elapsed):
0 Line Code Violations, 0 Path Code Violations 0 Slip Secs, 0 Fr Loss Secs,
0 Line Err Secs, 0 Degraded Mins 0 Errored Secs, 0 Bursty Err Secs,
0 Severely Err Secs, 0 Unavail Secs
Total Data (last 79 15 minute intervals):
0 Line Code Violations, 0 Path Code Violations, 0 Slip Secs, 0 Fr Loss Secs,
0 Line Err Secs, 0 Degraded Mins, 0 Errored Secs, 0 Bursty Err Secs,
0 Severely Err Secs, 0 Unavail Secs

Cisco AS5800 Access Server

The following example shows the status of the T1 controllers connected to the Cisco AS5800 access servers:

Router# show controllers t1
T1 1/0/0:1 is up.
No alarms detected.
Framing is ESF, Line Code is AMI, Clock Source is Line.
Data in current interval (770 seconds elapsed):
5 Line Code Violations, 8 Path Code Violations
0 Slip Secs, 0 Fr Loss Secs, 7 Line Err Secs, 0 Degraded Mins
0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 7 Unavail Secs
Total Data (last 81 15 minute intervals):
7 Line Code Violations, 4 Path Code Violations,
6 Slip Secs, 20 Fr Loss Secs, 2 Line Err Secs, 0 Degraded Mins,
0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 2 Unavail Secs
T1 1/0/1:5 is down.
Transmitter is sending remote alarm.
Receiver has loss of frame.
Framing is SF, Line Code is AMI, Clock Source is Line.
Data in current interval (770 seconds elapsed):
50 Line Code Violations, 5 Path Code Violations
0 Slip Secs, 7 Fr Loss Secs, 7 Line Err Secs, 0 Degraded Mins
0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 7 Unavail Secs
Total Data (last 81 15 minute intervals):
27 Line Code Violations, 22 Path Code Violations,
0 Slip Secs, 13 Fr Loss Secs, 13 Line Err Secs, 0 Degraded Mins,
0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 13 Unavail Secs

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


 Command:

show hosts

Mode:

Router#

Syntax:

show hosts

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the default domain name, the style of name lookup service, a list of name server hosts, and the cached list of host names and addresses, use the show hosts EXEC command.

Example:

Router#show hosts
Default domain is not set
Name/address lookup uses domain service
Name servers are 255.255.255.255

Host                     Flags      Age Type   Address(es)
abc                      (perm, OK)  0   IP    12.12.12.12
Router#

Misconceptions:
None

Related commands:
ip host


 Command:

show running-config

Mode:

Router#

Syntax:

show running-config

Syntax Description:

This command has no arguments or keywords.

Command Description:

This command allows you to view the current configuration in the RAM. This configuration is the active configuration, and changes made to the router will show up in this configuration file. Since it is stored in the RAM, any changes not saved will be gone when the router resets.

Example:

Router#show running-config
Current configuration:
!
version 12.1
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Router
!
boot system flash
!
!
!
!
!
ip subnet-zero
no ip domain-lookup
!
!
!
!
interface FastEthernet0
 --More--

Misconceptions:

IOS 12.0 and newer versions replaces show running-config with the command show running-config.

Related commands:

show startup-config


 Command:

show startup-config

Mode:

Router#

Syntax:

show startup-config

Syntax Description:

This command has no arguments or keywords

Command Description:

This command allows you to view the configuration file "startup-config" in the NVRAM. This configuration file is the stored, default file that is used by the router when it boots. Any changes made to the active configuration on the router that is not saved to this file using "copy running-config startup-config" will be lost upon next reload.

Example:

Router#show startup-config
Using 475 out of 7506 bytes

!
version 12.1
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Router
!
!
!
!
!
!
ip subnet-zero
!
!
!
!
interface FastEthernet0
 no ip address
 ip broadcast-address 0.0.0.0
 shutdown
 --More--

Misconceptions:
IOS 12.0 and newer versions replaces show startup-config with the command more nvram:startup-config.

Related commands:
show running-config
copy


 Command:

show interfaces

Mode:

Router>
Router#

Syntax:

show interfaces {type number}

Syntax Description:
type | Type of interface to be configured
number | This represents a port, connector, or interface card number.

Command Description:

Use the show interfaces EXEC command to display statistics for all interfaces configured on the router or access server. The resulting output varies, depending on the network for which an interface has been configured. You should use the summary option to limit the amount of information presented.

Example:
Router#show interfaces fastethernet 0/1
Ethernet0 is administratively down, line protocol is down
  Hardware is Lance, address is 00e0.b05a.6396 (bia 00e0.b05a.6396)
  MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 252/255, load 1/255
  Encapsulation ARPA, loopback not set, keepalive set (10 sec)
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:29:44, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 input packets with dribble condition detected
     1 packets output, 60 bytes, 0 underruns
     1 output errors, 0 collisions, 6 interface resets
     0 babbles, 0 late collision, 0 deferred
     1 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

Misconceptions:
None

Related commands:
None


 Command:

ip inspect name

Mode:

Router(config)#

Syntax:

ip inspect name inspection-name protocol [alert {on | off}] [audit-trail {on | off}] [timeout seconds]

no ip inspect name [inspection-name protocol]

Syntax Description:
inspection-name | Name of inspection defined protocol
protocol | A protocol keyword listed in the Table A.
alert | For each inspected protocol, the generation of alert messages can be set on or off.
audit-trail | For each inspected protocol, audit trail can be set on or off.
timeout | To override the global TCP or User Datagram Protocol idle timeouts for the specified protocol, specify the number of seconds for a different idle timeout.

Table A: Protocol Keywords

Protocol protocol Keyword

Transport-Layer Protocols

TCP

tcp

UDP

udp

Application-Layer Protocols

CU-SeeMe

cuseeme

FTP

ftp

Java

http

H.323

h323

Microsoft NetShow

netshow

UNIX R commands (rlogin, rexec, rsh)

rcmd

RealAudio

realaudio

RPC

rpc

SMTP

smtp

SQL*Net

sqlnet

StreamWorks

streamworks

TFTP

tftp

VDOLive

vdolive

Command Description:

To define a set of inspection rules, use the ip inspect name command in global configuration mode.

Example:

The following examples directs the router to inspect ftp traffic:

Router(config)#ip inspect name  mycbac1  ftp

Misconceptions:
None

Related Commands:
None


show ip inspect

Command:

show ip inspect

Mode:

Router>

Syntax:

show ip inspect {name inspection-name | config | interfaces | session [detail] | all }

Syntax Description:

name | Shows the configured inspection rule with the name inspection-name
config | Shows the complete CBAC inspection configuration
interfaces | Shows interface configuration with respect to applied inspection rules and access lists
session | Shows existing sessions that are currently being tracked and inspected by CBAC. The optional detail keyword causes additional details about these sessions to be shown.
all | Shows all CBAC configuration and all existing sessions that are currently being tracked and inspected by CBAC.

Command Description:

This command shows configuration information and statistics about context based access control processes.

Example:

Router#show ip inspect all

Session audit trail is disabled

one-minute (sampling period) thresholds are [400:500] connections

max-incomplete sessions thresholds are [400:500]

max-incomplete tcp connections per host is 50. Block-time 0 minute.

tcp synwait-time is 30 sec -- tcp finwait-time is 5 sec

tcp idle-time is 3600 sec -- udp idle-time is 30 sec

dns-timeout is 5 sec

Inspection Rule Configuration

Inspection name all

tcp timeout 3600

udp timeout 30

ftp timeout 3600

Interface Configuration

Interface Ethernet0

Inbound inspection rule is all

tcp timeout 3600

udp timeout 30

ftp timeout 3600

Outgoing inspection rule is not set

Inbound access list is not set

Outgoing access list is not set

Established Sessions

Session 25A6E1C (30.0.0.1:46065)=>(40.0.0.1:21) ftp SIS_OPEN

Session 25A34A0 (40.0.0.1:20)=>(30.0.0.1:46072) ftp-data SIS_OPEN

Misconceptions:

None

Related commands:

None


Command:

accept-lifetime

Mode:

Router(config-keychain)#

Syntax:

accept-lifetime start-time {infinite | end-time | duration seconds}

no accept-lifetime [start-time {infinite | end-time | duration seconds}]

Syntax Description:

start-time

Beginning time that the key specified by the key command is valid to be received. The syntax can be either of the following:

hh:mm:ss Month date year

hh:mm:ss date Month year

hh—hours

mm—minutes

ss—seconds

Month—first three letters of the month

date—date (1-31)

year—year (four digits)

The default start time and the earliest acceptable date is January 1, 1993.

infinite

Key is valid to be received from the start-time value on.

end-time

Key is valid to be received from the start-time value until the end-time value. The syntax is the same as that for the start-time value. The end-time value must be after the start-time value. The default end time is an infinite time period.

duration seconds

Length of time (in seconds) that the key is valid to be received.

Command Description:

To set the time period during which the authentication key on a key chain is received as valid, use the accept-lifetime key chain key configuration command. To revert to the default value, use the no form of this command.

Only DRP Agent, Enhanced IGRP (EIGRP), and Routing Information Protocol (RIP) Version 2 use key chains.

Specify a start-time value and one of the following values: infinite, end-time, or duration seconds.

We recommend running Network Time Protocol (NTP) or some other time synchronization method if you assign a lifetime to a key.

If the last key expires, authentication will continue and an error message will be generated. To disable authentication, you must manually delete the last valid key.

Example:

The following example configures a key chain called trees. The key named chestnut will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named birch will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or discrepancies in the set time of the router. There is a 30-minute leeway on each side to handle time differences:

Router(config-keychain)#accept-lifetime 13:30:00 Jan 25 1996 duration 7200

Misconceptions:

None

Related Commands:

key
key chain
key-string (authentication)
send-lifetime
show key chain


Command:

authentication (IKE policy)

Mode:

router(config-isakmp)#

Syntax:

authentication {rsa-sig | rsa-encr | pre-share}

no authentication

Syntax Description:

rsa-sig | Specifies RSA signatures as the authentication method.
rsa-encr | Specifies RSA encrypted nonces as the authentication method.
pre-share | Specifies preshared keys as the authentication method.

Command Description:

To specify the authentication method within an Internet Key Exchange policy, use the authentication ISAKMP policy configuration command. IKE policies define a set of parameters to be used during IKE negotiation. To reset the authentication method to the default value, use the no form of this command.

Use this command to specify the authentication method to be used in an IKE policy.

If you specify RSA signatures, you must configure your peer routers to obtain certificates from a certification authority (CA).

If you specify RSA encrypted nonces, you must ensure that each peer has the other peer's RSA public keys.

If you specify preshared keys, you must also separately configure these preshared keys.

Example:

The following example configures an IKE policy with preshared keys as the authentication method (all other parameters are set to the defaults):

crypto isakmp policy 15
authentication pre-share
exit

Misconceptions:

None.

Related Commands:

crypto isakmp policy

show crypto isakmp policy

hash (IKE policy)

crypto key generate rsa (IKE)

crypto isakmp key


clear crypto sa

Command:

clear crypto sa

Mode:

Router>
Router#

Syntax:

clear crypto sa

clear crypto sa peer {ip-address | peer-name}

clear crypto sa map map-name

clear crypto sa entry destination-address protocol spi

clear crypto sa counters

Syntax Description:

peer | Deletes any IPSec security associations for the specified peer.
ip-address | Specifies a remote peer's IP address.
peer-name | Specifies a remote peer's name as the fully qualified domain name, for example remotepeer.example.com.
map | Deletes any IPSec security associations for the named crypto map set.
map-name | Specifies the name of a crypto map set.
entry | Deletes the IPSec security association with the specified address, protocol, and SPI.
destination-address | Specifies the IP address of your peer or the remote peer.
protocol | Specifies either the Encapsulation Security Protocol or Authentication Header.
spi | Specifies an SPI (found by displaying the security association database).
counters | Clears the traffic counters maintained for each security association; counters does not clear the security associations themselves.

Command Description:

To delete IP Security security associations, use the clear crypto sa EXEC command.

Example:

The following example clears (and reinitializes if appropriate) all IPSec security associations at the router:

Router#clear crypto sa

The following example clears (and reinitializes if appropriate) the inbound and outbound IPSec security associations established along with the security association established for address 10.0.0.1 using the AH protocol with the SPI of 256:

Router#clear crypto sa entry 10.0.0.1 AH 256

Misconceptions:

None.

Related commands:

None.


crypto ca authenticate

Command:

crypto ca authenticate

Mode:

Router(config)#

Syntax:

crypto ca authenticate name

Syntax Description:

name Specifies the name of the CA. This is the same name used when the CA was declared with the crypto ca identity command.

Command Description:

To authenticate the certification authority (by getting the CA's certificate), use the crypto ca authenticate command in global configuration mode.

Example:

In the following example, the router requests the CA's certificate. The CA sends its certificate and the router prompts the administrator to verify the CA's certificate by checking the CA certificate's fingerprint. The CA administrator can also view the CA certificate's fingerprint, so you should compare what the CA administrator sees to what the router displays on the screen. If the fingerprint on the router's screen matches the fingerprint viewed by the CA administrator, you should accept the certificate as valid.

Router(config)#crypto ca authenticate myca
Certificate has the following attributes:
Fingerprint: 0123 4567 89AB CDEF 0123
Do you accept this certificate? [yes/no] y

Misconceptions:

None

Related commands:

crypto ca identity


crypto ca crl request

Command:

crypto ca crl request

Mode:

Router(config)#

Syntax:

crypto ca crl request name

Syntax Description:

name Specifies the name of the CA. This is the same name used when the CA was declared with the crypto ca identity command.

Command Description:

To request that a new certificate revocation list (CRL) be obtained immediately from the certification authority, use the crypto ca crl request command in global configuration mode.

Example:

The following example immediately downloads the latest CRL to your router:

Router(config)#crypto ca crl request myca

Misconceptions:

None.

Related commands:

crypto ca authenticate
crypto ca identity


crypto ca enroll

Command:

crypto ca enroll

Mode:

Router(config)#

Syntax:

crypto ca enroll name

no crypto ca enroll name

Syntax Description:

name Specifies the name of the CA. Use the same name as when you declared the CA using the crypto ca identity command.

Command Description:

To obtain your router's certificate(s) from the certification authority, use the crypto ca enroll command in global configuration mode. To delete a current enrollment request, use the no form of this command.

If your router reboots after you issued the crypto ca enroll command but before you received the certificate(s), you must reissue the command and notify the CA administrator.

Example:

In the following example, a router with a general-purpose RSA key pair requests a certificate from the CA. When the router displays the certificate fingerprint, the administrator verifies this number by calling the CA administrator, who checks the number. The fingerprint is correct, so the router administrator accepts the certificate.

There can be a delay between when the router administrator sends the request and when the certificate is actually received by the router. The amount of delay depends on the CA method of operation:

myrouter(config)#crypto ca enroll myca
%
% Start certificate enrollment ..
% Create a challenge password. You will need to verbally provide this
  password to the CA Administrator in order to revoke your certificate.
  For security reasons your password will not be saved in the configuration.
  Please make a note of it.
Password: <mypassword>
Re-enter password: <mypassword>
% The subject name in the certificate will be: myrouter.example.com
% Include the router serial number in the subject name? [yes/no]: yes
% The serial number in the certificate will be: 03433678
% Include an IP address in the subject name [yes/no]? yes
Interface: ethernet0/0
Request certificate from CA [yes/no]? yes
% Certificate request sent to Certificate Authority
% The certificate request fingerprint will be displayed.
% The 'show crypto ca certificate' command will also show the fingerprint.
myrouter(config)#

Some time later, the router receives the certificate from the CA and displays the following confirmation message:

myrouter(config)# Fingerprint: 01234567 89ABCDEF FEDCBA98 75543210
%CRYPTO-6-CERTRET: Certificate received from Certificate Authority
myrouter(config)#

If necessary, the router administrator can verify the displayed Fingerprint with the CA administrator.

If there is a problem with the certificate request and the certificate is not granted, the following message is displayed on the console instead:

%CRYPTO-6-CERTREJ: Certificate enrollment request was rejected by Certificate Authority

The subject name in the certificate is automatically assigned to be the same as the RSA key pair's name. In the above example, the RSA key pair was named "myrouter.example.com." (The router assigned this name.)

Requesting certificates for a router with special usage keys would be the same as the previous example, except that two certificates would have been returned by the CA. When the router received the two certificates, the router would have displayed the same confirmation message:

%CRYPTO-6-CERTRET: Certificate received from Certificate Authority

Misconceptions:

None.

Related commands:

crypto ca authenticate
crypto ca identity


crypto ca identity

Command:

crypto ca identity

Mode:

Router(config)#

Syntax:

crypto ca identity name
nocrypto ca identity name

Syntax Description:

name Creates a name for the CA. (If you previously declared the CA and just want to update its characteristics, specify the name you previously created.) The CA might require a particular name, such as its domain name.

Command Description:

To declare the certification authority that your router should use, use the crypto ca identity command in global configuration mode. To delete all identity information and certificates associated with the CA, use the no form of this command.

Example:

The following example declares a CA and identifies characteristics of the CA. In this example, the name "myca"; is created for the CA, which is located at http://ca_server

The CA does not use an RA or LDAP, and the CA's scripts are stored in the default location. This is the minimum possible configuration required to declare a CA.

Router(config)#crypto ca identity myca
enrollment url http://ca_server

The following example declares a CA when the CA uses an RA. The CA's scripts are stored in the default location, and the CA uses the SCEP instead of LDAP. This is the minimum possible configuration required to declare a CA that uses an RA.

Router(config)#crypto ca identity myca_with_ra
enrollment url http://ca_server
enrollment mode ra
query url ldap://serverx

The following example declares a CA that uses an RA and a nonstandard cgi-bin script location. This example also specifies a nonstandard retry period and retry count, and permits the router to accept certificates when CRLs are not obtainable.

Router(config)#crypto ca identity myca_with_ra
enrollment url http://example_ca/cgi-bin/somewhere/scripts.exe
enrollment mode ra
query url ldap://serverx
enrollment retry-period 20
enrollment retry-count 100
crl optional

In the previous example, if the router does not receive a certificate back from the CA within 20 minutes of sending a certificate request, the router will resend the certificate request. The router will keep sending a certificate request every 20 minutes until a certificate is received or until 100 requests have been sent.

If the CA cgi-bin script location is not /cgi-bin/pkiclient.exe at the CA (the default CA cgi-bin script location) you need to also include the nonstandard script location in the URL, in the form of http://CA_name/script_location where script_location is the full path to the CA scripts.

Misconceptions:

None.

Related commands:

crypto ca enroll


crypto ipsec security-association lifetime

Command:

crypto ipsec security-association lifetime

Mode:

Router(config)#

Syntax:

crypto ipsec security-association lifetime {seconds seconds | kilobytes kilobytes}

no crypto ipsec security-association lifetime {seconds | kilobytes}

Syntax Description:

seconds seconds | Specifies the number of seconds a security association will live before expiring. The default is 3600 seconds (one hour).
kilobytes kilobytes | Specifies the volume of traffic (in kilobytes) that can pass between IPSec peers using a given security association before that security association expires. The default is 4,608,000 kilobytes.

Command Description:

To change global lifetime values used when negotiating IPSec security associations, use the crypto ipsec security-association lifetime global configuration command. To reset a lifetime to the default value, use the no form of this command.

Example:

The following example shortens both lifetimes, because the administrator feels there is a higher risk that the keys could be compromised. The timed lifetime is shortened to 2,700 seconds (45 minutes), and the traffic-volume lifetime is shortened to 2,304,000 kilobytes (10 megabytes per second for one half hour):

Router(config)#crypto ipsec security-association lifetime seconds 2700
Router(config)#crypto ipsec security-association lifetime kilobytes 2304000

Misconceptions:

None.

Related commands:

None.


crypto ipsec transform-set

Command:

crypto ipsec transform-set

Mode:

Router(config)#

Syntax:

crypto ipsec transform-set transform-set-name transform1 [transform2 [transform3]]

no crypto ipsec transform-set transform-set-name

Syntax Description:

transform-set-name Specifies the name of the transform set to create (or modify).
transform1
transform2
transform3 		Specifies up to three "transforms." These transforms define the IPSec security protocols and algorithms. The parser will prevent you from entering invalid combinations.

Command Description:

To define a transform set--an acceptable combination of security protocols and algorithms--use the crypto ipsec transform-set global configuration command. To delete a transform set, use the no form of the command.

Example:

The following example defines two transform sets. The first transform set will be used with an IPSec peer that supports the newer ESP and AH protocols. The second transform set will be used with an IPSec peer that only supports the older transforms:

Router(config)#crypto ipsec transform-set newer esp-3des esp-sha-hmac
Router(config)#crypto ipsec transform-set older ah-rfc-1828 esp-rfc1829

Misconceptions:

None.

Related commands:

None.


Command:

crypto isakmp enable

Mode:

Router(config)#

Syntax:

crypto isakmp enable

no crypto isakmp enable

Syntax Description:

This command has no arguments or keywords.

Command Description:

To globally enable Internet Key Exchange at your peer router, use the crypto isakmp enable global configuration command. To disable IKE at the peer, use the no form of this command.

Example:

The following example disables IKE at one peer. (The same command should be issued at all remote peers.)
Router(config)#no crypto isakmp enable

Misconceptions:

None

Related commands:

None


%command%

Command:

crypto isakmp identity

Mode:

Router(config)#

Syntax:

crypto isakmp identity {address | hostname}

no crypto isakmp identity

Syntax Description:

address | Sets the ISAKMP identity to the IP address of the interface that is used to communicate to the remote peer during IKE negotiations. (By default, a peer's ISAKMP identity is the peer's IP address.)
hostname | Sets the ISAKMP identity to the host name concatenated with the domain name (for example, myhost.example.com).

Command Description:

To define the identity used by the router when participating in the Internet Key Exchange protocol, use the crypto isakmp identity global configuration command. Set an Internet Security Association Key Management Protocol identity whenever you specify preshared keys. To reset the ISAKMP identity to the default value (address), use the no form of this command.

Example:

The following example uses preshared keys at two peers and sets both their ISAKMP identities to IP address. At the local peer "LocalRouter" (at 10.0.0.1) the ISAKMP identity is set and the preshared key is specified.

LocalRouter(config)#crypto isakmp identity address
LocalRouter(config)#crypto isakmp key sharedkeystring address 192.168.1.33

At the remote peer "RemoteRouter" (at 192.168.1.33) the ISAKMP identity is set and the same preshared key is specified.

RemoteRouter(config)#crypto isakmp identity address
RemoteRouter(config)#crypto isakmp key sharedkey string address 10.0.0.1

At the local peer (at 10.0.0.1) the ISAKMP identity is set and the preshared key is specified.

crypto isakmp identity address

crypto isakmp key sharedkeystring address 192.168.1.33

At the remote peer (at 192.168.1.33) the ISAKMP identity is set and the same preshared key is specified.

crypto isakmp identity address

crypto isakmp key sharedkeystring address 10.0.0.1

Misconceptions:

None

Related commands:

crypto isakmp key

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

crypto isakmp key

Mode:

Router(config)#

Syntax:

crypto isakmp key keystring address peer-address [mask]

crypto isakmp key keystring hostname peer-hostname

no crypto isakmp key keystring address peer-address

no crypto isakmp key keystring hostname peer-hostname

Syntax Description:

address | Use this keyword if the remote peer Internet Security Association Key Management Protocol identity was set with its IP address.
hostname | Use this keyword if the remote peer ISAKMP identity was set with its hostname.
keystring | Specify the preshared key. Use any combination of alphanumeric characters up to 128 bytes. This preshared key must be identical at both peers.
peer-address | Specify the IP address of the remote peer.
peer-hostname | Specify the host name of the remote peer. This is the peer's host name concatenated with its domain name (for example, myhost.example.com).
mask | (Optional) Specify the subnet address of the remote peer. (The argument can be used only if the remote peer ISAKMP identity was set with its IP address.)

Command Description:

To configure a preshared authentication key, use the crypto isakmp key global configuration command. You must configure this key whenever you specify preshared keys in an Internet Key Exchange policy. To delete a preshared authentication key, use the no form of this command.

Example:

In the following example, the remote peer "RemoteRouter" specifies an ISAKMP identity by address:

crypto isakmp identity address

In the following example, the local peer "LocalRouter" also specifies an ISAKMP identity, but by host name:

crypto isakmp identity hostname

Now, the preshared key must be specified at each peer.

In the following example, the local peer specifies the preshared key and designates the remote peer by its IP address and a mask:

crypto isakmp key sharedkeystring address 172.21.230.33  255.255.255.255

In the following example, the remote peer specifies the same preshared key and designates the local peer by its host name:

crypto isakmp key sharedkeystring hostname LocalRouter.example.com

The remote peer also maps multiple IP addresses to the same host name for the local peer because the local peer has two interfaces which both might be used during an IKE negotiation with the local peer. These two interfaces' IP addresses (10.0.0.1 and 10.0.0.2) are both mapped to the remote peer's host name.

ip host LocalRouter.example.com 10.0.0.1 10.0.0.2

(This mapping would not have been necessary if LocalRouter.example.com was already mapped in DNS.)

In this example, a remote peer specifies its ISAKMP identity by address, and the local peer specifies its ISAKMP identity by host name. Depending on the circumstances in your network, both peers could specify their ISAKMP identity by address, or both by host name.

Misconceptions:

None

Related commands:

crypto isakmp identity

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

crypto isakmp policy

Mode:

Router(config)#

Syntax:

crypto isakmp policy priority

no crypto isakmp policy

Syntax Description:

priority

Uniquely identifies the IKE policy and assigns a priority to the policy. Use an integer from 1 to 10,000, with 1 being the highest priority and 10,000 the lowest.

Command Description:

To define an Internet Key Exchange policy, use the crypto isakmp policy global configuration command. IKE policies define a set of parameters to be used during the IKE negotiation. To delete an IKE policy, use the no form of this command.

Example:

The following example configures two policies for the peer:

crypto isakmp policy 15

 hash md5

 authentication rsa-sig

 group 2

 lifetime 5000

crypto isakmp policy 20

 authentication pre-share

 lifetime 10000

The above configuration results in the following policies:

Router# show crypto isakmp policy

Protection suite priority 15

encryption algorithm: DES - Data Encryption Standard (56 bit keys)

hash algorithm: Message Digest 5

authentication method: Rivest-Shamir-Adleman Signature

Diffie-Hellman Group: #2 (1024 bit)

lifetime: 5000 seconds, no volume limit

Protection suite priority 20

encryption algorithm: DES - Data Encryption Standard (56 bit keys)

hash algorithm: Secure Hash Standard

authentication method: preshared Key

Diffie-Hellman Group: #1 (768 bit)

lifetime: 10000 seconds, no volume limit

Default protection suite

encryption algorithm: DES - Data Encryption Standard (56 bit keys)

hash algorithm: Secure Hash Standard

authentication method: Rivest-Shamir-Adleman Signature

Diffie-Hellman Group: #1 (768 bit)

lifetime: 86400 seconds, no volume limit

Misconceptions:

None

Related commands:

show crypto isakmp policy

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

crypto key generate rsa (CA)

Mode:

Router(config)#

Syntax:

crypto key generate rsa [usage-keys]

Syntax Description:

usage-keys

(Optional) Specifies that two special-usage key pairs should be generated, instead of one general-purpose key pair.

Command Description:

To generate RSA key pairs, use the crypto key generate rsa command in global configuration mode.

Example:

The following example generates special-usage RSA keys:

crypto key generate rsa usage-keys

The name for the keys will be: myrouter.example.com

Choose the size of the key modulus in the range of 360 to 2048 for your Signature Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus[512]? <return>

Generating RSA keys.... [OK].

Choose the size of the key modulus in the range of 360 to 2048 for your Encryption Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus[512]? <return>

Generating RSA keys.... [OK].

The following example generates general-purpose RSA keys. (Note, you cannot generate both special usage and general-purpose keys; you can only generate one or the other.)

myrouter(config)# crypto key generate rsa

The name for the keys will be: myrouter.example.com

Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus[512]? <return>

Generating RSA keys.... [OK].

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

crypto key generate rsa (IKE)

Mode:

Router(config)#

Syntax:

crypto key generate rsa [usage-keys]

Syntax Description:

usage-keys

(Optional) Specifies that two RSA special usage key pairs should be generated (that is, one encryption pair and one signature pair), instead of one general-purpose key pair.

Command Description:

To generate RSA key pairs, use the crypto key generate rsa global configuration command.

Example:

The following example generates special-usage RSA keys:

Router(config)#crypto key generate rsa usage-keys

The name for the keys will be: myrouter.example.com

Choose the size of the key modulus in the range of 360 to 2048 for your Signature Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus[512]? <return>

Generating RSA keys.... [OK].

Choose the size of the key modulus in the range of 360 to 2048 for your Encryption Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus[512]? <return>

Generating RSA keys.... [OK].

Router(config)#

The following example generates general-purpose RSA keys:

Router(config)#crypto key generate rsa

The name for the keys will be: myrouter.example.com

Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus[512]? <return>

Generating RSA keys.... [OK].

Router(config)#

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

 crypto key pubkey-chain rsa

Mode:

Router(config)#

Syntax:

crypto key pubkey-chain rsa

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enter public key configuration mode (so you can manually specify other devices' RSA public keys), use the crypto key pubkey-chain rsa global configuration command.

Example:

The following example specifies the RSA public keys of two other IPSec peers. The remote peers use their IP address as their identity.

Router(config)# crypto key pubkey-chain rsa

Router(config-pubkey-chain)# addressed-key 10.5.5.1

Router(config-pubkey-key)# key-string

Router(config-pubkey)# 00302017 4A7D385B 1234EF29 335FC973

Router(config-pubkey)# 2DD50A37 C4F4B0FD 9DADE748 429618D5

Router(config-pubkey)# 18242BA3 2EDFBDD3 4296142A DDF7D3D8

Router(config-pubkey)# 08407685 2F2190A0 0B43F1BD 9A8A26DB

Router(config-pubkey)# 07953829 791FCDE9 A98420F0 6A82045B

Router(config-pubkey)# 90288A26 DBC64468 7789F76E EE21

Router(config-pubkey)# quit

Router(config-pubkey-key)# exit

Router(config-pubkey-chain)# addressed-key 10.1.1.2

Router(config-pubkey-key)# key-string

Router(config-pubkey)# 0738BC7A 2BC3E9F0 679B00FE 53987BCC

Router(config-pubkey)# 01030201 42DD06AF E228D24C 458AD228

Router(config-pubkey)# 58BB5DDD F4836401 2A2D7163 219F882E

Router(config-pubkey)# 64CE69D4 B583748A 241BED0F 6E7F2F16

Router(config-pubkey)# 0DE0986E DF02031F 4B0B0912 F68200C4

Router(config-pubkey)# C625C389 0BFF3321 A2598935 C1B1

Router(config-pubkey)# quit

Router(config-pubkey-key)# exit

Router(config-pubkey-chain)# exit

Router(config)#

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

 crypto key zeroize rsa

Mode:

Router(config)#

Syntax:

crypto key zeroize rsa

Syntax Description:

This command has no arguments or keywords.

Command Description:

To delete all RSA keys from your router, use the crypto key zeroize rsa command in global configuration mode.

Example:

The following example deletes the general purpose RSA key pair that was previously generated for the router. After deleting the RSA key pair, the administrator contacts the CA administrator and requests that the router's certificate be revoked. The administrator then deletes the router's certificate from the configuration. The following example deletes the general purpose RSA key pair that was previously generated for the router:

Router(config)#crypto key zeroize rsa

After deleting the RSA key pair, the administrator contacts the CA administrator and requests that the router's certificate be revoked. The administrator then deletes the router's certificate from the configuration: Router(config)#crypto ca certificate chain

Router(config)#crypto ca certificate chain
Router(config-cert-chain)#no certificate

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

crypto map

Mode:

Router(config)#

Syntax:

crypto map map-name seq-num ipsec-manual

crypto map map-name seq-num ipsec-isakmp [dynamic dynamic-map-name] [discover]

no crypto map map-name [seq-num]

Syntax Description:

map-name | The name that identifies the crypto map set. This is the name assigned when the crypto map was created.
seq-num | The number you assign to the crypto map entry. See additional explanation for using this argument in the "Usage Guidelines" section.
ipsec-manual | Indicates that Internet Key Exchange will not be used to establish the IP Security security associations for protecting the traffic specified by this crypto map entry.
ipsec-isakmp | Indicates that IKE will be used to establish the IPSec security associations for protecting the traffic specified by this crypto map entry.
dynamic | (Optional) Specifies that this crypto map entry is to reference a preexisting dynamic crypto map. Dynamic crypto maps are policy templates used in processing negotiation requests from a peer IPSec device. If you use this keyword, none of the crypto map configuration commands will be available.
dynamic-map-name | (Optional) Specifies the name of the dynamic crypto map set that should be used as the policy template.
discover | (Optional) Enables peer discovery. By default, peer discovery is not enabled.

Command Description:

To create or modify a crypto map entry and enter the crypto map configuration mode, use the crypto map global configuration command. To delete a crypto map entry or set, use the no form of this command.

Examples:

The following example shows the minimum required crypto map configuration when IKE will be used to establish the security associations. Specify the crypto map entry to create, for example "mymap10" using IKE to establish the IPSec security associations to protect traffic: Router(config)#crypto map mymap 10 ipsec-isakmp

Next, designate an access list to designate which traffic should be protected by IPSec and which traffic should not be protected by IPSec security in the context of this crypto map entry:

Router(config-crypto-m)#match address 101

Next, specify which transform set should be used:

Router(config-crypto-m)#set transform-set my_t_set1

Now, specify the remote IPSec peer:

Router(config-crypto-m)#set peer 10.0.0.1

The following example shows the minimum required crypto map configuration when IKE will be used to establish the security associations:

crypto map mymap 10 ipsec-isakmp
 match address 101
 set transform-set my_t_set1
 set peer 10.0.0.1

The following example shows the minimum required crypto map configuration when the security associations are manually established:

crypto transform-set someset ah-md5-hmac esp-des
crypto map mymap 10 ipsec-manual
 match address 102
 set transform-set someset
 set peer 10.0.0.5
 set session-key inbound ah 256 98765432109876549876543210987654
 set session-key outbound ah 256 fedcbafedcbafedcfedcbafedcbafedc
 set session-key inbound esp 256 cipher 0123456789012345
 set session-key outbound esp 256 cipher abcdefabcdefabcd

The following example configures an IPSec crypto map set that includes a reference to a dynamic crypto map set.

Crypto map "mymap 10" allows security associations to be established between the router and either (or both) of two remote IPSec peers for traffic matching access list 101. Crypto map "mymap 20" allows either of two transform sets to be negotiated with the remote peer for traffic matching access list 102.

Crypto map entry "mymap 30" references the dynamic crypto map set "mydynamicmap," which can be used to process inbound security association negotiation requests that do not match "mymap" entries 10 or 20. In this case, if the peer specifies a transform set that matches one of the transform sets specified in "mydynamicmap," for a flow "permitted" by the access list 103, IPSec will accept the request and set up security associations with the remote peer without previously knowing about the remote peer. If accepted, the resulting security associations (and temporary crypto map entry) are established according to the settings specified by the remote peer.

The access list associated with "mydynamicmap 10" is also used as a filter. Inbound packets that match a permit statement in this list are dropped for not being IPSec protected. (The same is true for access lists associated with static crypto maps entries.) Outbound packets that match a permit statement without an existing corresponding IPSec SA are also dropped.

crypto map mymap 10 ipsec-isakmp
 match address 101
 set transform-set my_t_set1
 set peer 10.0.0.1
 set peer 10.0.0.2
crypto map mymap 20 ipsec-isakmp
 match address 102
 set transform-set my_t_set1 my_t_set2
 set peer 10.0.0.3
crypto map mymap 30 ipsec-isakmp dynamic mydynamicmap
!
crypto dynamic-map mydynamicmap 10
 match address 103
 set transform-set my_t_set1 my_t_set2 my_t_set3

The following example configures Tunnel Endpoint Discovery on a Cisco router:

crypto map testtag 10 ipsec-isakmp dynamic dmap discover

Misconceptions:

None

Related commands:

show crypto map

© Cisco Systems, Inc. 2001, 2002


Command:

hash (IKE policy)

Mode:

router(config-isakmp)#

Syntax:

hash {sha | md5}

no hash

Syntax Description:

sha | Specifies SHA-1 (HMAC variant) as the hash algorithm.
md5 | Specifies MD5 (HMAC variant) as the hash algorithm.

Command Description:

To specify the hash algorithm within an Internet Key Exchange policy, use the hash ISAKMP policy configuration command. IKE policies define a set of parameters to be used during IKE negotiation. To reset the hash algorithm to the default SHA-1 hash algorithm, use the no form of this command.

Example:

The following example configures an IKE policy with the MD5 hash algorithm (all other parameters are set to the defaults):

crypto isakmp policy 15
hash md5
exit

Misconceptions:

None.

Related Commands

authentication (IKE policy)

crypto isakmp policy

encryption (IKE policy)

group (IKE policy)

lifetime (IKE policy)

show crypto isakmp policy

© Cisco Systems, Inc. 2001, 2002


Command:

debug crypto ipsec

Mode:

Router#

Syntax:

debug crypto ipsec

no debug crypto ipsec

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display IPSec events, use the debug crypto ipsec privileged EXEC command. The no form of this command disables debugging output.

Example:

The following is sample output from the debug crypto ipsec command. In this example, security associations (SAs) have been successfully established.

Router# debug crypto ipsec
00:24:30: IPSEC(sa_request): ,
(key eng. msg.) src= 172.21.114.123, dest= 172.21.114.67,
src_proxy= 172.21.114.123/255.255.255.255/0/0 (type=1),
dest_proxy= 172.21.114.67/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-des esp-md5-hmac ,
lifedur= 120s and 4608000kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4
00:24:30: IPSEC(sa_request): ,
(key eng. msg.) src= 172.21.114.123, dest= 172.21.114.67,
src_proxy= 172.21.114.123/255.255.255.255/0/0 (type=1),
dest_proxy= 172.21.114.67/255.255.255.255/0/0 (type=1).,
protocol= AH, transform= ah-sha-hmac ,
lifedur= 120s and 4608000kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0.
00:24:34: IPSEC(key_engine): got a queue event...
00:24:34: IPSEC(spi_response): getting spi 302974012ld for SA
from 172.21.114.67 to 172.21.114.123 for prot 3
00:24:34: IPSEC(spi_response): getting spi 525075940ld for SA
from 172.21.114.67 to 172.21.114.123 for prot 2

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

debug crypto isakmp

Mode:

Router#

Syntax:

debug crypto isakmp

no debug crypto isakmp

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display messages about IKE events, use the debug crypto isakmp privileged EXEC command. The no form of this command disables debugging output.

Example:

The following is sample output from the debug crypto isakmp command for an IKE peer that initiates an IKE negotiation.

Router# debug crypto isakmp
20:26:58: ISAKMP (8): beginning Main Mode exchange
20:26:58: ISAKMP (8): processing SA payload. message ID = 0
20:26:58: ISAKMP (8): Checking ISAKMP transform 1 against priority 10 policy
20:26:58: ISAKMP: encryption DES-CBC
20:26:58: ISAKMP: hash SHA
20:26:58: ISAKMP: default group 1
20:26:58: ISAKMP: auth pre-share
20:26:58: ISAKMP (8): atts are acceptable. Next payload is 0
20:26:58: ISAKMP (8): SA is doing pre-shared key authentication
20:26:59: ISAKMP (8): processing KE payload. message ID = 0
20:26:59: ISAKMP (8): processing NONCE payload. message ID = 0
20:26:59: ISAKMP (8): SKEYID state generated
20:26:59: ISAKMP (8): processing ID payload. message ID = 0
20:26:59: ISAKMP (8): processing HASH payload. message ID = 0
20:26:59: ISAKMP (8): SA has been authenticated

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show crypto ipsec security-association lifetime

Mode:

Router#
Router>

Syntax:

show crypto ipsec security-association lifetime

Syntax Description:

This command has no arguments or keywords.

Command Description:

To view the security-association lifetime value configured for a particular crypto map entry, use the show crypto ipsec security-association lifetime command in EXEC mode.

Example:

The following is sample output for the show crypto ipsec security-association lifetime command:

Router# show crypto ipsec security-association lifetime

Security-association lifetime: 4608000 kilobytes/120 seconds

The following configuration was in effect when the previous show crypto ipsec security-association lifetime command was issued:

crypto ipsec security-association lifetime seconds 120

Misconceptions:

None

Related commands:

crypto ipsec security-association lifetime

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show crypto ipsec transform-set

Mode:

Router#

Router>

Syntax:

show crypto ipsec transform-set [tag transform-set-name]

Syntax Description:

tag transform-set-name

(Optional) Only the transform sets with the specified transform-set-name are displayed.

Command Description:

To view the configured transform sets, use the show crypto ipsec transform-set command in EXEC mode.

Example:

The following is sample output for the show crypto ipsec transform-set command:

Router# show crypto ipsec transform-set

Transform set combined-des-sha: {esp-des esp-sha-hmac}

will negotiate = { Tunnel, },

Transform set combined-des-md5: {esp-des esp-md5-hmac}

will negotiate = { Tunnel, },

Transform set t1: {esp-des esp-md5-hmac}

will negotiate = {Tunnel,},

Transform set t100: {ah-sha-hmac}

will negotiate = {Transport,},

Transform set t2: {ah-sha-hmac}

will negotiate = {Tunnel,},

{ esp-des }

will negotiate = {Tunnel,},

The following configuration was in effect when the previous show crypto ipsec transform-set command was issued:

crypto ipsec transform-set combined-des-sha esp-des esp-sha-hmac

crypto ipsec transform-set combined-des-md5 esp-des esp-md5-hmac

crypto ipsec transform-set t1 esp-des esp-md5-hmac

crypto ipsec transform-set t100 ah-sha-hmac

 mode transport

crypto ipsec transform-set t2 ah-sha-hmac esp-des

The following sample output from the show crypto ipsec transform-set command displays a warning message after a user tries to configure an IPSec transform that the hardware does not support:

Router# show crypto ipsec transform-set

Transform set transform-1:{ esp-256-aes esp-md5-hmac }

will negotiate = { Tunnel, },

WARNING:encryption hardware does not support transform

esp-aes 256 within IPSec transform transform-1

Misconceptions:

None

Related commands:

crypto isakmp transform-set

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show crypto isakmp policy

Mode:

Router#
Router>

Syntax:

show crypto isakmp policy

Syntax Description:

This command has no arguments or keywords.

Command Description:

To view the parameters for each Internet Key Exchange (IKE) policy, use the show crypto isakmp policy command command in EXEC mode.

Example:

The following is sample output from the show crypto isakmp policy command, after two IKE policies have been configured (with priorities 15 and 20, respectively):

Router# show crypto isakmp policy

Protection suite priority 15

        encryption algorithm:    DES - Data Encryption Standard (56 bit keys)

        hash algorithm:  Message Digest 5

        authentication method:   Rivest-Shamir-Adleman Signature

        Diffie-Hellman Group:    #2 (1024 bit)

        lifetime:      5000 seconds, no volume limit

Protection suite priority 20

        encryption algorithm:    DES - Data Encryption Standard (56 bit keys)

        hash algorithm: Secure Hash Standard

        authentication method:   preshared Key

        Diffie-Hellman Group:    #1 (768 bit)

        lifetime:      10000 seconds, no volume limit

Default protection suite

        encryption algorithm:    DES - Data Encryption Standard (56 bit keys)

        hash algorithm: Secure Hash Standard

        authentication method:   Rivest-Shamir-Adleman Signature

        Diffie-Hellman Group:    #1 (768 bit)

        lifetime:      86400 seconds, no volume limit

The following sample output from the show crypto isakmp policy command displays a warning message after a user tries to configure an IKE encryption method that the hardware does not support:

Router# show crypto isakmp policy

Protection suite of priority 1

encryption algorithm: AES - Advanced Encryption Standard (256 bit keys).

WARNING:encryption hardware does not support the configured

encryption method for ISAKMP policy 1

hash algorithm: Secure Hash Standard

authentication method: Pre-Shared Key

Diffie-Hellman group: #1 (768 bit)

lifetime: 3600 seconds, no volume limit

Misconceptions:

None

Related commands:

crypto isakmp policy

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show crypto map

Mode:

Router#
Router>

Syntax:

show crypto map [interface interface | tag map-name]

Syntax Description:

interface interface | (Optional) Displays only the crypto map set applied to the specified interface.
tag map-name | (Optional) Displays only the crypto map set with the specified map-name.

Command Description:

To view the crypto map configuration, use the show crypto map command in EXEC mode.

Example:

The following is sample output for the show crypto map command:

Router# show crypto map

Crypto Map "crypmap" 1 ipsec-isakmp

Peer = 172.1.1.1

ISAKMP Profile: vpn1

Extended IP access list 101

access-list 101 permit ip 10.1.0.0 0.0.255.255 10.2.0.0 0.0.255.255

access-list 101 permit ip host 192.168.1.1 host 10.2.1.1

access-list 101 permit ip 10.3.0.0 0.0.255.255 10.2.0.0 0.0.255.255

Current peer: 172.16.1.1

Security association lifetime: 4608000 kilobytes/3600 seconds

PFS (Y/N): N

Transform sets={

vpn1,

The following configuration was in effect when the above show crypto map command was issued:

crypto map crypmap 1 ipsec-isakmp

set peer 172.16.1.1

set transform-set vpn1

set isakmp-profile vpn1

match address 101

Misconceptions:

None

Related commands:

crypto map

© Cisco Systems, Inc. 2001, 2002


 Command:

dialer callback-secure

Mode:

Router(config-if)#

Syntax:

dialer callback-secure

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable callback security, use the dialer callback-secure interface configuration command. This command ensures that the initial call is always disconnected at the receiving end and that the return call is made only if the username is configured for callback. If the username (hostname in the dialermap command) is not configured for callback, the initial call stays up and no return call is made.

Example:

Router(config-if)#dialer callback-secure

Misconceptions:

None

Related Commands:
None


 Command:

dialer fast-idle

Mode:

Router (config-if)#

Syntax:

dialer fast-idle number-of-seconds

no dialer fast-idle

Syntax Description:

number-of-seconds

Idle time, in seconds, that must occur on an interface before the line is disconnected. Acceptable values are positive, nonzero integers.

Command Description:

If there is contention for a line, the dialer fast-idle interface configuration command is used to specify the amount of time that the line will stay idle before it is disconnected. The dialer fast idle timer is activated if a line is busy, a packet for a different next hop address is received, and the busy line is required to send the competing packet. If the line becomes idle for the configured length of time, the current call is disconnected immediately and the new call is placed. Use the no dialer fast-idle command to reset the timeout period to the default.

Example:

The following example specifies a fast idle timeout of 35 seconds on interface async 1:

Router(config)#interface async 1
Router(config-if)#dialer fast-idle 35

Misconceptions:
None

Related Commands:
dialer in-band
dialer idle-timeout
dialer map


 Command:

dialer hold-queue

Mode:

Router(config-if)#

Syntax:

dialer hold-queue packets timeout seconds

no dialer hold-queue packets

Syntax Description:

packets

Number of packets, in the range 1 to 100 packets, to hold in the queue. This argument is optional with the no form of the command.

timeout seconds

Amount of time in seconds to queue the packets.

Command Description:

To allow interesting outgoing packets to be queued until a modem connection is established, use the dialer hold-queue interface configuration command. To disable the hold queue, use the no form of this command.

A dialer hold queue can be configured on any type of dialer, including in-band synchronous, asynchronous, data terminal ready (DTR), and Integrated Services Digital Network (ISDN) dialers. Rotary groups can also be configured with a dialer hold queue. If a rotary group is configured with a hold queue, all members of the group inherit that queue. No individual member's hold queue can be altered.

If no hold queue is configured, packets are dropped during the time required to establish a connection. Setting packets to 0 using the dialer hold-queue command is equivalent to using the no dialer hold-queue command.

Example:

The following command configures a dialer hold queue to hold 10 packets:

Router(config)#dialer hold-queue 10 timeout 60
Misconceptions:
None

Related Commands:
dialer-group


 Command:

dialer load-threshold

Mode:

Router(config-if)#

Syntax:

dialer load-threshold load [outbound | inbound | either]

no dialer load-threshold

Syntax Description:

load

Interface load used to determine whether to initiate another call or to drop a link to the destination. This argument represents a utilization percentage; it is a number between 1 and 255, where 255 is 100%.

outbound

(Optional) Calculates the actual load using outbound data only

inbound

(Optional) Calculates the actual load using inbound data only

either

(Optional) Sets the maximum calculated load as the larger of the outbound and inbound loads

Command Description:

To configure bandwidth on demand by setting the maximum load before the dialer places another call to a destination, use the dialer load-threshold interface command. To disable the setting, use the no form of this command.

This command first appeared in Cisco IOS Release 10.0. The list command and access-list-number and access-group arguments first appeared in Cisco IOS Release 10.3.

This command applies to dialer rotary groups only.

When the cumulative load of all UP links(a number n) exceeds the load threshold the dialer adds an extra link and when the cumulative load of all UP links minus one (n - 1) is at or below load threshold then the dialer can bring down that one link. The dialer will make additional calls or drop links as necessary but will never interrupt an existing call to another destination.

The argument load is the calculated weighted average load value for the interface; 1 is unloaded and 255 is fully loaded. The load is calculated by the system dynamically, based on bandwidth. You must set the bandwidth for an interface in kilobits per second, using the bandwidth command.

The load calculation determines how much of the total bandwidth you are using. A load value of 255 means that you are using one hundred percent of the bandwidth. The load number is required.

When multilink PPP is configured, the dialer-load threshold 1 command no longer keeps a multilink bundle of n links connected indefinitely and the dialer-load threshold 2 command no longer keeps a multilink bundle of 2 links connected indefinitely. If you want a multilink bundle to be connected indefinitely, you must set a very high idle timer.

Example:

In the following example, if the load to a particular destination on an interface in dialer rotary group 5 exceeds interface load 200, the dialer will initiate another call to the destination:

Router(config)#interface dialer 5
Router(config-if)#dialer load-threshold 200

Misconceptions:

None

Related Commands:
bandwidth
interface dialer
dialer rotary-group


Command:

dialer map

Mode:

Router(config-if)#

Syntax:

dialer map protocol next-hop-address [name hostname] [spc ] [speed 56 | speed 64 ] [broadcast ] [modem-script modem-regexp] [system-script system-regexp] [dial-string [: isdn-subaddress]]

no dialer map protocol next-hop-address [name hostname] [spc ] [speed 56 | speed 64 ] [broadcast ] [modem-script modem-regexp] [system-script system-regexp] [dial-string [: isdn-subaddress]]

Syntax Description:

protocol

Protocol keywords; one of the following: appletalk, bridge, clns, decnet, ip, ipx, novell, snapshot, vines, and xns

next-hop-address

Protocol address used to match against addresses to which packets are destined

name

(Optional) Indicates the remote system with which the local router or access server communicates. Used for authenticating the remote system on incoming calls.

hostname

(Optional) Case-sensitive name or ID of the remote device (usually the host name). For routers with ISDN interfaces, if calling line identification sometimes called CLI, but also known as caller ID and automatic number identification (ANI) is provided, the hostname field can contain the number that the calling line ID provides.

spc

(Optional) Specifies a semipermanent connection between customer equipment and the exchange; used only in Germany for circuits between an ISDN BRI and a 1TR6 ISDN switch and in Australia for circuits between an ISDN PRI and a TS-014 switch.

speed 56 | speed 64

(Optional) Keyword and value indicating the line speed in kilobits per second to use. Used for ISDN only. The default speed is speed 64 (64 kbps).

broadcast

(Optional) Indicates that broadcasts should be forwarded to this protocol address

modem-script

(Optional) Indicates the modem script to be used for the connection (for asynchronous interfaces)

modem-regexp

(Optional) Regular expression to which a modem script will be matched (for asynchronous interfaces)

system-script

(Optional) Indicates the system script to be used for the connection (for asynchronous interfaces

system-regexp

(Optional) Regular expression to which a system script will be matched (for asynchronous interfaces)

dial-string [:isdn-subaddress]

(Optional) Telephone number sent to the dialing device when it recognizes packets with the specified next hop address that matches the access lists defined, and the optional subaddress number used for ISDN multipoint connections. The dial string and ISDN subaddress, if used, must be the last item in the command line.

Command Description:

To configure an ISDN interface to place a call to multiple sites, or to authenticate calls from multiple sites, use the dialer map interface configuration command. Similar to the function provided by an ARP table, dialer map statements translate next-hop protocol addresses to telephone numbers. Use the no form of this command to reset the ISDN interface dialer map configuration.

Example:

In the following example, packets received for a host 10.0.0.1 (HQ-central) is statically mapped to telephone number 555-1212:

Router(config)#interface bri 0/0
Router(config-if)#dialer map ip 10.0.0.1 name HQ-central broadcast 2330038283

Misconceptions:

None

Related Commands:

dialer-list protocol


%command%

Command:

dialer watch-disable

Mode:

Router(config-if)#

Syntax:

dialer watch-disable timeout

no dialer watch-disable

Syntax Description:

timeout

The timeout value in seconds.

Command Description:

Dialer Watch activates a DDR connection when one or more user-specified routes are removed from a router's routing table. Use the dialer watch-disable command to instruct a router to wait for a specified number of seconds after the route is reinserted into the routing table before bringing down the backup connection.

Example:

The following example forces a 6-second delay to the backup interface once the primary interface recovers:

Router(config)#interface bri0

Router(config-if)#ip address 10.1.1.2 255.255.255.0

Router(config-if)#encapsulation ppp

Router(config-if)#dialer map ip 10.3.1.1 255.255.255.0 name hubble 5551234

Router(config-if)#dialer-group 1

Router(config-if)#dialer watch-group 1

Router(config-if)#dialer watch-disable 6

Misconceptions:

None

Related commands:

dialer watch-list
dialer watch-group

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

dialer watch-group

Mode:

Router(config-if)#

Syntax:

dialer watch-group group-number

no dialer watch-group group-number

Syntax Description:

group-number

Group number assigned that will point to a globally defined list of IP addresses to watch. The valid range is 1 to 255.

Command Description:

To enable dial-on-demand routing (DDR) backup on an interface using Dialer Watch, apply a dialer list to the interface with the dialer watch-group command. To disable this feature, use the no form of this command.

Example:

The following example configures BRI interface 0 as the backup interface:

interface bri 0

ip address 10.1.1.2 255.255.255.0

encapsulation ppp

dialer watch-group 1

Misconceptions:

None

Related commands:

dialer watch-list
dialer watch-disable

© Cisco Systems, Inc. 2001, 2002


 Command:

dialer-list protocol

Mode:

Router(config)#

Syntax:

dialer-list dialer-group protocol protocol-name {permit | deny | list access-list-number | access-group}

no dialer-list dialer-group [protocol protocol-name {permit | deny | list access-list-number | access-group} ]

Syntax Description:

dialer-group

Number of a dialer access group identified in any dialer-group interface configuration command

protocol-name

One of the following protocol keywords: appletalk, bridge, clns, clns_es, clns_is, decnet, decnet_router-L1, decnet_router-L2, decnet_node, ip, ipx, vines, or xns

permit

Permits access to an entire protocol

deny

Denies access to an entire protocol

list

Specifies that an access list will be used for defining a granularity finer than an entire protocol

access-list-number

Access list numbers specified in any DECnet, Banyan VINES, IP, Novell IPX, or XNS standard or extended access lists, including Novell IPX extended service access point (SAP) access lists and bridging types. See Table for the supported access list types and numbers.

access-group

Filter list name used in the clns filter-set and clns access-group commands

Command Description:

To define a dial-on-demand routing (DDR) dialer list to control dialing by protocol or by a combination of a protocol and a previously defined access list, use the dialer-list global configuration command. To delete a dialer list, use the no form of this command.

Example:

Dialing occurs when an interesting packet (one that matches access list specifications) needs to be output on an interface. Using the standard access list method, packets can be classified as interesting or uninteresting. In the following example, IGRP TCP/IP routing protocol updates are not classified as interesting and do not initiate calls:

Router(config)#access-list 101 deny igrp 0.0.0.0 255.255.255.255 255.255.255.255 0.0.0.0

The following example classifies all other IP packets as interesting and permits them to initiate calls:

Router(config)#access-list 101 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255

Then the following command places list 101 into dialer access group 1:

Router(config)#dialer-list 1 protocol ip list 101

Misconceptions:
None

Related Commands:
dialer map
dialer-group


 Command:

debug all

Mode:

Router#

Syntax:

debug all

no debug all

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable all system diagnostics, enter the debug all command in privileged EXEC mode. The no debug all command turns off all diagnostic output. Using the no debug all command is a convenient way to ensure that you have not accidentally left any debug commands turned on. Debugging output takes priority over other network traffic, and because the debug all command generates more output than any other debug command, it can severely diminish the router's performance or even render it unusable. In virtually all cases, it is best to use more specific debug commands.

Example:
Router#debug all
This may severely impact network performance. Continue? [confirm]
All possible debugging has been turned on

Misconceptions:

None

Related Commands:
debug ip ospf
show ip ospf
debug ppp


Command:

debug arp

Mode:

Router#

Syntax:

debug arp

no debug arp

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information on Address Resolution Protocol (ARP) transactions, use the debug arp

privileged EXEC command. The no form of this command disables debugging output.

Use this command when some nodes on a TCP/IP network are responding, but others are not. It shows

whether the router is sending ARP packets and whether it is receiving ARP packets.

Example:

The following is sample output from the debug arp command:

Router# debug arp

IP ARP: sent req src 172.16.22.7 0000.0c01.e117, dst 172.16.22.96 0000.0000.0000

IP ARP: rcvd rep src 172.16.22.96 0800.2010.b908, dst 172.16.22.7

IP ARP: rcvd req src 172.16.6.10 0000.0c00.6fa2, dst 172.16.6.62

IP ARP: rep filtered src 172.16.22.7 aa92.1b36.a456, dst 255.255.255.255 ffff.ffff.ffff

IP ARP: rep filtered src 172.16.9.7 0000.0c00.6b31, dst 172.16.22.7 0800.2010.b908

In the output, each line of output represents an ARP packet that the router sent or received. Explanations

for the individual lines of output follow.

The first line indicates that the router at IP address 172.16.22.7 and MAC address 0000.0c01.e117 sent

an ARP request for the MAC address of the host at 172.16.22.96. The series of zeros (0000.0000.0000)

following this address indicate that the router is currently unaware of the MAC address.

IP ARP: sent req src 172.16.22.7 0000.0c01.e117, dst 172.16.22.96 0000.0000.0000

The second line indicates that the router at IP address 172.16.22.7 receives a reply from the host at

172.16.22.96 indicating that its MAC address is 0800.2010.b908:

IP ARP: rcvd rep src 172.16.22.96 0800.2010.b908, dst 172.16.22.7

The third line indicates that the router receives an ARP request from the host at 172.16.6.10 requesting

the MAC address for the host at 172.16.6.62:

IP ARP: rcvd req src 172.16.6.10 0000.0c00.6fa2, dst 172.16.6.62

The fourth line indicates that another host on the network attempted to send the router an ARP reply for

its own address. The router ignores meaningless replies. Usually, meaningless replies happen if a bridge

is being run in parallel with the router and is allowing ARP to be bridged. This condition indicates a

network misconfiguration.

IP ARP: rep filtered src 172.16.22.7 aa92.1b36.a456, dst 255.255.255.255 ffff.ffff.ffff

The fifth line indicates that another host on the network attempted to inform the router that it is on

network 172.16.9.7, but the router does not know that the network is attached to a different router

interface. The remote host (probably a PC or an X terminal) is misconfigured. If the router were to install

this entry, it would deny service to the real machine on the proper cable.

IP ARP: rep filtered src 172.16.9.7 0000.0c00.6b31, dst 172.16.22.7 0800.2010.b908

Misconceptions:

None.

Related Commands:

None.


 Command:

debug dialer

Mode:

Router#

Syntax:

debug dialer {events | packets}

no debug dialer {events | packets}

Syntax Description:

events When DDR is enabled on the interface, information concerning the cause of any call (called the Dialing cause) is displayed.
packets Displays debugging information about the packets received on a dialer interface.

Command Description:

This command is used to display debugging information about the packets received on a dialer interface, including source and destination address, and number dialed. When Dial on Demand Routing (DDR) is enabled on the interface, information concerning the cause of any call (called the Dialing cause) is also displayed. The no form of the command disables debugging output.

Example:

The following is a sample line of output from the debug dialer events command. The following display for an IP packet, lists the name of the DDR interface and the source and destination addresses of the packet:

Router#debug dialer events

Dialing cause: Serial0: ip (s=172.16.1.111 d=172.16.2.22)

The following is a sample of output from the debug dialer packets command. It shows the interface type, the type of packet (protocol) being sent, the source and destination addresses, the size of the packet, and the default action for the packet (in this example, PERMIT).

Router#debug dialer packets

BRI0: ip (s=10.1.1.8, d=10.1.1.1), 100 bytes, interesting (ip PERMIT)

Misconceptions:

None

Related Commands:
debug all


 Command:

debug eigrp

Mode:

Router#

Syntax:

debug ip eigrp {fsm | neighbors | packet}

no debug eigrp {fsm | neighbors [static] | packet}

Syntax Description:

fsm | Displays debugging information about EIGRP feasible successormetrics (FSM).
neighbors | Display neighbors discovered by EIGRP.
packet | Displays general debugging information, including packets transmitted and received.

Command Description:

The debug eigrp commands can be used to troubleshoot or monitor live EIGRP processes.

Example:

Router#debug eigrp fsm
DUAL:
dual_rcvupdate(): 172.25.166.0 255.255.255.0 via 0.0.0.0 metric 750080/0
DUAL: Find FS for dest 172.25.166.0 255.255.255.0. FD is 4294967295, RD is 42949
67295 found
DUAL: RT installed 172.25.166.0 255.255.255.0 via 0.0.0.0
DUAL:
dual_rcvupdate(): 192.168.4.0 255.255.255.0 via 0.0.0.0 metric 4294967295/
4294967295
DUAL: Find FS for dest 192.168.4.0 255.255.255.0. FD is 2249216, RD is 2249216
DUAL:   0.0.0.0 metric 4294967295/4294967295not found Dmin is 4294967295
DUAL: Dest 192.168.4.0 255.255.255.0 not entering active state.
DUAL: Removing dest 192.168.4.0 255.255.255.0, nexthop 0.0.0.0
DUAL: No routes. Flushing dest 192.168.4.0 255.255.255.0

Misconceptions:

None

Related Commands:
debug all


Command:

debug frame-relay events

Mode:

Router#

Syntax:

debug frame-relay events

no debug frame-relay events

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display debugging information about Frame Relay ARP replies on networks that support a multicast

channel and use dynamic addressing, use the debug frame-relay events privileged EXEC command.

The no form of this command disables debugging output.

This command is useful for identifying the cause of end-to-end connection problems during the

installation of a Frame Relay network or node.

Note: Because the debug frame-relay events command does not generate much output, you can use it at

any time, even during periods of heavy traffic, without adversely affecting other users on the system.

Example:

The following is sample output from the debug frame-relay events command:

Router# debug frame-relay events

Serial2(i): reply rcvd 172.16.170.26 126

Serial2(i): reply rcvd 172.16.170.28 128

Serial2(i): reply rcvd 172.16.170.34 134

Serial2(i): reply rcvd 172.16.170.38 144

Serial2(i): reply rcvd 172.16.170.41 228

Serial2(i): reply rcvd 172.16.170.65 325

As the output shows, the debug frame-relay events command returns one specific message type. The

first line, for example, indicates that IP address 172.16.170.26 sent a Frame Relay ARP reply; this packet

was received as input on serial interface 2. The last field (126) is the data-link connection identifier

(DLCI) to use when communicating with the responding router.

Misconceptions:

None.

Related Commands:

None.


Command:

debug frame-relay lmi

Mode:

Router#

Syntax:

debug frame-relay lmi [interface name]

no debug frame-relay lmi [interface name]

Syntax Description:

interface name (Optional) The name of interface.

Command Description:

To display information on the local management interface (LMI) packets exchanged by the router and the Frame Relay service provider, use the debug frame-relay lmi privileged EXEC command. The no form of this command disables debugging output.

You can use this command to determine whether the router and the Frame Relay switch are sending and receiving LMI packets properly.

Note: Because the debug frame-relay lmi command does not generate much output, you can use it at any time, even during periods of heavy traffic, without adversely affecting other users on the system.

Example:

The following is sample output from the debug frame-relay lmi command: The first four lines describe an LMI exchange. The first line describes the LMI request the router has sent to the switch. The second line describes the LMI reply the router has received from the switch. The third and fourth lines describe the response to this request from the switch. This LMI exchange is followed by two similar LMI exchanges. The last six lines consist of a full LMI status message that includes a description of the two permanent virtual circuits (PVCs) of the router.

Router# debug frame-relay lmi

Serial1(out): StEnq, clock 20212760, myseq 206, mineseen 205, yourseen 136, DTE up

Serial1(in): Status, clock 20212764, myseq 206

RT IE 1, length 1, type 1

KA IE 3, length 2, yourseq 138, myseq 206

Serial1(out): StEnq, clock 20222760, myseq 207, mineseen 206, yourseen 138, DTE up

Serial1(in): Status, clock 20222764, myseq 207

RT IE 1, length 1, type 1

KA IE 3, length 2, yourseq 140, myseq 207

Serial1(out): clock 20232760, myseq 208, mineseen 207, yourseen 140, line up

RT IE 1, length 1, type 1

KA IE 3, length 2, yourseq 142, myseq 208

Serial1(out): StEnq, clock 20252760, myseq 210, mineseen 209, yourseen 144, DTE up

Serial1(in): Status, clock 20252764,

RT IE 1, length 1, type 0

KA IE 3, length 2, yourseq 146, myseq 210

PVC IE 0x7, length 0x6, dlci 400, status 0, bw 56000

PVC IE 0x7, length 0x6, dlci 401, status 0, bw 56000

Misconceptions:

None.

Related Commands:

None.


Command:

debug frame-relay packet

Mode:

Router#

Syntax:

debug frame-relay packet [interface name [dlci value]]

no debug frame-relay packet [interface name [dlci value]]

Syntax Description:

interface name | (Optional) Name of interface or subinterface.
dlci value | (Optional) Data-link connection indentifier (DLCI) decimal value.

Command Description:

To display information on packets that have been sent on a Frame Relay interface, use the debug frame-relay packet privileged EXEC command. The no form of this command disables debugging output.

This command helps you analyze the packets that are sent on a Frame Relay interface. Because the debug frame-relay packet command generates a substantial amount of output, only use it when traffic on the Frame Relay network is fewer than 25 packets per second. Use the options to limit the debugging output to a specific DLCI or interface.

To analyze the packets received on a Frame Relay interface, use the debug frame-relay command.

Example:

The following is sample output from the debug frame-relay packet command:

Router# debug frame-relay packets
Serial0: broadcast = 1, link 809B, addr 65535.255
Serial0(o):DLCI 500 type 809B size 24
Serial0: broadcast - 0, link 809B, addr 10.2
Serial0(o):DLCI 100 type 809B size 104
Serial0: broadcast search
Serial0(o):DLCI 300 type 809B size 24
Serial0(o):DLCI 400 type 809B size 24

The debug frame-relay packet output consists of groups of output lines; each group describes a Frame Relay packet that has been sent. The number of lines in the group can vary, depending on the number of DLCIs on which the packet was sent. For example, the first two pairs of output lines describe two different packets, both of which were sent out on a single DLCI. The last three lines describe a single Frame Relay packet that was sent out on two DLCIs.

The following lines describe a Frame Relay packet sent to a particular address; in this case AppleTalk address 10.2:

Serial0: broadcast - 0, link 809B, addr 10.2
Serial0(o):DLCI 100 type 809B size 104

The following lines describe a Frame Relay packet that went out on two different DLCIs, because two Frame Relay map entries were found:

Serial0: broadcast search
Serial0(o):DLCI 300 type 809B size 24
Serial0(o):DLCI 400 type 809B size 24

The following lines do not appear. They describe a Frame Relay packet sent to a true broadcast address.

Serial1: broadcast search
Serial1(o):DLCI 400 type 800 size 288

Misconceptions:

None.

Related Commands:

None.


Command:

debug http client

Mode:

Router#

Syntax:

debug http client {all | api | background | cache | error | main | msg | socket}

no debug http client {all | api | background | cache | error | main | msg | socket}

Syntax Description:

all | Displays all debugging messages for the HTTP client.
api | Displays debug information for the HTTP client application programming interface (API) process.
background | Displays background messages.
cache | Displays debug information for the HTTP client cache module.
error | Displays the HTTP client error messages.
main | Displays debug information for the HTTP client main process.
msg | Displays the HTTP client messages.
socket | Displays the HTTP client socket messages.

Command Description:

To display debugging messages for the HTTP client, use the debug http client command in privileged EXEC mode. To disable debugging output, use the no form of this command.

The output of this command is effected by the debug condition application voice command. If the debug condition application voice command is configured and the element is enabled in the VoiceXML document, debugging output is limited to the VoiceXML application named in the debug condition application voice command.

Example:

The following example shows output from the debug http client api command:

Router# debug http client api
HTTP Client API Process debugging is on
*Jan 3 10:58:48.609: httpc_send_ev: event sent to HTTP Client:
*Jan 3 10:58:48.609: method (GET), url (http://serverX.com/vxml/test/prompts/9.au)
*Jan 3 10:58:48.609: callback (61008E78), argp (63590DB4), sid (0), timeout (60), retries (2)
*Jan 3 10:58:48.609: httpc_free: app freeing response data(626FA608)
*Jan 3 10:58:59.353: httpc_send_ev: event sent to HTTP Client:
*Jan 3 10:58:59.353: method (GET), url (http://1.7.100.1/vxml/test/dropoffRecord)
*Jan 3 10:58:59.353: callback (61008E78), argp (6393B684), sid (0), timeout (60), retries (0)
*Jan 3 10:58:59.369: httpc_free: app freeing response data(626F9348)
*Jan 3 10:59:45.033: httpc_send_ev: event sent to HTTP Client:
*Jan 3 10:59:45.033: method (POST), url (http://rtsp-ws/dropoffAppend.php?append=&disconnect=1)
*Jan 3 10:59:45.033: callback (60FE9064), argp (63448820), sid (7179), timeout (0), retries (0)
*Jan 3 10:59:57.369: httpc_free: app freeing response data(626F9340)

Misconceptions:

Cisco recommends that you log output from the debug http client msg and debug http client socket commands to a buffer, rather than sending the output to the console; otherwise, the size of the output could severely impact the performance of the gateway.

Related Commands:

None


Command:

debug ip dhcp server

Mode:

Router#

Syntax:

debug ip dhcp server {events | packets | linkage}

no debug ip dhcp server {events | packets | linkage}

Syntax Description:

events | Reports server events, like address assignments and database updates.
packets | Decodes DHCP receptions and transmissions.
linkage | Displays database linkage information (such as parent-child relationships in a radix tree).

Command Description:

To enable DHCP Server debugging, use the debug ip dhcp server privileged EXEC command.

Example:

The following is sample output from the debug ip dhcp server command.

Router#debug ip dhcp server events
1d21h: DHCPD: there is no address pool for 1.7.45.35.

Misconceptions:

None.

Related Commands:

None.


Command:

debug ip eigrp

Mode:

Router#

Syntax:

debug ip eigrp

no debug ip eigrp

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information on Enhanced IGRP protocol packets, use the debug ip eigrp privileged EXEC command. The no form of this command disables debugging output.

Example:

The following is sample output from the debug ip eigrp command:

Router# debug ip eigrp
IP-EIGRP: Processing incoming UPDATE packet
IP-EIGRP: Ext 192.168.3.0 255.255.255.0 M 386560 - 256000 130560 SM 360960 - 256000 104960
IP-EIGRP: Ext 192.168.0.0 255.255.255.0 M 386560 - 256000 130560 SM 360960 - 256000 104960
IP-EIGRP: Ext 192.168.3.0 255.255.255.0 M 386560 - 256000 130560 SM 360960 - 256000 104960
IP-EIGRP: 172.69.43.0 255.255.255.0, - do advertise out Ethernet0/1
IP-EIGRP: Ext 172.69.43.0 255.255.255.0 metric 371200 - 256000 115200
IP-EIGRP: 192.135.246.0 255.255.255.0, - do advertise out Ethernet0/1
IP-EIGRP: Ext 192.135.246.0 255.255.255.0 metric 46310656 - 45714176 596480
IP-EIGRP: 172.69.40.0 255.255.255.0, - do advertise out Ethernet0/1
IP-EIGRP: Ext 172.69.40.0 255.255.255.0 metric 2272256 - 1657856 614400
IP-EIGRP: 192.135.245.0 255.255.255.0, - do advertise out Ethernet0/1
IP-EIGRP: Ext 192.135.245.0 255.255.255.0 metric 40622080 - 40000000 622080
IP-EIGRP: 192.135.244.0 255.255.255.0, - do advertise out Ethernet0/1

Misconceptions:

None.

Related Commands:

None.


Command:

debug ip icmp

Mode:

Router#

Syntax:

debug ip icmp

no debug ip icmp

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information on Internal Control Message Protocol (ICMP) transactions, use the debug ip icmp privileged EXEC command. The no form of this command disables debugging output.

This command helps you determine whether the router is sending or receiving ICMP messages. Use it, for example, when you are troubleshooting an end-to-end connection problem.

Example:

The following is sample output from the debug ip icmp command:

Router# debug ip icmp
ICMP: rcvd type 3, code 1, from 10.95.192.4
ICMP: src 10.56.0.202, dst 172.69.16.1, echo reply
ICMP: dst (10.120.1.0) port unreachable rcv from 10.120.1.15
ICMP: src 172.69.12.35, dst 172.69.20.7, echo reply
ICMP: dst (255.255.255.255) protocol unreachable rcv from 10.31.7.21
ICMP: dst (10.120.1.0) port unreachable rcv from 10.120.1.15
ICMP: dst (255.255.255.255) protocol unreachable rcv from 10.31.7.21
ICMP: dst (10.120.1.0) port unreachable rcv from 10.120.1.15
ICMP: src 10.56.0.202, dst 172.69.16.1, echo reply
ICMP: dst (10.120.1.0) port unreachable rcv from 10.120.1.15
ICMP: dst (255.255.255.255) protocol unreachable rcv from 10.31.7.21
ICMP: dst (10.120.1.0) port unreachable rcv from 10.120.1.15

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

debug ip igrp events

Mode:

Router#

Syntax:

debug ip igrp events [ip-address]

no debug ip igrp events [ip-address]

Syntax Description:

ip-address (Optional) The IP address of an IGRP neighbor.

Command Description:

To display summary information on Interior Gateway Routing Protocol (IGRP) routing messages that

indicate the source and destination of each update, and the number of routes in each update, use the

debug ip igrp events privileged EXEC command. The no form of this command disables debugging

output.

If the IP address of an IGRP neighbor is specified, the resulting debug ip igrp events output includes

messages describing updates from that neighbor and updates that the router broadcasts toward that

neighbor. Messages are not generated for each route.

This command is particularly useful when there are many networks in your routing table. In this case,

using debug ip igrp transactions could flood the console and make the router unusable. Use debug ip

igrp events instead to display summary routing information.

Example:

The following is sample output from the debug ip igrp events command:

Router# debug ip igrp events

IGRP: sending update to 255.255.255.255 via Ethernet1 (160.89.33.8)

IGRP: Update contains 26 interior, 40 system, and 3 exterior routes.

IGRP: Total routes in update: 69

IGRP: sending update to 255.255.255.255 via Ethernet0 (160.89.32.8)

IGRP: Update contains 1 interior, 0 system, and 0 exterior routes.

IGRP: Total routes in update: 1

IGRP: received update from 160.89.32.24 on Ethernet0

IGRP: Update contains 17 interior, 1 system, and 0 exterior routes.

IGRP: Total routes in update: 18

IGRP: received update from 160.89.32.7 on Ethernet0

IGRP: Update contains 5 interior, 1 system, and 0 exterior routes.

IGRP: Total routes in update: 6

This shows that the router has sent two updates to the broadcast address 255.255.255.255. The router

also received two updates. Three lines of output describe each of these updates.

The first line indicates whether the router sent or received the update packet, the source or destination

address, and the interface through which the update was sent or received. If the update was sent, the IP

address assigned to this interface is shown (in parentheses).

IGRP: sending update to 255.255.255.255 via Ethernet1 (160.89.33.8)

The second line summarizes the number and types of routes described in the update:

IGRP: Update contains 26 interior, 40 system, and 3 exterior routes.

The third line indicates the total number of routes described in the update:

IGRP: Total routes in update: 69

Misconceptions:

None.

Related Commands:

None.


Command:

debug ip igrp transactions

Mode:

Router#

Syntax:

debug ip igrp transactions [ip-address]

no debug ip igrp transactions [ip-address]

Syntax Description:

ip-address (Optional) The IP address of an IGRP neighbor.

Command Description:

To display transaction information on Interior Gateway Routing Protocol (IGRP) routing transactions,

use the debug ip igrp transactions privileged EXEC command. The no form of this command disables

debugging output.

If the IP address of an IGRP neighbor is specified, the resulting debug ip igrp transactions output

includes messages describing updates from that neighbor and updates that the router broadcasts toward

that neighbor.

When many networks are in your routing table, the debug ip igrp transactions command can flood the

console and make the router unusable. In this case, use the debug ip igrp events command instead to

display summary routing information.

Example:

The following is sample output from the debug ip igrp transactions command:

Router# debug ip igrp transactions

IGRP: received update from 160.89.80.240 on Ethernet

subnet 160.89.66.0, metric 1300 (neighbor 1200)

subnet 160.89.56.0, metric 8676 (neighbor 8576)

subnet 160.89.48.0, metric 1200 (neighbor 1100)

subnet 160.89.50.0, metric 1300 (neighbor 1200)

subnet 160.89.40.0, metric 8676 (neighbor 8576)

network 192.82.152.0, metric 158550 (neighbor 158450)

network 192.68.151.0, metric 1115511 (neighbor 1115411)

network 150.136.0.0, metric 16777215 (inaccessible)

exterior network 129.140.0.0, metric 9676 (neighbor 9576)

exterior network 140.222.0.0, metric 9676 (neighbor 9576)

IGRP: received update from 160.89.80.28 on Ethernet

subnet 160.89.95.0, metric 180671 (neighbor 180571)

subnet 160.89.81.0, metric 1200 (neighbor 1100)

subnet 160.89.15.0, metric 16777215 (inaccessible)

IGRP: sending update to 255.255.255.255 via Ethernet0 (160.89.64.31)

subnet 160.89.94.0, metric=847

IGRP: sending update to 255.255.255.255 via Serial1 (160.89.94.31)

subnet 160.89.80.0, metric=16777215

subnet 160.89.64.0, metric=1100

The output shows that the router being debugged has received updates from two other routers on the

network. The router at source address 160.89.80.240 sent information about ten destinations in the

update; the router at source address 160.89.80.28 sent information about three destinations in its update.

The router being debugged also sent updates—in both cases to the broadcast address 255.255.255.255

as the destination address.

On the second line the first field refers to the type of destination information: "subnet" (interior),

"network" (system), or "exterior" (exterior). The second field is the Internet address of the destination

network. The third field is the metric stored in the routing table and the metric advertised by the neighbor

sending the information. "Metric... inaccessible" usually means that the neighbor router has put the

destination in a hold down state.

The entries show that the router is sending updates that are similar, except that the numbers in

parentheses are the source addresses used in the IP header. A metric of 16777215 is inaccessible.

Other examples of output that the debug ip igrp transactions command can produce follow.

The following entry indicates that the routing table was updated and shows the new edition number (97

in this case) to be used in the next IGRP update:

IGRP: edition is now 97

Entries such as the following occur on startup or when some event occurs such as an interface making a

transition or a user manually clearing the routing table:

IGRP: broadcasting request on Ethernet0

IGRP: broadcasting request on Ethernet1

The following type of entry can result when routing updates become corrupted between sending and

receiving routers:

IGRP: bad checksum from 172.69.64.43

An entry such as the following should never appear. If it does, the receiving router has a bug in the

software or a problem with the hardware. In either case, contact your technical support representative.

IGRP: system 45 from 172.69.64.234, should be system 109

Misconceptions:

None.

Related Commands:

None.


Command:

debug ip nat

Mode:

Router#

Syntax:

debug ip nat [access-list | detailed | h323 | pptp]

no debug ip nat [access-list | detailed | h323 | pptp]

Syntax Description:

access-list

(Optional) The standard IP access list number. If the datagram is not

permitted by the specified access list, the related debugging output is

suppressed.

detailed

(Optional) Displays debug information in a detailed format.

h323

(Optional) Displays H.225/H.245 protocol information.

pptp

(Optional) Displays Point-to-Point Tunneling (PPTP) protocol information.

Command Description:

To display information about IP packets translated by the IP Network Address Translation (NAT)

feature, use the debug ip nat privileged EXEC command. To disable debugging output, use the no form

of this command.

The NAT feature reduces the need for unique, registered IP addresses. It can also save private network

administrators from needing to renumber hosts and routers that do not conform to global IP addressing.

Use the debug ip nat command to verify the operation of the NAT feature by displaying information

about every packet that is translated by the router. The debug ip nat detailed command generates a

description of each packet considered for translation. This command also outputs information about

certain errors or exceptional conditions, such as the failure to allocate a global address. To display

messages related to the processing of H.225 signalling and H.245 messages, use the debug ip nat h323

command.

Caution: Because the debug ip nat command generates a substantial amount of output, use it only when traffic

on the IP network is low, so other activity on the system is not adversely affected.

Example:

The following is sample output from the debug ip nat command. In this example, the first two lines show

the debugging output produced by a Domain Name System (DNS) request and reply. The remaining lines

show the debugging output from a Telnet connection from a host on the inside of the network to a host

on the outside of the network. All Telnet packets, except for the first packet, were translated in the fast

path, as indicated by the asterisk (*).

Router# debug ip nat

NAT: s=192.168.1.95->172.31.233.209, d=172.31.2.132 [6825]

NAT: s=172.31.2.132, d=172.31.233.209->192.168.1.95 [21852]

NAT: s=192.168.1.95->172.31.233.209, d=172.31.1.161 [6826]

NAT*: s=172.31.1.161, d=172.31.233.209->192.168.1.95 [23311]

NAT*: s=192.168.1.95->172.31.233.209, d=172.31.1.161 [6827]

NAT*: s=192.168.1.95->172.31.233.209, d=172.31.1.161 [6828]

NAT*: s=172.31.1.161, d=172.31.233.209->192.168.1.95 [23313]

NAT*: s=172.31.1.161, d=172.31.233.209->192.168.1.95 [23325]

Misconceptions:

None.

Related Commands:

None.


Command:

debug ip ospf adj

Mode:

Router#

Syntax:

debug ip ospf adj

no debug ip ospf adj

Syntax Description:

This command has no arguments or keywords.

Command Description:

Debugs OSPF neighbor adjacency establishment process. The no form of this command disables debugging output.

Example:

Sample debug Command Output - Configuring Plain Text Authentication

r3.3.3.3#debug ip ospf adj
23:31:41: OSPF: Interface OSPF_VL0 going Up
23:31:41: OSPF: Build router LSA for area 0, router ID 3.3.3.3, seq 0x8000002E
23:31:41: OSPF: Build router LSA for area 1, router ID 3.3.3.3, seq 0x8000002E
23:31:41: OSPF: Build router LSA for area 2, router ID 3.3.3.3, seq 0x80000031
23:31:51: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL0 seq 0x887 opt 0x62 flag 0x7 len 32  mtu 0 state INIT
23:31:51: OSPF: 2 Way Communication to 1.1.1.1 on OSPF_VL0, state 2WAY
23:31:51: OSPF: Send DBD to 1.1.1.1 on OSPF_VL0 seq 0x2102 opt 0x62 flag 0x7 len 32
23:31:51: OSPF: First DBD and we are not SLAVE
23:31:51: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL0 seq 0x2102 opt 0x62 flag 0x2 len 172  mtu 0 state EXSTART
23:31:51: OSPF: NBR Negotiation Done. We are the MASTER
23:31:51: OSPF: Send DBD to 1.1.1.1 on OSPF_VL0 seq 0x2103 opt 0x62 flag 0x3 len 172
23:31:51: OSPF: Database request to 1.1.1.1
23:31:51: OSPF: sent LS REQ packet to 5.0.0.1, length 12
23:31:51: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL0 seq 0x2103 opt 0x62 flag 0x0 len 32  mtu 0 state EXCHANGE
23:31:51: OSPF: Send DBD to 1.1.1.1 on OSPF_VL0 seq 0x2104 opt 0x62 flag 0x1 len 32
23:31:51: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL0 seq 0x2104 opt 0x62 flag 0x0 len 32  mtu 0 state EXCHANGE
23:31:51: OSPF: Exchange Done with 1.1.1.1 on OSPF_VL0
23:31:51: OSPF: Synchronized with 1.1.1.1 on OSPF_VL0, state FULL

!--- Indicates the neighbor adjacency is established

23:31:51: %OSPF-5-ADJCHG: Process 2, Nbr 1.1.1.1 on OSPF_VL0 from LOADING to FULL, Loading Done
23:31:52: OSPF: Build router LSA for area 0, router ID 3.3.3.3, seq 0x8000002F
23:32:23: OSPF: Dead event ignored for 1.1.1.1 on demand circuit OSPF_VL0
r3.3.3.3#

Misconceptions:

None.

Related Commands:

debug ip ospf events


Command:

debug ip ospf events

Mode:

Router#

Syntax:

debug ip ospf events

no debug ip ospf events

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information on Open Shortest Path First (OSPF)-related events, such as adjacencies, flooding information, designated router selection, and shortest path first (SPF) calculation, use the debug ip ospf events privileged EXEC command. The no form of this command disables debugging output.

Example:

The following is sample output from the debug ip ospf events command:

Router# debug ip ospf events

OSPF:hello with invalid timers on interface Ethernet0

hello interval received 10 configured 10

net mask received 255.255.255.0 configured 255.255.255.0

dead interval received 40 configured 30

The debug ip ospf events output shown might appear if any of the following situations occurs:

• The IP subnet masks for routers on the same network do not match.

• The OSPF hello interval for the router does not match that configured for a neighbor.

• The OSPF dead interval for the router does not match that configured for a neighbor.

If a router configured for OSPF routing is not seeing an OSPF neighbor on an attached network, perform the following tasks:

• Make sure that both routers have been configured with the same IP mask, OSPF hello interval, and OSPF dead interval.

• Make sure that both neighbors are part of the same area type.

In the following example line, the neighbor and this router are not part of a stub area (that is, one is a part of a transit area and the other is a part of a stub area, as explained in RFC 1247):

OSPF: hello packet with mismatched E bit

Misconceptions:

None.

Related Commands:

debug ip ospf adj

debug ip ospf packet


Command:

debug ip ospf monitor

Mode:

Router#

Syntax:

debug ip ospf monitor

no debug ip ospf monitor

Syntax Description:

This command has no arguments or keywords.

Command Description:

To determine if the link is brought up due to a change in network topology, use the debug ip ospf monitor command. The no form of this command disables debugging output.

Example:

The output below shows there was a change in the router LSA with the router ID of 192.168.246.41, which causes the database to be resynchronized. If the network is stable, then this debug output shows nothing.

To reduce the affect of link flaps on the demand circuit, configure the area that contains the demand circuit as totally stub. If this isn't doable, and there is a constant link flap within the network, demand circuit might not be a good choice for you.

The example shows which LSA is changing, as seen below:

Router#debug ip ospf monitor
OSPF: Schedule SPF in area 0.0.0.0
    Change in LS ID 192.168.246.41, LSA type R,
OSPF: schedule SPF: spf_time 1620348064ms wait_interval 10s

Misconceptions:

None.

Related Commands:

None.


Command:

debug ip ospf mpls traffic-eng advertisements

Mode:

Router#

Syntax:

debug ip ospf mpls traffic-eng advertisements

no debug ip ospf mpls traffic-eng advertisements

Syntax Description:

This command has no arguments or keywords.

Command Description:

To print information about traffic engineering advertisements in OSPF link state advertisement (LSA) messages, use the debug ip ospf mpls traffic-eng advertisements privileged EXEC command. To disable debugging output, use the no form of this command.

Example:

In the following example, information about traffic engineering advertisements is printed in OSPF LSA messages:

Router#debug ip ospf mpls traffic-eng advertisements
OSPF:IGP delete router node 10.106.0.6 fragment 0 with 0 links
TE Router ID 10.106.0.6
OSPF:IGP update router node 10.110.0.10 fragment 0 with 0 links
TE Router ID 10.110.0.10
OSPF:MPLS announce router node 10.106.0.6 fragment 0 with 1 links
Link connected to Point-to-Point network
Link ID :10.110.0.10
Interface Address :10.1.0.6
Neighbor Address :10.1.0.10
Admin Metric :10
Maximum bandwidth :1250000
Maximum reservable bandwidth :625000
Number of Priority :8
Priority 0 :625000 Priority 1 :625000
Priority 2 :625000 Priority 3 :625000
Priority 4 :625000 Priority 5 :625000
Priority 6 :625000 Priority 7 :625000
Affinity Bit :0x0

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

debug ip ospf packet

Mode:

Router#

Syntax:

debug ip ospf packet

no debug ip ospf packet

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information about each Open Shortest Path First (OSPF) packet received, use the debug ip

ospf packet privileged EXEC command. The no form of this command disables debugging output.

Example:

The following is sample output from the debug ip ospf packet command:

Router# debug ip ospf packet

OSPF: rcv. v:2 t:1 l:48 rid:200.0.0.117

aid:0.0.0.0 chk:6AB2 aut:0 auk:

The debug ip ospf packet command produces one set of information for each packet received. The

output varies slightly depending on which authentication is used. The following is sample output from

the debug ip ospf packet command when MD5 authentication is used.

Router# debug ip ospf packet

OSPF: rcv. v:2 t:1 l:48 rid:200.0.0.116

aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x0

Misconceptions:

None.

Related Commands:

debug ip ospf events


Command:

debug ip ospf spf statistic

Mode:

Router#

Syntax:

debug ip ospf spf statistic

no debug ip ospf spf statistic

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display statistical information while running the shortest path first algorithm (SPF), use the debug ip ospf spf statistic command in privileged EXEC mode. To disable the debugging output, use the no form of this command.

The debug ip ospf spf statistic command displays the SPF calculation times in milliseconds, the node count, and a time stamp.

Example:

The following is sample output from the debug ip ospf spf statistic command:

Router# debug ip ospf spf statistic
00:05:59: OSPF: Begin SPF at 359.216ms, process time 60ms
00:05:59: spf_time 00:05:59.216, wait_interval 0s
00:05:59: OSPF: End SPF at 359.216ms, Total elapsed time 0ms
00:05:59: Intra: 0ms, Inter: 0ms, External: 0ms
00:05:59: R: 4, N: 2, Stubs: 1
00:05:59: SN: 1, SA: 0, X5: 1, X7: 0
00:05:59: SPF suspends: 0 intra, 1 total

Misconceptions:

None.

Related Commands:

None.


 Command:

debug ip ospf

Mode:

Router#

Syntax:

debug ip ospf { events | packet }

no debug ip ospf { events | packet }

Syntax Description:

events | Displays information on the Open Shortest Path First (OSPF) protocol related events, such as adjacencies, flooding information, designated router selection, and shortest path first (SPF) calculation. The no form of this command disables debugging output.
packet | Displays information about each Open Shortest Path First (OSPF) packet received.

Command Description:

The debug ip ospf commands can be used to troubleshoot or monitor live OSPF processes.

Example:

Router#debug ip ospf events
OSPF:hello with invalid timers on interface Ethernet0
hello interval received 10 configured 10
net mask received 255.255.255.0 configured 255.255.255.0
dead interval received 40 configured 30

Misconceptions:

None

Related Commands:
debug all


Command:

debug ip packet

Mode:

Router#

Syntax:

debug ip packet [access-list-number]

no debug ip packet [access-list-number]

Syntax Description:

access-list-number

(Optional) The IP access list number that you can specify. If the datagram is not permitted by that access list, the related debugging output is suppressed.

Command Description:

To display general IP debugging information and IP security option (IPSO) security transactions, use the

debug ip packet privileged EXEC command. The no form of this command disables debugging output.

If a communication session is closing when it should not be, an end-to-end connection problem can be

the cause. The debug ip packet command is useful for analyzing the messages traveling between the

local and remote hosts.

IP debugging information includes packets received, generated, and forwarded. Fast-switched packets

do not generate messages.

IPSO security transactions include messages that describe the cause of failure each time a datagram fails

a security test in the system. This information is also sent to the sending host when the router

configuration allows it.

Caution: Because the debug ip packet command generates a substantial amount of output, use it only when

traffic on the IP network is low, so other activity on the system is not adversely affected.

Example:

The following is sample output from the debug ip packet command:

Router# debug ip packet

IP: s=172.69.13.44 (Fddi0), d=10.125.254.1 (Serial2), g=172.69.16.2, forward

IP: s=172.69.1.57 (Ethernet4), d=10.36.125.2 (Serial2), g=172.69.16.2, forward

IP: s=172.69.1.6 (Ethernet4), d=255.255.255.255, rcvd 2

IP: s=172.69.1.55 (Ethernet4), d=172.69.2.42 (Fddi0), g=172.69.13.6, forward

IP: s=172.69.89.33 (Ethernet2), d=10.130.2.156 (Serial2), g=172.69.16.2, forward

IP: s=172.69.1.27 (Ethernet4), d=172.69.43.126 (Fddi1), g=172.69.23.5, forward

IP: s=172.69.1.27 (Ethernet4), d=172.69.43.126 (Fddi0), g=172.69.13.6, forward

IP: s=172.69.20.32 (Ethernet2), d=255.255.255.255, rcvd 2

IP: s=172.69.1.57 (Ethernet4), d=10.36.125.2 (Serial2), g=172.69.16.2, access denied

The output shows two types of messages that the debug ip packet command can produce; the first line

of output describes an IP packet that the router forwards, and the third line of output describes a packet

that is destined for the router. In the third line of output, rcvd 2 indicates that the router decided to receive

the packet.

Misconceptions:

None.

Related Commands:

None.


 Command:

debug ip rip

Mode:

Router#

Syntax:

debug ip rip

no debug ip rip

Syntax Description:

This command has no arguments or keywords.

Command Description:

This command displays RIP transactions.

Example:

Router#debug ip rip
RIP protocol debugging is on

Misconceptions:

None

Related Commands:
debug all


Command:

debug isdn q921

Mode:

Router#

Syntax:

debug isdn q921

no debug isdn q921

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display data link layer (Layer 2) access procedures that are taking place at the router on the D channel (LAPD) of its ISDN interface, use the debug isdn q921 privileged EXEC command. The no form of this command disables debugging output.

The ISDN data link layer interface provided by the router conforms to the user interface specification defined by ITU-T recommendation Q.921. The debug isdn q921 command output is limited to commands and responses exchanged during peer-to-peer communication carried over the D channel. This debug information does not include data sent over the B channels that is also part of the router’s ISDN interface. The peers (data link layer entities and layer management entities on the routers) communicate with each other via an ISDN switch over the D channel.

A router can be the calling or called party of the ISDN Q.921 data link layer access procedures. If the router is the calling party, the command displays information about an outgoing call. If the router is the called party, the command displays information about an incoming call and the keepalives.

The debug isdn q921 command can be used with the debug isdn event and the debug isdn q931 commands at the same time. The displays will be intermingled.

Use the service timestamps debug datetime msec global configuration command to include the time with each message.

Example:

The following is sample output from the debug isdn q921 command for an outgoing call:

Router# debug isdn q921
Jan 3 14:52:24.475: ISDN BR0: TX -> INFOc sapi = 0 tei = 64 ns = 5 nr = 2
i = 0x08010705040288901801837006803631383835
Jan 3 14:52:24.503: ISDN BR0: RX <- RRr sapi = 0 tei = 64 nr = 6
Jan 3 14:52:24.527: ISDN BR0: RX <- INFOc sapi = 0 tei = 64 ns = 2 nr = 6
i = 0x08018702180189
Jan 3 14:52:24.535: ISDN BR0: TX -> RRr sapi = 0 tei = 64 nr = 3
Jan 3 14:52:24.643: ISDN BR0: RX <- INFOc sapi = 0 tei = 64 ns = 3 nr = 6
i = 0x08018707
Jan 3 14:52:24.655: ISDN BR0: TX -> RRr sapi = 0 tei = 64 nr = 4
%LINK-3-UPDOWN: Interface BRI0:1, changed state to up
Jan 3 14:52:24.683: ISDN BR0: TX -> INFOc sapi = 0 tei = 64 ns = 6 nr = 4
i = 0x0801070F
Jan 3 14:52:24.699: ISDN BR0: RX <- RRr sapi = 0 tei = 64 nr = 7
%LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state to up
%ISDN-6-CONNECT: Interface BRI0:1 is now connected to 61885 goodie
Jan 3 14:52:34.415: ISDN BR0: RX <- RRp sapi = 0 tei = 64 nr = 7
Jan 3 14:52:34.419: ISDN BR0: TX -> RRf sapi = 0 tei = 64 nr = 4

Misconceptions:

The ISDN switch provides the network interface defined by Q.921. This debug command does not display data link layer access procedures taking place within the ISDN network (that is, procedures taking place on the network side of the ISDN connection).

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

debug isdn q931

Mode:

Router#

Syntax:

debug isdn q931

no debug isdn q931

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information about call setup and teardown of ISDN network connections (layer 3) between the local router (user side) and the network, use the debug isdn q931 privileged EXEC command. The no form of this command disables debugging output.

The ISDN network layer interface provided by the router conforms to the user interface specification defined by ITU-T recommendation Q.931, supplemented by other specifications such as for switch type VN4. The router tracks only activities that occur on the user side, not the network side, of the network connection. The display information debug isdn q931 command output is limited to commands and responses exchanged during peer-to-peer communication carried over the D channel. This debug information does not include data sent over the B channels, which are also part of the router’s ISDN interface. The peers (network layers) communicate with each other via an ISDN switch over the D channel.

A router can be the calling or called party of the ISDN Q.931 network connection call setup and tear-down procedures. If the router is the calling party, the command displays information about an outgoing call. If the router is the called party, the command displays information about an incoming call.

You can use the debug isdn q931 command with the debug isdn event and the debug isdn q921 commands at the same time. The displays will be intermingled. Use the service timestamps debug datetime msec global configuration command to include the time with each message.

Example:

The following is sample output from the debug isdn q931 command of a call setup procedure for an outgoing call:

Router# debug isdn q931
TX -> SETUP pd = 8 callref = 0x04
Bearer Capability i = 0x8890
Channel ID i = 0x83
Called Party Number i = 0x80, ‘415555121202’
RX <- CALL_PROC pd = 8 callref = 0x84
Channel ID i = 0x89
RX <- CONNECT pd = 8 callref = 0x84
TX -> CONNECT_ACK pd = 8 callref = 0x04....
Success rate is 0 percent (0/5)

Misconceptions:

The ISDN switch provides the network interface defined by Q.921. This debug command does not display data link layer access procedures taking place within the ISDN network (that is, procedures taking place on the network side of the ISDN connection).

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


 Command:

debug isdn

Mode:

Router#

Syntax:

debug isdn [events | q921 | q931]

no debug isdn [events | q921 | q931]

Syntax Description:

events | Displays Integrated Services Digital Network (ISDN) events occurring on the user side (on the router) of the ISDN interface. The ISDN events that can be displayed are Q.931 events (call setup and teardown of ISDN network connections). Although the debug isdn event and the debug isdn q931 commands provide similar debug information, the information is displayed in a different format. If you want to see the information in both formats, enable both commands at the same time. The displays will be intermingled.
q921 | Displays data link layer (Layer 2) access procedures occurring at the router on the D channel (LAPD) of its Integrated Services Digital Network (ISDN) interface.
q931 | q931: Displays information about the call setup and teardown of ISDN network connections (Layer 3) between the local router (user side) and the network. The ISDN network layer interface provided by the router conforms to the user interface specification defined by ITU-T recommendation Q.931, supplemented by other specifications such as for switch type VN4. The router tracks only activities that occur on the user side, not the network side of the network connection. The command output of the debug isdn q931 command is limited to commands and responses exchanged during peer-to-peer communication carried over the D channel.

Command Description:

Use the debug isdn priviledged EXEC command to display information on ISDN link activity. The no form of the command disables debugging output.

Example:

Router#debug isdn events
ISDN Event: Call to 415555121202
received HOST_PROCEEDING
 Channel ID i = 0x0101
 -------------------
 Channel ID i = 0x89
received HOST_CONNECT
 Channel ID i = 0x0101
ISDN Event: Connected to 415555121202 on B1 at 64 Kb/s

Misconceptions:

None

Related Commands:
show dialer


Command:

debug isis adj packets

Mode:

Router#

Syntax:

debug isis adj packets

no debug isis adj packets

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information on all adjacency-related activity such as hello packets sent and received and IS-IS adjacencies going up and down, use the debug isis adj packets privileged EXEC command. The no form of this command disables debugging output.

Example:

The following is sample output from the debug isis adj packets command:

Router# debug isis adj packets
ISIS-Adj: Rec L1 IIH from 0000.0c00.40af (Ethernet0), cir type 3, cir id BBBB.BBBB.BBBB.01
ISIS-Adj: Rec L2 IIH from 0000.0c00.40af (Ethernet0), cir type 3, cir id BBBB.BBBB.BBBB.01
ISIS-Adj: Rec L1 IIH from 0000.0c00.0c36 (Ethernet1), cir type 3, cir id CCCC.CCCC.CCCC.03
ISIS-Adj: Area mismatch, level 1 IIH on Ethernet1
ISIS-Adj: Sending L1 IIH on Ethernet1
ISIS-Adj: Sending L2 IIH on Ethernet1
ISIS-Adj: Rec L2 IIH from 0000.0c00.0c36 (Ethernet1), cir type 3, cir id BBBB.BBBB.BBBB.03

Misconceptions:

None.

Related Commands:

None.


Command:

debug isis mpls traffic-eng advertisements

Mode:

Router>

Syntax:

debug isis mpls traffic-eng advertisements

no debug isis mpls traffic-eng advertisements

Syntax Description:

This command has no arguments or keywords.

Command Description:

To print information about traffic engineering advertisements in ISIS Link-state advertisement (LSA) messages, use the debug isis mpls traffic-eng advertisements EXEC command. To disable debugging output, use the no form of this command.

Example:

In the following example, information about traffic engineering advertisements is printed in ISIS LSA messages:

Router>debug isis mpls traffic-eng advertisements
System ID:Router1.00
Router ID:10.106.0.6
Link Count:1
Link[1]
Neighbor System ID:Router2.00 (P2P link)
Interface IP address:10.42.0.6
Neighbor IP Address:10.42.0.10
Admin. Weight:10
Physical BW:155520000 bits/sec
Reservable BW:5000000 bits/sec
BW unreserved[0]:2000000 bits/sec, BW unreserved[1]:100000 bits/sec
BW unreserved[2]:100000 bits/sec, BW unreserved[3]:100000 bits/sec
BW unreserved[4]:100000 bits/sec, BW unreserved[5]:100000 bits/sec
BW unreserved[6]:100000 bits/sec, BW unreserved[7]:0 bits/sec
Affinity Bits:0x00000000

Misconceptions:

None

Related Commands:

None


Command:

debug isis mpls traffic-eng events

Mode:

Router#

Syntax:

debug isis mpls traffic-eng events

no debug isis mpls traffic-eng events

Syntax Description:

This command has no arguments or keywords.

Command Description:

To print information about traffic engineering-related ISIS events, use the debug isis mpls traffic-eng events privileged EXEC command. To disable debugging output, use the no form of this command.

Example:

In the following example, information is printed about traffic engineering-related ISIS events:

Router# debug isis mpls traffic-eng events
ISIS-RRR:Send MPLS TE Et4/0/1 Router1.02 adjacency down:address 0.0.0.0
ISIS-RRR:Found interface address 10.1.0.6 Router1.02, building subtlv... 58 bytes
ISIS-RRR:Found interface address 10.42.0.6 Router2.00, building subtlv... 64 bytes
ISIS-RRR:Interface address 0.0.0.0 Router1.00 not found, not building subtlv
ISIS-RRR:LSP Router1.02 changed from 0x606BCD30
ISIS-RRR:Mark LSP Router1.02 changed because TLV contents different, code 16
ISIS-RRR:Received 1 MPLS TE links flood info for system id Router1.00

Misconceptions:

None

Related Commands:

None

© Cisco Systems, Inc. 2001, 2002


Command:

debug isis spf statistics

Mode:

Router#

Syntax:

debug isis spf statistics

no debug isis spf statistics

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display statistical information about building routes between intermediate systems (ISs), use the debug isis spf statistics privileged EXEC command. The no form of this command disables debugging output.

The Intermediate System-to-Intermediate System (IS-IS) Interdomain Routing Protocol (IDRP) provides routing between ISs by flooding the network with link-state information. IS-IS provides routing at two levels, intra-area (Level 1) and intra-domain (Level 2). Level 1 routing allows Level 1 ISs to communicate with other Level 1 ISs in the same area. Level 2 routing allows Level 2 ISs to build an interdomain backbone between Level 1 areas by traversing only Level 2 ISs. Level 1 ISs only need to know the path to the nearest Level 2 IS in order to take advantage of the interdomain backbone created by the Level 2 ISs.

The IS-IS protocol uses the SPF routing algorithm to build Level 1 and Level 2 routes. The debug isis spf statistics command provides information for determining the time required to place a Level 1 IS or Level 2 IS on the shortest path tree (SPT) using the IS-IS protocol.

Example:

The following is sample output from the debug isis spf statistics command:

Router# debug isis spf statistics
ISIS-Stats: Compute L1 SPT, Timestamp 2780.328 seconds
ISIS-Stats: Complete L1 SPT, Compute time 0.004, 1 nodes on SPT
ISIS-Stats: Compute L2 SPT, Timestamp 2780.3336 seconds
ISIS-Stats: Complete L2 SPT, Compute time 0.056, 12 nodes on SPT

Misconceptions:

The SPF algorithm is also called the Dijkstra algorithm, after the creator of the algorithm.

Related Commands:

None.


Command:

debug isis spf-events

Mode:

Router#

Syntax:

debug isis spf-events

no debug isis spf-events

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display a log of significant events during an Intermediate System-to-Intermediate System (IS-IS) shortest-path first (SPF) computation, use the debug isis spf-events command in privileged EXEC mode. To disable debugging output, use the no form of this command.

This command displays information about significant events that occur during SPF-related processing.

Example:

The following example displays significant events during an IS-IS SPF computation:

Router# debug isis spf-events
ISIS-Spf: Compute L2 IPv6 SPT
ISIS-Spf: Move 0000.0000.1111.00-00 to PATHS, metric 0
ISIS-Spf: Add 0000.0000.2222.01-00 to TENT, metric 10
ISIS-Spf: Move 0000.0000.2222.01-00 to PATHS, metric 10
ISIS-Spf: considering adj to 0000.0000.2222 (Ethernet3/1) metric 10, level 2, circuit 3, adj 3
ISIS-Spf: (accepted)
ISIS-Spf: Add 0000.0000.2222.00-00 to TENT, metric 10
ISIS-Spf: Next hop 0000.0000.2222 (Ethernet3/1)
ISIS-Spf: Move 0000.0000.2222.00-00 to PATHS, metric 10
ISIS-Spf: Add 0000.0000.2222.02-00 to TENT, metric 20
ISIS-Spf: Next hop 0000.0000.2222 (Ethernet3/1)
ISIS-Spf: Move 0000.0000.2222.02-00 to PATHS, metric 20
ISIS-Spf: Add 0000.0000.3333.00-00 to TENT, metric 20
ISIS-Spf: Next hop 0000.0000.2222 (Ethernet3/1)
ISIS-Spf: Move 0000.0000.3333.00-00 to PATHS, metric 20

Misconceptions:

None.

Related Commands:

None.


Command:

debug isis update-packets

Mode:

Router#

Syntax:

debug isis update-packets

no debug isis update-packets

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display various sequence number protocol data units (PDUs) and link-state packets that are detected by a router, use the debug isis update-packets privileged EXEC command. The no form of this command disables debugging output.

Example:

This router has been configured for IS-IS routing. The following is sample output from the debug isis update-packets command:

Router# debug isis update-packets
ISIS-Update: Sending L1 CSNP on Ethernet0
ISIS-Update: Sending L2 CSNP on Ethernet0
ISIS-Update: Updating L2 LSP
ISIS-Update: Delete link 888.8800.0181.00 from L2 LSP 1600.8906.4022.00-00, seq E
ISIS-Update: Updating L1 LSP
ISIS-Update: Sending L1 CSNP on Ethernet0
ISIS-Update: Sending L2 CSNP on Ethernet0
ISIS-Update: Add link 8888.8800.0181.00 to L2 LSP 1600.8906.4022.00-00, new seq 10,
len 91
ISIS-Update: Sending L2 LSP 1600.8906.4022.00-00, seq 10, ht 1198 on Tunnel0
ISIS-Update: Sending L2 CSNP on Tunnel0
ISIS-Update: Updating L2 LSP
ISIS-Update: Rate limiting L2 LSP 1600.8906.4022.00-00, seq 11 (Tunnel0)
ISIS-Update: Updating L1 LSP
ISIS-Update: Rec L2 LSP 888.8800.0181.00.00-00 (Tunnel0)
ISIS-Update: PSNP entry 1600.8906.4022.00-00, seq 10, ht 1196

Misconceptions:

None.

Related Commands:

None.


Command:

debug ntp

Mode:

Router#

Syntax:

debug ntp {adjust | authentication | events | loopfilter | packets | params | refclock | select | sync | validity}

no debug ntp {adjust | authentication | events | loopfilter | packets | params | refclock | select | sync | validity}

Syntax Description:

adjust | Displays debugging information on NTP clock adjustments.
authentication | Displays debugging information on NTP authentication.
events | Displays debugging information on NTP events.
loopfilter | Displays debugging information on NTP loop filters.
packets | Displays debugging information on NTP packets.
params | Displays debugging information on NTP clock parameters.
refclock | Displays debugging information on NTP reference clocks
select | Displays debugging information on NTP clock selection.
sync | Displays debugging information on NTP clock synchronization.
validity | Displays debugging information on NTP peer clock validity.

Command Description:

To display debug messages for Network Time Protocol (NTP) features, use the debug ntp command. To stop the output of ntp debugging messages, use the no form of this command.

Example:

The following example displays the system output when the debug ntp command is issued:

Switch# debug ntp

Misconceptions:

None

Related Commands:

None


 Command:

debug ppp

Mode:

Router#

Syntax:

debug ppp {packet | negotiation | error | authentication | compression | cbcp}

no debug ppp {packet | negotiation | error | authentication | compression | cbcp}

Syntax Description:

packet

Displays PPP packets being sent and received. (This command displays low-level packet dumps.)

negotiation

Displays PPP packets transmitted during PPP startup, where PPP options are negotiated.

error

Displays protocol errors and error statistics associated with PPP connection negotiation and operation.

authentication

Displays authentication protocol messages, including Challenge Authentication Protocol (CHAP) packet exchanges and Password Authentication Protocol (PAP) exchanges.

compression

Displays information specific to the exchange of PPP connections using MPPC. This command is useful for obtaining incorrect packet sequence number information where MPPC compression is enabled.

cbcp

Displays protocol errors and statistics associated with PPP connection negotiations using MSCB.

Command Description:

Use the debug ppp EXEC command to display information on traffic and exchanges in an internetwork implementing the Point-to-Point Protocol (PPP).

Example:

Router#debug ppp negotiation

The following is sample output from the debug ppp negotiation command. This is a normal
negotiation, where both sides agree on network control program (NCP) parameters. In this
case, protocol type IP is proposed and acknowledged.

ppp: sending CONFREQ, type = 4 (CI_QUALITYTYPE), value = C025/3E8
ppp: sending CONFREQ, type = 5 (CI_MAGICNUMBER), value = 3D56CAC
ppp: received config for type = 4 (QUALITYTYPE) acked
ppp: received config for type = 5 (MAGICNUMBER) value = 3D567F8 acked (ok)
PPP Serial4: state = ACKSENT fsm_rconfack(C021): rcvd id 5
ppp: config ACK received, type = 4 (CI_QUALITYTYPE), value = C025
ppp: config ACK received, type = 5 (CI_MAGICNUMBER), value = 3D56CAC
ppp: ipcp_reqci: returning CONFACK.
 (ok)
PPP Serial4: state = ACKSENT fsm_rconfack(8021): rcvd id 4
Misconceptions:
None

Related Commands:
debug all


Command:

debug snmp packet

Mode:

Router#

Syntax:

debug snmp packet

no debug snmp packet

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information about every SNMP packet sent or received by the router, use the debug snmp packet privileged EXEC command. The no form of this command disables debugging output.

Example:

The following is sample output from the debug snmp packet command. In this example, the router receives a get-next request from the host at 172.16.63.17 and responds with the requested information.

Router# debug snmp packet
SNMP: Packet received via UDP from 172.16.63.17 on Ethernet0
SNMP: Get-next request, reqid 23584, errstat 0, erridx 0
sysUpTime = NULL TYPE/VALUE
system.1 = NULL TYPE/VALUE
system.6 = NULL TYPE/VALUE
SNMP: Response, reqid 23584, errstat 0, erridx 0
sysUpTime.0 = 2217027
system.1.0 = Cisco Internetwork Operating System Software
system.6.0 =
SNMP: Packet sent via UDP to 172.16.63.17

Misconceptions:

None.

Related Commands:

None.


Command:

debug standby

Mode:

Router#

Syntax:

debug standby

no debug standby

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display Hot Standby Protocol state changes, use the debug standby privileged EXEC command. The no form of this command disables debugging output.

The debug standby command displays Hot Standby Protocol state changes and debugging information regarding transmission and receipt of Hot Standby Protocol packets. Use this command to determine whether hot standby routers recognize one another and take the proper actions.

Example:

The following is sample output from the debug standby command:

Router# debug standby
SB: Ethernet0 state Virgin -> Listen
SB: Starting up hot standby process
SB:Ethernet0 Hello in 192.168.72.21 Active pri 90 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Active pri 90 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Active pri 90 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Active pri 90 hel 3 hol 10 ip 192.168.72.29
SB: Ethernet0 state Listen -> Speak
SB:Ethernet0 Hello out 192.168.72.20 Speak pri 100 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Active pri 90 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello out 192.168.72.20 Speak pri 100 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Active pri 90 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello out 192.168.72.20 Speak pri 100 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Active pri 90 hel 3 hol 10 ip 192.168.72.29
SB: Ethernet0 state Speak -> Standby
SB:Ethernet0 Hello out 192.168.72.20 Standby pri 100 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Active pri 90 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello out 192.168.72.20 Standby pri 100 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Active pri 90 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello out 192.168.72.20 Standby pri 100 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Active pri 90 hel 3 hol 10 ip 192.168.72.29
SB: Ethernet0 Coup out 192.168.72.20 Standby pri 100 hel 3 hol 10 ip 192.168.72.29
SB: Ethernet0 state Standby -> Active
SB:Ethernet0 Hello out 192.168.72.20 Active pri 100 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Speak pri 90 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello out 192.168.72.20 Active pri 100 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello in 192.168.72.21 Speak pri 90 hel 3 hol 10 ip 192.168.72.29
SB:Ethernet0 Hello out 192.168.72.20 Active pri 100 hel 3 hol 10 ip 192.168.72.29

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

debug sw-vlan

Mode:

Switch#

Syntax:

debug sw-vlan {badpmcookies | cfg-vlan {bootup | cli} | events | ifs | management | notification | packets | registries | vtp}

no debug sw-vlan {badpmcookies | cfg-vlan {bootup | cli} | events | ifs | management | notification | packets | registries | vtp}

Syntax Description:

badpmcookies

Display VLAN manager incidents of bad port manager cookies.

cfg-vlan bootup

Debug config-vlan messages generated when the switch is booting up.

cfg-vlan cli

Debug messages generated when the CLI is in config-vlan mode.

events

Debug VLAN manager events.

ifs

Debug VLAN manager IOS file system (IFS) error tests.

management

Debug VLAN manager management of internal VLANs.

notification

Debug VLAN manager notifications.

packets

Debug packet handling and encapsulation processes.

registries

Debug VLAN manager registries.

vtp

Debug the VLAN Trunking Protocol (VTP).

Command Description:

Use the debug sw-vlan privileged EXEC command to debug VLAN manager activities. Use the no form of this command to disable debugging output.

The undebug sw-vlan command is the same as the no debug sw-vlan command.

Example:

This is an example of the debug sw-vlan command:

Switch#debug sw-vlan ?
   events                    vlan manager events
   ifs                       vlan manager ifs error tests
   management                vlan manager management of internal vlans
   packets                   vlan manager packets
   vtp                       vtp protocol debugging

Switch#debug sw-vlan events
vlan manager events debugging is on

Misconceptions:

None.

Related Commands:

show debugging

show vlan

show vtp


Command:

debug tftp

Mode:

Router#

Syntax:

debug tftp

no debug tftp

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display Trivial File Transfer Protocol (TFTP) debugging information when encountering problems netbooting or using the copy tftp system:running-config or copy system:running-config tftp commands, use the debug tftp privileged EXEC command. The no form of this command disables debugging output.

Example:

The following is sample output from the debug tftp command from the copy system:running-config tftp EXEC command:

Router# debug tftp
TFTP: msclock 0x292B4; Sending write request (retry 0), socket_id 0x301DA8
TFTP: msclock 0x2A63C; Sending write request (retry 1), socket_id 0x301DA8
TFTP: msclock 0x2A6DC; Received ACK for block 0, socket_id 0x301DA8
TFTP: msclock 0x2A6DC; Received ACK for block 0, socket_id 0x301DA8
TFTP: msclock 0x2A6DC; Sending block 1 (retry 0), socket_id 0x301DA8
TFTP: msclock 0x2A6E4; Received ACK for block 1, socket_id 0x301DA8

Misconceptions:

None.

Related Commands:

None.


 Command:

default-router

Mode:

Router(dhcp-config)#

Syntax:

default-router {hostname | address} [hostname2 | address2 ... Hostname8 | address8]

no default-router

Syntax Description:

address | Describes the IP address of the default router for the DHCP client
hostname | Name of the router for use by DHCP clients

Command Description:

This command specifies the IP address of the default router for a DHCP client. To disable this feature, use the no form of this command.

Example:

This example specifies two addresses for the default router:

Router(dhcp-config)#default-router 192.168.0.1 192.168.0.2

Misconceptions:

None

Related Commands:
ip dhcp pool
host


 Command:

dns-server

Mode:

Router(dhcp-config)#

Syntax:

dns-server {hostname | address} [hostname2 | address2 ... Hostname8 | address8]

no dns-server

Syntax Description:

address | The IP address of the domain name server
hostname | The name of the domain name server

Command Description:

This command specifies the IP address of a DNS server that is available to a DHCP client. To disable this feature, use the no form of this command.

Example:

The following example will define two domain name servers (192.168.0.10, and 10.0.0.20) in a DHCP pool named "house".

Router(config)#ip dhcp pool house
Router(dhcp-config)#dns-server 192.168.0.10 10.0.0.20

Misconceptions:
None

Related Commands:
ip dhcp pool
domain-name


 Command:

domain-name

Mode:

Router(dhcp-config)#

Syntax:

domain-name domain

no domain-name

Syntax Description:
domain The domain name string of the client

Command Description:

This command specifies the domain name for the client. To remove the domain name, use the no form of this command.

Example:

The following example will define the domain name to mydomain.com in a DHCP pool named "house".

Router(config)#ip dhcp pool house
Router(dhcp-config)#domain-name mydomain.com

Misconceptions:

None

Related Commands:
ip dhcp pool
dns-server


 Command:

host

Mode:

Router(dhcp-config)#

Syntax:

host address [mask | prefix-length]

no host

Syntax Description:
address | Specifies the address of the client.
mask | (Optional) Specifies the network mask of the client.
prefix-length | (Optional) Specifies the number of bits that comprise the address prefix. The prefix is an alternative way of specifying the network mask of the client. The prefix length must be preceded by a forward slash (/).

Command Description:

Use this command to specify the IP address and network mask for a manual binding to a DHCP client. To remove the IP address of the client, use the no form of this command.

Example:

The following example specifies 10.12.1.99 as the IP address of the client and 255.255.248.0 as the subnet mask:

Router(dhcp-config)#host 10.12.1.99 255.255.248.0
Misconceptions:
None

Related Commands:
ip dhcp pool
dns-server
domain-name


Command:

ip dhcp excluded-address

Mode:

Router(config)#

Syntax:

ip dhcp excluded-address low-address [high-address]
no ip dhcp excluded-address low-address [high-address]

Syntax Description:

low-address | The excluded IP address, or first IP address in an excluded address range.
high-address | (Optional) The last IP address in the excluded address range.

Command Description:

To specify IP addresses that a Cisco IOS Dynamic Host Configuration Protocol (DHCP) Server should not assign to DHCP clients, use the ip dhcp excluded-address global configuration command. To remove the excluded IP addresses, use the no form of this command.

By default, all IP pool addresses are assignable.

The DHCP Server assumes that all pool addresses may be assigned to clients. Use this command to exclude a single IP address or a range of IP addresses.

Example:

The following example configures an excluded IP address range from 172.16.1.100 through 172.16.1.199:

Router(config)#ip dhcp excluded-address 172.16.1.100 172.16.1.199

Misconceptions:

None

Related Commands:

ip dhcp pool
network (DHCP)


 Command:

ip dhcp pool

Mode:

Router(config)#

Syntax:

ip dhcp pool pool-name

no ip dhcp pool pool-name

Syntax Description:
pool-name  The name of this DHCP pool

Command Description:

To activate the IOS DHCP server and configure pool-specific settings, use the ip dhcp pool command. To remove the address pool, use the no form of this command.

Example:

The following creates a pool named "MyPool1".

Router(config)#ip dhcp pool MyPool1

Misconceptions:
None

Related Commands:
dns-server
domain-name
default-router
lease
netbios-name-server
network (DHCP)


 Command:

lease

Mode:

Router(dhcp-config)#

Syntax:

lease {days [hours][minutes] | infinite}

no lease

Syntax Description:
days | The lease time for the DHCP host in days.
hours | The lease time for the DHCP host in hours.
minutes | The lease time for the DHCP host in minutes.
infinite | Set the lease time to never expire.

Command Description:

To change the lease value for an IP address, use the lease command. To restore the default value, use the no form of this command.

Example:

This example configures a DHCP lease for 3 days, 2 hours and 1 minute:

Router(dhcp-config)#lease 3 2 1

To configure a 3 hour lease, enter the following:

Router(dhcp-config)#lease 0 3

Misconceptions:
None

Related Commands:
ip dhcp pool


 Command:

netbios-name-server

Mode:

Router(dhcp-config)#

Syntax:

netbios-name-server {hostname | address} [hostname2 | address2 ... Hostname8 | address8]

no netbios-name-server

Syntax Description:

address(n) | The IP address(es) of the netbios name server(s).
hostname | The name of the netbios-name-server.

Command Description:

This command specifies the IP address of a netbios name-server that is available to a DHCP client. One IP address is required; however, you can specify up to eight IP addresses in one command line. To remove the NetBIOS name server list, use the no form of this command.

Example:

The following example will define a two netbios name server in a DHCP pool named "house". The first is at 192.168.0.10 and the second is at 10.0.0.20.

Router(config)#ip dhcp pool house
Router(dhcp-config)#netbios-name-server 192.168.0.10 10.0.0.20
Misconceptions:
None

Related Commands:
ip dhcp pool
dns-server
domain-name


 Command:

network (DHCP)

Mode:

Router(dhcp-config)#

Syntax:

network network-number [mask | /prefix-length]

no network

Syntax Description:

network-number | Specify the network address for the DHCP pool
mask | Specify the subnet mask of the DHCP pool in dotted decimal notation
prefix-length | Specify the subnet mask in prefix-length notation

Command Description:

Specifies the subnet network number and mask of the DHCP address pool.

Example:

The following example will define a range of addresses from 192.168.0.0 through 192.168.0.255 in a DHCP pool named "house".

Router(config)#ip dhcp pool house

Router(dhcp-config)#network 192.168.0.0 255.255.255.0

Misconceptions:

None

Related Commands:

None


Command:

service dhcp

Mode:

Router(config)#

Syntax:

service dhcp
no service dhcp

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the Cisco IOS Dynamic Host Configuration Protocol (DHCP) server and relay agent features on your router, use the service dhcp global configuration command. To disable the Cisco IOS DHCP server and relay agent features, use the no form of this command.

This command is enabled by default.

Example:

The following example enables DHCP services on the DHCP Server:

Router(config)#service dhcp

Misconceptions:

None

Related Commands:

None


Command:

show dhcp

Mode:

Router#

Syntax:

show dhcp {server | lease [interface async [number]]}

Syntax Description:

server | Displays known DHCP servers.
lease | Displays DHCP addresses leased from a server.
interface async number | (Optional) Specifies asynchronous interfaces and, optionally, a specific interface number.

Command Description:

To display the current Dynamic Host Configuration Protocol (DHCP) settings on point-to-point interfaces, use the show dhcp command in privileged EXEC mode.

If you omit the optional argument, the show dhcp command displays information about all interfaces.

You can use this command on any point-to-point type of interface (for example, serial, ISDN, and asynchronous) that uses DHCP for temporary IP address allocation.

Example:

The following is sample output from the show dhcp server command:

Router# show dhcp server
IP address pooling for Point to Point clients is: DHCP Proxy Client
DHCP Proxy Client Status:
DHCP server: ANY (255.255.255.255)
Leases: 0
Offers: 0 Requests: 0 Acks: 0 Naks: 0
Declines: 0 Releases: 0 Bad: 0

Misconceptions:

None.

Related Commands:

ip address-pool

ip dhcp-server

peer default ip address

© Cisco Systems, Inc. 2001, 2002


 Command:

show ip dhcp

Mode:

Router>

Syntax:

show ip dhcp { binding [address] | conflict [address] | database [url] | server statistics }

Syntax Description:
conflict | Displays a list of all address conflicts recorded by a specific DHCP server
binding | Displays a list of all bindings created on a specific DHCP server
database | Displays recent activity on the DHCP database
server statistics | Displays count information about server statistics and messages sent and received
url (Optional) Specifies the remote file used to store automatic DHCP bindings. Following are the acceptable URL file formats:
  • tftp://host/filename

  • ftp://user:password@host/filename

  • rcp://user@host/filename
address | The address of the DHCP server.

Command Description:

This command is used to display DHCP server information from EXEC mode.

Example:

The following will display the DHCP server statics:

Router#show ip dhcp server statistics

Misconceptions:
None

Related commands:
None


%command%

Command:

dialer callback-server

Mode:

Router(config-if)#

Syntax:

dialer callback-server [username | dialstring]

no dialer callback-server

Syntax Description:

username | (Optional) Looks up the authenticated host name in a dialer map command. This is the default.
dialstring | (Optional) Identifies the return call during callback negotiation.

Command Description:

To enable an interface to make return calls when callback is successfully negotiated, use the dialer callback-server command in interface configuration mode. To disable return calls, use the no form of this command.

Example:

The following partial example configures BRI 0 to function as the callback server on the shared network:

interface BRI0

ip address 172.19.1.9 255.255.255.0

encapsulation ppp

dialer callback-secure

dialer enable-timeout 2

dialer map ip 172.19.1.8 name atlanta class dial1 81012345678901

dialer-group 1

ppp callback accept

ppp authentication chap

!

map-class dialer dial1

dialer callback-server username

Misconceptions:

None

Related commands:

dialer callback-secure
dialer map
ppp callback

© Cisco Systems, Inc. 2001, 2002


 Command:

dialer idle-timeout

Mode:

Router(config-if)#

Syntax:

dialer idle-timeout seconds [inbound | either]

no dialer idle-timeout

Syntax Description:

seconds | Idle time, in seconds, that must occur on the interface before the line is disconnected. Acceptable values are positive, nonzero integers.
inbound | (Optional) Only inbound traffic will reset the idle timeout.
either | (Optional) Both inbound and outbound traffic will reset the idle timeout.

Command Description:

The dialer idle-timeout interface configuration command specifies the amount of idle time (in seconds) before the line is disconnected. Use the no dialer idle-timeout command to reset the idle timeout to the default value of 120 seconds.

Example:

The following example specifies of an idle timeout of 3 minutes (180 seconds) on asynchronous interface 1. Because the inbound keyword is included, only inbound traffic that matches the dialer group will reset the idle timer.

Router(config)#interface async 1
Router(config-if)#dialer idle-timeout 180 inbound

Misconceptions:
None

Related Commands:
dialer wait-for-carrier-time
dialer fast-idle


 Command:

dialer pool

Mode:

Router(config-if)#

Syntax:

dialer pool number

no dialer pool number

Syntax Description:

number

Dialing pool number, in the range 1 through 255.

Command Description:

To specify, for a dialer interface, which dialing pool to use to connect to a specific destination subnetwork, use the dialer pool interface configuration command.

This command applies to dialer interfaces only.

Example:

The following example shows a dialer interface configuration that is linked to the physical interface configuration shown for BRI 1 in the dialer pool-member command section. Dialer interface 1 uses dialer pool 3, of which BRI 1 is a member.

This is a dialer profile for reaching remote subnetwork 1.1.1.1.

Router(config)#interface Dialer1
Router(config-if)#ip address 1.1.1.1 255.255.255.0
Router(config-if)#encapsulation ppp
Router(config-if)#dialer remote-name Smalluser
Router(config-if)#dialer string 4540
Router(config-if)#dialer pool 3
Router(config-if)#dialer-group 1

The following example might accompany the previous dialer profile configuration example. Physical interface BRI 1 has a reserved channel in dialer pool 3. That channel is inactive until BRI 1 uses it to place calls.
Router(config)#interface BRI1
Router(config-if)#encapsulation ppp
Router(config-if)#dialer pool-member 1 priority 50
Router(config-if)#dialer pool-member 2 priority 50
Router(config-if)#dialer pool-member 3 min-link 1
Router(config-if)#ppp authentication chap

Misconceptions:
None

Related Commands:
dialer pool-member


 Command:

dialer pool-member

Mode:

Router(config-if)#

Syntax:

dialer pool-member number [priority priority] [min-link minimum] [max-link maximum]

no dialer pool-member

Syntax Description:

number

Dialing pool number, in the range 1 through 255.

priority priority

(Optional) Priority of this interface within the dialing pool, in the range 0 (lowest) to 255 (highest). Interfaces with the highest priority are selected first for dialing out. Default is 0.

min-link minimum

(Optional) Minimum number of B channels on this interface that are reserved for this dialing pool, in the range 0 to 255. Default is 0. A reserved channel is inactive until the specified interface uses it to place calls. Applies to ISDN interfaces only.

max-link maximum

(Optional) Maximum number of B channels on this interface that can be used by this dialing pool, in the range 0 to 255. Default is 255. Applies to ISDN interfaces only.

Command Description:

To configure a physical interface to be a member of a Dialer Profiles dialing pool, use the dialer pool-member interface configuration command.

Example:

The following example shows the configuration of one ISDN BRI interface to be a member of dialer pool 2 with priority 100:

Router(config)#interface bri 2
Router(config-if)#encapsulation ppp
Router(config-if)#dialer pool-member 2 priority 100
Router(config-if)#ppp authentication chap
In the following example, BRI physical interface configuration BRI 1 has a reserved channel in dialer pool 3. That channel is inactive until BRI 1 uses it to place calls.
Router(config)#interface bri 1
Router(config-if)#encapsulation ppp
Router(config-if)#dialer pool-member 1 priority 50
Router(config-if)#dialer pool-member 2 priority 50
Router(config-if)#dialer pool-member 3 min-link 1
Router(config-if)#ppp authentication chap
Misconceptions:
None

Related Commands:
dialer pool


 Command:

dialer priority

Mode:

Router(config-if)#

Syntax:

dialer priority number

no dialer priority

Syntax Description:

number

Priority of an interface in a dialer rotary group; the highest number indicates the highest priority. This is a number from 0 through 255. The default value is 0, the lowest priority.

Command Description:

To set the priority of an interface in a dialer rotary group, use the dialer priority interface configuration command. Use the no form of the command to revert to the default setting.This command is meaningful only for interfaces that are part of dialer rotary groups.

The value 0 indicates the lowest priority, and 255 indicates the highest priority. The dialer priority command controls which interfaces within a dialer rotary group will be used first. Higher priority interfaces (configured with higher n value) are used first.

The dialer priority command gives you the ability to tell the dialer rotary group which free interface (and, by extension for asynchronous interfaces, which modem) to use first. This command applies to outgoing calls only.

For example, a router or access server might have a selection of many modems, some of which are better performers than others. You might have a 19.2-kbps, two 4800-bps, three 1200-bps, and one 300-bps modem on interfaces in one dialer rotary group. You do not want the router or access server to make the call on the 300 bps modem if any of the faster modems are free. You want to use the highest-performance modems first, and the slowest modems last.

Example:

In the following example, asynchronous interface 3 will be used after interfaces with higher priority and before interfaces with lower priority:

Router(config)#interface async 3

Router(config-if)#dialer priority 5

Misconceptions:
None

Related Commands:
interface dialer
dialer rotary-group


 Command:

dialer remote-name

Mode:

Router(config-if)#

Syntax:

dialer remote-name username

no dialer remote-name username

Syntax Description:

username

Case-sensitive character string identifying the remote device; maximum length is 255 characters.

Command Description:

Use the dialer remote-name interface configuration command to specify the authentication name of the remote router on the destination subnetwork.

Example:

The following example sets the name of the remote host to dallas:

Router(config-if)#dialer remote-name dallas

Misconceptions:

None

Related Commands:
ppp authentication


 Command:

dialer rotary-group

Mode:

Router(config-if)#

Syntax:

dialer rotary-group number

no dialer rotary-group number

Syntax Description:

number

Number of the previously defined dialer interface in whose rotary group this interface is to be included. This is a number from 0 to 255. The dialer interface is defined by the interface dialer command.

Command Description:

To include a specified interface in a dialer rotary group, use the dialer rotary-group interface configuration command.

Usage Guidelines:

Dialer rotary groups allow you to apply a single interface configuration to a set of physical interfaces. This allows a group of interfaces to be used as a pool of interfaces for calling many destinations.

Once the interface configuration is propagated to a set of interfaces, those interfaces can be used to place calls using the standard DDR criteria. When multiple destinations are configured, any of these interfaces can be used for outgoing calls.

Dialer rotary groups are useful in environments that require multiple calling destinations. Only the rotary group needs to be configured with the dialer map commands. The only configuration required for the interfaces is the dialer rotary-group command indicating that each interface is part of a dialer rotary group.

Although a dialer rotary group is configured as an interface, it is not a physical interface. Instead, it represents a group of interfaces. Interface configuration commands entered after the interface dialer command will be applied to all physical interfaces assigned to specified rotary groups. Individual interfaces in a dialer rotary group do not have individual addresses. The dialer interface has a protocol address, and that address is used by all interfaces in the dialer rotary group.

Example:

The following example identifies interface dialer 1 as the dialer rotary group leader. Interface dialer 1 is not a physical interface, but represents a group of interfaces. The interface configuration commands that follow apply to all interfaces included in this group. The first dialer map command allows the central site and remote site YYY to call each other and allows the central site to authenticate site YYY when it calls in. The second dialer map command, with no dialer string, allows the central site to authenticate remote site ZZZ when it calls in, but the central site cannot call remote site ZZZ (no phone number).

Router(config)#interface dialer 1
Router(config-if)#encapsulation ppp
Router(config-if)#authentication chap
Router(config-if)#dialer in-band
Router(config-if)#ip address 1.2.3.4
Router(config-if)#dialer map ip 131.108.2.5 name YYY 14155553434
Router(config-if)#dialer map ip 131.126.4.5 name ZZZ
Router(config)#interface bri 0
Router(config-if)#dialer rotary-group 1
Router(config)#interface bri 1
Router(config-if)#interface rotary-group 1

Misconceptions:

None

Related Commands:
interface dialer


 Command:

dialer string

Mode:

Router(config-if)#

Syntax:

dialer string dial-string [class class-name]

no dialer string

Syntax Description:

dial-string

Telephone number to be sent to a DCE device.

class class-name

(Optional) Dialer map class associated with this telephone number.

Command Description:

To specify the string (telephone number) to be used when placing a call from an interface, use the dialer string interface configuration command. Use the no form of this command to delete the telephone number specified for the interface.

Usage Guidelines

When you use Dialer Profiles for DDR, use the dialer string class form of this command to define a map class for a specific dialer profile.

Dialer Profiles make it unnecessary to use dialer maps to configure DDR.

If a dialer string command is specified without a dialer-group command with access lists defined, dialing is never initiated. If the debug dialer command is enabled, an error message is displayed indicating that dialing never will occur.

Example:

The following example specifies that the dial string 4159991234 be used in calls to destinations defined by the map class sf:

Router(config-if)#dialer string 4159991234 class sf

Misconceptions:
None

Related Commands:
dialer wait-for-carrier-time
interface dialer


 Command:

dialer wait-for-carrier-time

Mode:

Router(config-if)#

Syntax:

dialer wait-for-carrier-time seconds

no dialer wait-for-carrier-time

Syntax Description:
seconds

Number of seconds that the interface waits for the carrier to come up when a call is placed. Acceptable values are positive, nonzero integers. The default is 30 seconds.

Command Description:

To specify the length of time to wait for a carrier when dialing out to the dial string associated with a specified map class, use the dialer wait-for-carrier-time map-class dialer configuration command. Use the no form of this command to reset the carrier wait time value to the default.

Usage Guidelines

You can define different dialer map classes with different wait-for-carrier times to suit the different types of lines and interfaces. For example, you must define a longer wait time for a map class used by serial interfaces than for one used by ISDN interfaces.

Example:

The following example specifies a carrier wait time of 20 seconds for the Eng class on the Dialer2 interface:

Router(config)#interface Dialer2
Router(config-if)#ip address 2.2.2.2 255.255.255.0
Router(config-if)#encapsulation ppp
Router(config-if)#dialer remote-name Mediumuser
Router(config-if)#dialer string 5264540 class Eng
Router(config-if)#dialer wait-for-carrier-time 20
Router(config-if)#dialer load-threshold 50 either
Router(config-if)#dialer pool 1
Router(config-if)#dialer-group 2

Misconceptions:
None

Related Commands:
None


Command:

dialer-group

Mode:

Router(config-if)#

Syntax:

dialer-group group-number

no dialer-group

Syntax Description:

group-number

This specifies the number of the dialer access group to which the specific interface belongs. This access group is defined with the dialer-list command. Acceptable values are nonzero, positive integers between 1 and 10.

Command Description:

To control access by configuring an interface to belong to a specific dialing group, use the dialer-group command in interface configuration mode. Use the no form of this command to remove an interface from the specified dialer access group.

Example:

The following example specifies dialer access group number 1. The destination address of the packet is evaluated against the access list specified in the associated dialer-list command. If it passes, either a call is initiated (if no connection has already been established) or the idle timer is reset (if a call is currently connected).

  Router(config)#interface async 1
  Router(config-if)#dialer-group 1
  Router(config-if)#exit
  Router(config)#access-list 101 deny igrp 0.0.0.0 255.255.255.255 255.255.255.255 0.0.0.0
  Router(config)#access-list 101 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
  Router(config)#dialer-list 1 protocol ip list 101

Misconceptions:

None

Related Commands:

dialer-list protocol


 Command:

interface dialer

Mode:

Router(config)#

Syntax:

interface dialer number

Syntax Description:

number

Number of the dialer rotary group. It can be number in the range 0 through 255.

Command Description:

To define a dialer rotary group, use the interface dialer global configuration command.

This command first appeared in Cisco IOS Release 10.0.

Dialer rotary groups allow you to apply a single interface configuration to a set of physical interfaces. This allows a group of interfaces to be used as a pool of interfaces for calling many destinations.

Once the interface configuration is propagated to a set of interfaces, those interfaces can be used to place calls using the standard DDR criteria. When multiple destinations are configured, any of these interfaces can be used for outgoing calls.

Dialer rotary groups are useful in environments that require multiple calling destinations. Only the rotary group needs to be configured with the dialer map commands. The only configuration required for the interfaces is the dialer rotary-group command indicating that each interface is part of a dialer rotary group.

Although a dialer rotary group is configured as an interface, it is not a physical interface. Instead, it represents a group of interfaces. Interface configuration commands entered after the interface dialer command will be applied to all physical interfaces assigned to specified rotary groups. Individual interfaces in a dialer rotary group do not have individual addresses. The dialer interface has a protocol address, and that address is used by all interfaces in the dialer rotary group.

Example:

The following example identifies interface dialer 1 as the dialer rotary group leader. Interface dialer 1 is not a physical interface, but represents a group of interfaces. The interface configuratin commands that follow apply to all interfaces included in this group.

Router(config)#interface dialer 1
Router(config-if)#encapsulation ppp
Router(config-if)#authentication chap
Router(config-if)#dialer in-band ip address 1.2.3.4
Router(config-if)#dialer map ip 1.2.2.5 name YYY 14155553434
Router(config-if)#dialer map ip 1.3.2.6 name ZZZ

Misconceptions:
None

Related Commands:
None


 Command:

interface group-async

Mode:

Router(config)#

Syntax:

interface group-async unit-number

no interface group-async unit-number

Syntax Description:

unit-number

The number of the asynchronous group interface being created.

Command Description:

To create a group interface that will serve as master, to which asynchronous interfaces can be associated as members, use the interface group-async global configuration command. Use the no form of the command to restore the default.

Using the interface group-async command, you create a single asynchronous interface to which other interfaces are associated as members using the group-range command. This one-to-many configuration allows you to configure all associated member interfaces by entering one command on the group master interface, rather than entering this command on each individual interface. You can create multiple group masters on a device. However, each member interface can only be associated with one group.

Example:

The following example defines asynchronous group master interface 0:

Router(config)#interface group-async 0

Misconceptions:
None

Related Commands:
group-range


 Command:

isdn incoming-voice modem

Mode:

Router(config-if)#

Syntax:

isdn incoming-voice {voice | data [56 | 64] | modem [56 | 64]}

no isdn incoming-voice {voice | data [56 | 64] | modem [56 | 64]}

Syntax Description:
voice | Incoming voice calls bypass the modems and will be handled as a voice call.
data | Incoming voice calls bypass the modems and will be handled as digital data. If this keyword is selected, you can specify a B-channel bandwidth of either 56 kbps or 64 kbps. If no argument is entered, the default value is 64.
modem | Incoming voice calls are passed over to the digital modems, where they negotiate the appropriate modem connection with the far-end modem. If this keyword is selected, you can specify a B-channel bandwidth of either 56 kbps or 64 kbps. If no argument is entered, the default value is 64.

Command Description:

To allow all incoming ISDN voice calls to access onboard modems, use the isdn incoming-voice modem interface configuration command. Use the no form of this command to stop all incoming voice calls from accessing the modems.

Usage Guidelines

Configure this command on each D channel in the access server or router. Incoming circuit switched data calls are not affected by this command.

This command is not used for channelized T1 or channelized E1 network scenarios. These networks use traditional analog trunks that have in-band signaling. Use the isdn incoming-voice modem command only when you are using ISDN.

Example:

The following example enables incoming and outgoing ISDN calls to route to the modems using the D channel serial interface:

Router(config)#interface serial 0:23
Router(config-if)#isdn incoming-voice modem

Misconceptions:
None

Related Commands:
None


 Command:

map-class dialer

Mode:

Router(config)#

Syntax:

map-class dialer classname

Syntax Description:

classname

Unique class identifier.

Command Description:

To define a class of shared configuration parameters for outgoing calls from an ISDN interface, use the map-class dialer global configuration command.

This command first appeared in Cisco IOS Release 11.0.

The classname in the map-class dialer command used to specify the class must be the same as a classname used in a dialer map command.

This command is used to define classes of calls for PPP callback for DDR, for ISDN Advice of Charge, and for Network Specific Facilities (NSF) call-by-call dialing plans.

For NSF call-by-call support on ISDN Primary-4ESS switches only, use one of the dialing-plan keywords listed in the table below.

Table: NSF Keywords and Supported Services
Keyword NSF Dialing Plan Data Voice International

sdnplan

SDN

Yes

Yes

GSDN (Global SDN)

megaplan

MEGACOMM

No

Yes

Yes

accuplan

ACCUNET

Yes

Yes

Yes

Example:

The following example configures the PPP callback server on an ISDN BRI interface on a router in Atlanta. The callback server requires an enable timeout and a map class to be defined.

Router(config)#interface BRI0
Router(config-if)#ip address 7.1.1.7 255.255.255.0
Router(config-if)#encapsulation ppp
Router(config-if)#dialer callback-secure
Router(config-if)#dialer enable-timeout 2
Router(config-if)#dialer map ip 7.1.1.8 name atlanta class dial1 81012345678901
Router(config-if)#dialer-group 1
Router(config-if)#ppp callback accept
Router(config-if)#ppp authentication chap
Router(config)#map-class dialer dial1
Router(config-map-class)#dialer callback-server  username

The following example configures the ISDN switch type to Primary-4ESS and configures ISDN PRI on T1 controller 1/0, and sets the D channel for dialer map classes that reference the NSF dialing plans. Finally, the map-class dialer command uses a dialing plan keyword and the dialer outgoing command refers to the same plan.

Router(config)#isdn switch-type primary-4ess
Router(config)#controller T1  1/0
Router(config-controller)#framing esf
Router(config-controller)#linecode b8zs
Router(config-controller)#pri-group timeslots 1-24
Router(config)#interface Serial 1/0:23
Router(config-if)#description
  This is the DMS D-channel 415-390-9503
Router(config-if)#ip address 6.1.1.3 255.255.255.0
Router(config-if)#encapsulation ppp
Router(config-if)#no keepalive
Router(config-if)#dialer map ip 6.1.1.1 name tommyjohn class sdnplan 14085770715
Router(config-if)#dialer map ip 6.1.1.2 name angus class megaplan 14085773775
Router(config-if)#dialer map ip 6.1.1.4 name angus class accuplan 14085773778
Router(config-if)#dialer-group 1
Router(config-if)#ppp authentication chap
Router(config)#map-class dialer sdnplan
Router(config-map-class)#dialer outgoing sdn
Router(config)#map-class dialer megaplan
Router(config-map-class)#dialer voice-call
Router(config-map-class)#dialer outgoing megacomm
Router(config)#map-class dialer accuplan
Router(config-map-class)#dialer outgoing accunet

The following example configures a map class called "hawaii" and sets an ISDN speed of 56 kbps for the class.

Router(config)#map-class dialer hawaii
Router(config-map-class)#isdn speed 56

The following example configures BRI 0 to function as the callback server on the shared network. The callback server requires an enable timeout and a map class to be defined.

Router(config)#interface bri 0
Router(config-if)#ip address 10.2.1.7 255.255.255.0
Router(config-if)#encapsulation ppp
Router(config-if)#dialer callback-secure
Router(config-if)#dialer enable-timeout 2
Router(config-if)#dialer map ip  10.2.1.8 name atlanta class dial1 81012345678901
Router(config-if)#dialer-group 1
Router(config-if)#ppp callback accept
Router(config-if)#ppp authentication chap
Router(config)#map-class dialer dial1
Router(config-map-class)#dialer callback-server username

Misconceptions:
None

Related Commands:
None


 Command:

show dialer

Mode:

Router#

Syntax:

show dialer [interface type number]

Syntax Description:
interface Displays information for the interface specified by the arguments type and number

Command Description:

To display general diagnostic information for interfaces configured for DDR (dial-on-demand routing), use the show dialer command in EXEC mode.

Example:
The following is an output example from the show dialer command for a BRI interface when dialer profiles are configured:
Router#show dialer interface bri 0
BRI0 - dialer type = ISDN
Dial String      Successes   Failures    Last called   Last status
0 incoming call(s) have been screened.
BRI0: B-Channel 1
Idle timer (120 secs), Fast idle timer (20 secs)
Wait for carrier (30 secs), Re-enable (15 secs)
Dialer state is data link layer up
Dial reason: ip (s=6.1.1.8, d=6.1.1.1)
Interface bound to profile Dialer0
Time until disconnect 102 secs
Current call connected 00:00:19
Connected to 5773872 (wolfman)
BRI0: B-Channel 2
Idle timer (120 secs), Fast idle timer (20 secs)
Wait for carrier (30 secs), Re-enable (15 secs)
Dialer state is idle

The following table describes significant fields shown in the display:

Table: Show Dialer Interface BRI Field Descriptions
Field Description

BRI0 - dialer type = ISDN

ISDN dialer.

Dial string

Dial strings of logged calls (telephone numbers). On ISDN BRI interfaces, if you have specified a subaddress number in the dialer string, this number is included in the dial string after a colon.

Successes

Successful connections (even if no data is passed).

Failures

Failed connections; call not successfully completed.

Last called

Time that last call occurred to specific dial string.

Last status

Status of last call to specific dial string (successful or failed).

0 incoming call(s) have been screened.

Number of calls subjected to Dialer Profiles screening to determine how the call is to be treated.

BRI0: B-Channel 1

Header indicating the following data is for B channel 1.

Idle timer (120 secs), Fast idle timer (20 secs)

Settings (in seconds) for the idle timer and the fast idle timer.

Wait for carrier (30 secs), Re-enable (15 secs)

Settings (in seconds) for the wait for carrier timer and the reenable timer.

Dialer state is data link layer up

The message "data link layer up" suggests that the dialer came up properly, if it says anything else then dialer did not come up properly. The message "physical layer up" means the line protocol (LCP) came up, but the NCP did not come up. The show interfaces command also provides the similar information.

Dial reason: ip (s=6.1.1.8, d=6.1.1.1)

What initiated the dial, namely an IP packet, plus source and destination address in the packet.

Interface bound to profile Dialer0

Dialer profile that is bound to this interface or B channel.

Time until disconnect

Time until line is configured to disconnect. This field is displayed if the interface is currently connected to a destination.

Current call connected

Time at which the current call was connected.

Connected to

Dial string to which line is currently connected.

Misconceptions:

None

Related Commands:
debug isdn


Command:

default-metric (Enhanced IGRP)

Mode:

Router(config-router)#

Syntax:

default-metric bandwidth delay reliability loading mtu
no default-metric bandwidth delay reliability loading mtu

Syntax Description:

bandwidth | Minimum bandwidth of the route in kbps. It can be 0 or any positive integer.
delay | Route delay (in tens of microseconds). It can be 0 or any positive number that is a multiple of 39.1 nanoseconds.
reliability | Likelihood of successful packet transmission expressed as a number from 0 to 255. The value 255 means 100 percent reliability; 0 means no reliability.
loading | Effective bandwidth of the route expressed as a number from 0 to 255 (255 is 100 percent loading).
mtu | Maximum transmission unit (MTU) size of the route in bytes. It can be 0 or any positive integer.

Command Description:

To set metrics for IGRP or Enhanced IGRP (EIGRP), use the default-metric command in router configuration mode. To remove the metric value and restore the default state, use the no form of this command.

A default metric is required to redistribute a protocol into IGRP or EIGRP, unless you use the redistribute command. Automatic metric translations occur between IGRP and EIGRP. You do not need default metrics to redistributed IGRP or EIGRP into itself.

Metric defaults have been carefully set to work for a wide variety of networks. Take great care when changing these values.

Keeping the same metrics is supported only when redistributing from IGRP, EIGRP, or static routes.

By default, only connected routes and interface static routes can be redistributed without a default metric.

Example:

The following example takes redistributed Routing Information Protocol (RIP) metrics and translates them into IGRP metrics with values as follows: bandwidth = 1000, delay = 100, reliability = 250, loading = 100, and MTU = 1500.

Router(config)# router igrp 109
Router(config-router)# network 172.16.0.0
Router(config-router)# redistribute rip
Router(config-router)# default-metric 1000 100 250 100 1500

Misconceptions:

The default metric command does not affect EIGRP-to-EIGRP or IGRP-to-EIGRP distribution. To configure EIGRP-to-EIGRP or IGRP-to-EIGRP distribution, use route maps.

Related Commands:

None


Command:

distance bgp

Mode:

Router(config-router)#

Syntax:

distance eigrp internal-distance external-distance
no distance eigrp

Syntax Description:

internal-distance | Administrative distance for Enhanced IGRP (EIGRP) internal routes. Internal routes are those that are learned from another entity within the same autonomous system. The distance can be a value from 1 to 255.
external-distance | Administrative distance for EIGRP external routes. External routes are those for which the best path is learned from a neighbor external to the autonomous system. The distance can be a value from 1 to 255.

Command Description:

To allow the use of two administrative distances--internal and external--that could be a better route to a node, use the distance eigrp command in router configuration mode. To reset these values to their defaults, use the no form of this command.

Defaults:

internal-distance: 90

external-distance: 170

An administrative distance is a rating of the trustworthiness of a routing information source, such as an individual router or a group of routers. Numerically, an administrative distance is an integer from 0 to 255. In general, the higher the value, the lower the trust rating. An administrative distance of 255 means the routing information source cannot be trusted at all and should be ignored.

Use the distance eigrp command if another protocol is known to be able to provide a better route to a node than was actually learned via external EIGRP, or if some internal routes should really be preferred by EIGRP.

The following table lists the default administrative distances
Route Source | Default Distance
Conected interface | 0
Static route | 1
Enhanced IGRP summary route | 5
External BGP | 20
Internal Enhanced IGRP | 90
IGRP | 100
Open Shortest Path First (OSPF) | 110
Intermediate System-to-Intermediate System (IS-IS) | 115
Routing Information Protocol (RIP) | 120
Exterior Gateway Protocol (EGP) | 140
EIGRP external route | 170
Internal Border Gateway Protocol (BGP) | 200
Unknown | 255

To display the default administrative distance for a specified routing process, use the show ip protocols EXEC command.

Example:

In the following example, the router eigrp global configuration command sets up Enhanced IGRP routing in autonomous system number 109. The network router configuration commands specify Enhanced IGRP routing on networks 192.168.7.0 and 172.16.0.0. The distance eigrp command sets the administrative distance of all EIGRP internal routes to 80 and all EIGRP external routes to 130.

Router(config)#router eigrp 109
Router(router-config)#network 192.168.7.0
Router(router-config)#network 172.16.0.0
Router(router-config)#distance eigrp 80 130

Misconceptions:

You cannot set the administrative distance in EIGRP against certain routes or sources, as you can with other protocols. The command does not work this way with EIGRP.

Related Commands:

show ip protocols


Command:

eigrp log-neighbor-changes

Mode:

Router(config-router)#

Syntax

eigrp log-neighbor-changes

no eigrp log-neighbor-changes

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the logging of changes in EIGRP neighbor adjacencies, use the eigrp log-neighbor-changes router interface configuration command.

Example:

The following configuration will log neighbor changes for EIGRP process 209:

Router(config)#router eigrp 209
Router(config-router)#eigrp log-neighbor-changes

Misconceptions:
None

Related Commands:
None


Command:

eigrp log-neighbor-warnings

Mode:

Router(config-router)#

Syntax:

eigrp log-neighbor-warnings [seconds]
no eigrp log-neighbor-warnings

Syntax Description:

seconds (Optional) The time interval (in seconds) between repeated neighbor warning messages. The range of seconds is from 1 to 65535.

Command Description:

To enable the logging of Enhanced IGRP (EIGRP) neighbor warning messages, use the eigrp log-neighbor-warnings command in router configuration mode. To disable the logging of EIGRP neighbor warning messages, use the no form of this command.

Default: Neighbor warning messages are logged.

When neighbor warning messages occur, they are logged by default. With this command, you can disable and enable neighbor warning messages, and configure the interval between repeated neighbor warning messages.

Example:

The following command will log neighbor warning messages for EIGRP process 209 and repeat the warning messages in 5-minute (300 seconds) intervals:

Router(config)#router eigrp 209
Router(config-router)#eigrp log-neighbor-warnings 300

Misconceptions:

None

Related Commands:

None


Command:

eigrp stub

Mode:

Router(config-router)#

Syntax:

eigrp stub [receive-only | connected | static | summary]
no eigrp stub [receive-only | connected | static | summary]

Syntax Description:

receive-only | (Optional) Sets the router as a receive-only neighbor.
connected | (Optional) Advertises connected routes.
static | (Optional) Advertises static routes.
summary | (Optional) Advertises summary routes.

Command Description:

To configure a router as a stub using Enhanced IGRP (EIGRP), use the eigrp stub command in router configuration mode. To disable the EIGRP stub routing feature, use the no form of this command.

Stub routing is not enabled by default.

Use the eigrp stub command to configure a router as a stub where the router directs all IP traffic to a distribution router.

The eigrp stub command can be modified with several options, and these options can be used in any combination except for the receive-only keyword. The receive-only keyword will restrict the router from sharing any of its routes with any other router in that EIGRP autonomous system, and the receive-only keyword will not permit any other option to be specified because it prevents any type of route from being sent. The three other optional keywords (connected, static, and summary) can be used in any combination but cannot be used with the receive-only keyword. If any of these three keywords is used individually with the eigrp stub command, connected and summary routes will not be sent automatically.

The connected keyword will permit the EIGRP Stub Routing feature to send connected routes. If the connected routes are not covered by a network statement, it may be necessary to redistribute connected routes with the redistribute connected command under the EIGRP process. This option is enabled by default.

The static keyword will permit the EIGRP Stub Routing feature to send static routes. Without the configuration of this option, EIGRP will not send any static routes, including internal static routes that normally would be automatically redistributed. It will still be necessary to redistribute static routes with the redistribute static command.

The summary keyword will permit the EIGRP Stub Routing feature to send summary routes. Summary routes can be created manually with the summary address command or automatically at a major network border router with the auto-summary command enabled. This option is enabled by default.

Example:

In the following example, the eigrp stub command is used to configure the router as a stub that advertises connected and summary routes:

Router(config)#router eigrp 1
Router(config-router)#network 10.0.0.0
Router(config-router)#eigrp stub

In the following example, the eigrp stub command is issued with the connected and static keywords to configure the router as a stub that advertises connected and static routes (sending summary routes will not be permitted):

Router(config)#router eigrp 1
Router(config-router)#network 10.0.0.0
Router(config-router)#eigrp stub connected static

In the following example, the eigrp stub command is issued with the receive-only keyword to configure the router as a receive-only neighbor (connected, summary, and static routes will not be sent):

Router(config)#router eigrp 1
Router(config-router)#network 10.0.0.0 eigrp
Router(config-router)#eigrp stub receive-only

Misconceptions:

Multi-access interfaces, such as ATM, Ethernet, Frame Relay, ISDN PRI, and X.25, are supported by the EIGRP Stub Routing feature only when all routers on that interface, except the hub, are configured as stub routers.

Related Commands:

None


Command:

ip authentication key-chain eigrp

Mode:

Router(config-if)#

Syntax:

ip authentication key-chain eigrp as-number key-chain
no ip authentication key-chain eigrp as-number key-chain

Syntax Description:

as-number | Autonomous system number to which the authentication applies.
key-chain | Name of the authentication key chain.

Command Description:

To enable authentication of Enhanced IGRP (EIGRP) packets, use the ip authentication key-chain eigrp command in interface configuration mode. To disable such authentication, use the no form of this command.

No authentication is provided for EIGRP packets by default.

Example:

The following example applies authentication to autonomous system 2 and identifies a key chain named SPORTS:

Router(config-if)#ip authentication key-chain eigrp 2 SPORTS

Misconceptions:

None

Related Commands:

accept-lifetime
ip authentication mode eigrp
key
key chain
key-string
send-lifetime


Command:

ip authentication mode eigrp

Mode:

Router(config-if)#

Syntax:

ip authentication mode eigrp as-number md5 no ip authentication mode eigrp as-number md5

Syntax Description:

as-number | Autonomous system number.
md5 | Keyed Message Digest 5 (MD5) authentication.

Command Description:

To specify the type of authentication used in Enhanced IGRP (EIGRP) packets, use the ip authentication mode eigrp command in interface configuration mode. To disable that type of authentication, use the no form of this command.

Configure authentication to prevent unapproved sources from introducing unauthorized or false routing messages. When authentication is configured, an MD5 keyed digest is added to each EIGRP packet in the specified autonomous system.

Example:

The following example configures the interface to use MD5 authentication in EIGRP packets in autonomous system 10:

Router(config-if)#ip authentication mode eigrp 10 md5

Misconceptions:

None

Related Commands:

accept-lifetime
ip authentication key-chain eigrp
key
key chain
key-string
send-lifetime


 Command:

ip bandwidth-percent eigrp

Mode:

Router(config-if)#

Syntax:

ip bandwidth-percent eigrp as-number percent

no ip bandwidth-percent eigrp as-number percent

Syntax Description:

as-number | Autonomous system number.
percent | Percent of bandwidth that Enhanced IGRP may use

Command Description:

To configure the percentage of bandwidth that may be used by EIGRP on an interface, use the ip bandwidth-percent eigrp interface configuration command.

Example:
Router(config-if)#ip bandwidth-percent eigrp 209 75

Misconceptions:
None

Related Commands:
None


Command:

ip hello-interval eigrp

Mode:

Router(config)#

Syntax:

ip hello-interval eigrp as-number seconds
no ip hello-interval eigrp as-number seconds

Syntax Description:

as-number | Autonomous system number.
seconds | Hello interval (in seconds).

Command Description:

To configure the hello interval for the EIGRP routing process designated by an autonomous system number, use the ip hello-interval eigrp command in interface configuration mode. To restore the default value, use the no form of this command.

The default of 60 seconds applies only to low-speed, NBMA media. Low speed is considered to be a rate of T1 or slower, as specified with the bandwidth interface configuration command. Note that for the purposes of Enhanced IGRP, Frame Relay and Switched Multimegabit Data Service (SMDS) networks may be considered to be NBMA. These networks are considered NBMA if the interface has not been configured to use physical multicasting; otherwise, they are considered not to be NBMA.

Defaults:

For low-speed, nonbroadcast multiaccess (NBMA) networks: 60 seconds

For all other networks: 5 seconds

Example:

The following example sets the hello interval for Ethernet interface 0 to 10 seconds:

Router(config)#interface ethernet 0
Router(config)#ip hello-interval eigrp 109 10

Misconceptions:

None

Related Commands:

bandwidth
ip hold-time eigrp


Command:

ip hold-time eigrp

Mode:

Router(config-if)#

Syntax:

ip hold-time eigrp as-number seconds
no ip hold-time eigrp as-number seconds

Syntax Description:

as-number | Autonomous system number.
seconds | Hold time (in seconds).

Command Description:

To configure the hold time for a particular Enhanced IGRP (EIGRP) routing process designated by the autonomous system number, use the ip hold-time eigrp command in interface configuration mode. To restore the default value, use the no form of this command.

On very congested and large networks, the default hold time might not be sufficient time for all routers and access servers to receive hello packets from their neighbors. In this case, you may want to increase the hold time.

We recommend that the hold time be at least three times the hello interval. If a router does not receive a hello packet within the specified hold time, routes through this router are considered unavailable.

Increasing the hold time delays route convergence across the network.

The default of 180 seconds hold time and 60 seconds hello interval apply only to low-speed, NBMA media. Low speed is considered to be a rate of T1 or slower, as specified with the bandwidth interface configuration command.

Defaults:

For low-speed, nonbroadcast multiaccess (NBMA) networks: 180 seconds

For all other networks: 15 seconds

Example:

The following example sets the hold time for Ethernet interface 0 to 40 seconds:

Router(config-if)#interface ethernet 0
Router(config-if)#ip hold-time eigrp 109 40

Misconceptions:

None

Related Commands:

bandwidth
ip hello-interval eigrp


Command:

ip split-horizon eigrp

Mode:

Router(config-if)#

Syntax:

ip split-horizon eigrp as-number

no ip split-horizon eigrp as-number

Syntax Description:

as-number

Autonomous system number.

Defaults

The behavior of this command is enabled by default.

Command Description:

To enable Enhanced IGRP (EIGRP) split horizon, use the ip split-horizon eigrp command in interface configuration mode. To disable split horizon, use the no form

For networks that include links over X.25 packet-switched networks (PSNs), you can use the neighbor router configuration command to defeat the split horizon feature. As an alternative, you can explicitly specify the no ip split-horizon eigrp command in your configuration. However, if you do so, you must similarly disable split horizon for all routers and access servers in any relevant multicast groups on that network.

Note: In general, we recommend that you not change the default state of split horizon unless you are certain that your application requires the change in order to properly advertise routes. Remember that if split horizon is disabled on a serial interface and that interface is attached to a packet-switched network, you must disable split horizon for all routers and access servers in any relevant multicast groups on that network.

Example:

The following example disables split horizon on a serial link connected to an X.25 network:

interface serial 0

 encapsulation x25

 no ip split-horizon eigrp 101

Misconceptions:

None.

Related Commands:

neighbor (IGRP)


 Command:

ip summary-address eigrp

Mode:

Router(config-if)#

Syntax:

ip summary-address eigrp as-number network-address subnet-mask [admin-distance]

no ip summary-address eigrp as-number network-address subnet-mask [admin-distance]

Syntax Description:
as-number | Autonomous system number.
network-address | IP summary aggregate address to apply to an interface.
subnet-mask | Subnet mask.
admin-distance | (Optional) Administrative distance. A value from 0 to 255.

Command Description:

To configure a summary aggregate address for a specified interface, use the ip summary-address eigrp interface configuration command. To disable a configuration, use the no form of this command.

Example:
Router(config-if)#ip summary-address eigrp 109 192.1.0.0 255.255.0.0

Misconceptions:
None

Related Commands:
auto-summary
summary-address


Command:

key

Mode:

Router(config-keychain)#

Syntax:

key key-id
no key key-id

Syntax Description:

key-id Identification number of an authentication key on a key chain. The range of keys is from 0 to 2147483647. The key identification numbers need not be consecutive.

Command Description:

To identify an authentication key on a key chain, use the key key-chain configuration command. To remove the key from the key chain, use the no form of this command.

Defaults:
No key exists on the key chain.

Only DRP Agent, Enhanced IGRP (EIGRP), and Routing Information Protocol (RIP) Version 2 use key chains.

It is useful to have multiple keys on a key chain so that the software can sequence through the keys as they become invalid after time, based on the accept-lifetime and send-lifetime key chain key command settings.

Each key has its own key identifier, which is stored locally. The combination of the key identifier and the interface associated with the message uniquely identifies the authentication algorithm and Message Digest 5 (MD5) authentication key in use. Only one authentication packet is sent, regardless of the number of valid keys. The software starts looking at the lowest key identifier number and uses the first valid key.

If the last key expires, authentication will continue and an error message will be generated. To disable authentication, you must manually delete the last valid key.

To remove all keys, remove the key chain by using the no key chain command.

Example:

The following example configures a key chain named trees. The key named chestnut will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named birch will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# interface ethernet 0
Router(config-if)# ip rip authentication key-chain trees
Router(config-if)# ip rip authentication mode md5

Router(config)# router rip
Router(config-router)# network 172.19.0.0
Router(config-router)# version 2

Router(config)# key chain trees
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string chestnut
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string birch
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600

Misconceptions:

None

Related Commands:

accept-lifetime
key chain
key-string
send-lifetime
show key chain


Command:

key chain

Mode:

Router(config)#

Syntax:

key chain name-of-chain
no key chain name-of-chain

Syntax Description:

name-of-chain Name of a key chain. A key chain must have at least one key and can have up to 2,147,483,647 keys.

Command Description:

To enable authentication for routing protocols, identify a group of authentication keys by using the key chain command in global configuration mode. To remove the key chain, use the no form of this command.

Defaults:
No key chain exists.

Only DRP Agent, Enhanced IGRP (EIGRP), and Routing Information Protocol (RIP) Version 2 use key chains.

You must configure a key chain with keys to enable authentication.

Although you can identify multiple key chains, we recommend using one key chain per interface per routing protocol. Upon specifying the key chain command, you enter key-chain configuration mode.

Example:

The following example configures a key chain named trees. The key named chestnut will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named birch will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# interface ethernet 0
Router(config-if)# ip rip authentication key-chain trees
Router(config-if)# ip rip authentication mode md5

Router(config)# router rip
Router(config-router)# network 172.19.0.0
Router(config-router)# version 2

Router(config)# key chain trees
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string chestnut
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string birch
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600

Misconceptions:

None

Related Commands:

accept-lifetime
ip rip authentication key-chain
key
key-string
send-lifetime
show key chain


Command:

key-string

Mode:

Router(config-keychain-key)#

Syntax:

key-string text
no key-string [text]

Syntax Description:

text Authentication string that must be sent and received in the packets using the routing protocol being authenticated. The string can contain from 1 to 80 uppercase and lowercase alphanumeric characters, except that the first character cannot be a number.

Command Description:

To specify the authentication string for a key, use the key-string key chain key configuration command. To remove the authentication string, use the no form of this command.

Only DRP Agent, Enhanced IGRP (EIGRP), and Routing Information Protocol (RIP) Version 2 use key chains. Each key can have only one key string.

If password encryption is configured (with the service password-encryption command), the software saves the key string as encrypted text. When you write to the terminal with the more system:running-config command, the software displays key-string 7 encrypted text.

Example:

The following example configures a key chain named trees. The key named chestnut will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named birch will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# interface ethernet 0
Router(config-if)# ip rip authentication key-chain trees
Router(config-if)# ip rip authentication mode md5

Router(config)# router rip
Router(config-router)# network 172.19.0.0
Router(config-router)# version 2

Router(config)# key chain trees
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string chestnut
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string birch
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600

Misconceptions:

None

Related Commands:

accept-lifetime
key
key chain
send-lifetime
show key chain


 Command:

metric weights

Mode:

Router(config-router)#

Syntax:

metric weights tos k1 k2 k3 k4 k5

no metric weights

Syntax Description:

tos

Type of service. Currently, it must always be zero.

k1-k5

Constants that convert an IGRP or EIGRP metric vector into a scalar quantity.

Command Description:

To allow the tuning of the IGRP or EIGRP metric calculations, use the metric weights router configuration command. To reset the values to their defaults, use the no form of this command.

Usage Guidelines

Use this command to alter the default behavior of IGRP or EIGRP routing and metric computation and allow the tuning of the metric calculation for a particular type of service (TOS).

If k5 equals 0, the composite IGRP or EIGRP metric is computed according to the following formula:
metric = [k1 * bandwidth + (k2 * bandwidth)/(256 - load) + k3 * delay]

If k5 does not equal zero, an additional operation is done:
metric = metric * [k5 / (reliability + k4)]

Bandwidth is inverse minimum bandwidth of the path in bits per second scaled by a factor of 2.56 * 10^12. The range is from a 1200-bps line to 10 terabits per second.

Delay is in units of 10 microseconds. This gives a range of 10 microseconds to 168 seconds. A delay of all ones indicates that the network is unreachable. The delay parameter is stored in a 32-bit field, in increments of 39.1 nanoseconds. This gives a range of 1 (39.1 nanoseconds) to hexadecimal FFFFFFFF (decimal 167,503,724,504 nanoseconds). A delay of all ones (hexadecimal FFFFFFFF) indicates that the network is unreachable.

defaults:

tos: 0
k1: 1
k2: 0
k3: 1
k4: 0
k5: 0

Example:

The following example sets the metric weights to slightly different values than the defaults:

Router(config)#router igrp 109
Router(config-router)#network 131.108.0.0
Router(config-router)#metric weights 0 2 0 2 0 0

Misconceptions:
None

Related Commands:
show ip protocols


 Command:

network (EIGRP)

Mode:

Router(config-router)#

Syntax:

network network-number [network-mask]

no network network-number [network-mask]

Syntax Description:

network-number | IP address of the directly connected networks.
network-mask | (Optional) Network mask.

Command Description:

To specify a list of networks for an EIGRP routing process, use this form of the network router configuration command. To remove an entry, use the no form of this command.

Example:

The following example configures a router for EIGRP and assigns autonomous system number 109. The network command indicates the network directly connected to the router.

Router(config)#router eigrp 109
Router(config-router)#network 172.16.0.0 0.0.255.255
Misconceptions:
None

Related Commands:
router eigrp
show ip route


Command:

offset-list (EIGRP)

Mode:

Router(config-router)#

Syntax:

offset-list {access-list-number | access-list-name} {in | out} offset [interface-type interface-number]
no offset-list {access-list-number | access-list-name} {in | out} offset [interface-type interface-number]

Syntax Description:

access-list-number | access-list-name | Standard access list number or name to be applied. Access list number 0 indicates all access lists. If the offset value is 0, no action is taken. For IGRP, the offset is added to the delay component only.
in | Applies the access list to incoming metrics.
out | Applies the access list to outgoing metrics.
offset | Positive offset to be applied to metrics for networks matching the access list. If the offset is 0, no action is taken.
interface-type | (Optional) Interface type to which the offset list is applied.
interface-number | (Optional) Interface number to which the offset list is applied.

Command Description:

To add an offset to incoming and outgoing metrics to routes learned via Enhanced IGRP (EIGRP), use the offset-list command in router configuration mode. To remove an offset list, use the no form of this command.

This command is disabled by default.

The offset value is added to the routing metric. An offset list with an interface type and interface number is considered extended and takes precedence over an offset list that is not extended. Therefore, if an entry passes the extended offset list and the normal offset list, the offset of the extended offset list is added to the metric.

Example:

In the following example, the router applies an offset of 10 to the delay component of the router only to access list 21:

Router(config-router)# offset-list 21 out 10

In the following example, the router applies an offset of 10 to routes learned from Ethernet interface 0:

Router(config-router)# offset-list 21 in 10 ethernet 0

Misconceptions:

None

Related Commands:

None


Command:

router eigrp

Mode:

Router(config)#

Syntax:

router eigrp autonomous-system

no router eigrp autonomous-system

Syntax Description:

autonomous-system Autonomous system number that identifies the routes to the other EIGRP routers. It is also used to tag the routing information.

Command Description:

To configure the EIGRP routing process, use the router eigrp global configuration command. To shut down a routing process, use the no form of this command.

Example:

The following example configures an EIGRP routing process and assigns process number 109:

Router(config)#router eigrp 109

Misconceptions:

None

Related Commands:

network (EIGRP)


 Command:

show ip eigrp

Mode:

Router>

Syntax:

show ip eigrp interfaces [interface-type interface-number] [as-number]

Syntax Description:
interface-type: (Optional) Interface type
interface-number | Displays the Enhanced IGRP topology table
as-number | (Optional) Interface number

Command Description:

This command displays EIGRP statistics and status information.

Example:

Router#show ip eigrp interfaces

Misconceptions:
None

Related commands:
show ip eigrp topology


 Command:

show ip eigrp interfaces

Mode:

Router>

Syntax:

show ip eigrp interfaces [interface-type interface-number] [as-number]

Syntax Description:
interface-type: (Optional) Interface type
interface-number | Displays the Enhanced IGRP topology table
as-number | (Optional) Interface number

Command Description:

This command displays EIGRP statistics and status information.

Example:

Router#show ip eigrp interfaces

Misconceptions:
None

Related commands:
show ip eigrp topology


Command:

show ip eigrp neighbors

Mode:

Router>

Syntax:

show ip eigrp neighbors [interface-type | as-number | static]

Syntax Description:

interface-type | (Optional) Interface type.
as-number | (Optional) Autonomous system number.
static | (Optional) Static routes.

Command Description:

To display the neighbors discovered by Enhanced IGRP (EIGRP), use the show ip eigrp neighbors command in EXEC mode.

Use the show ip eigrp neighbors command to determine when neighbors become active and inactive. It is also useful for debugging certain types of transport problems.

Example:

The following is sample output from the show ip eigrp neighbors command:

Router# show ip eigrp neighbors

IP-EIGRP Neighbors for process 77

Address Interface Holdtime Uptime Q Seq SRTT RTO

(secs) (h:m:s) Count Num (ms) (ms)

172.16.81.28 Ethernet1 13 0:00:41 0 11 4 20

172.16.80.28 Ethernet0 14 0:02:01 0 10 12 24

172.16.80.31 Ethernet0 12 0:02:02 0 4 5 20

show ip eigrp neighbors Field Descriptions

Field | Description
process 77 | Autonomous system number specified in the router configuration command.
Address | IP address of the EIGRP peer.
Interface | Interface on which the router is receiving hello packets from the peer.
Holdtime | Length of time (in seconds) that the Cisco IOS software will wait to hear from the peer before declaring it down. If the peer is using the default hold time, this number will be less than 15. If the peer configures a nondefault hold time, the nondefault hold time will be displayed.
Uptime | Elapsed time (in hours:minutes: seconds) since the local router first heard from this neighbor.
Q Count | Number of EIGRP packets (update, query, and reply) that the software is waiting to send.
Seq Num | Sequence number of the last update, query, or reply packet that was received from this neighbor.
SRTT | Smooth round-trip time. This is the number of milliseconds required for an EIGRP packet to be sent to this neighbor and for the local router to receive an acknowledgment of that packet.
RTO | Retransmission timeout (in milliseconds). This is the amount of time the software waits before resending a packet from the retransmission queue to a neighbor.

Misconceptions:

None.

Related Commands:

None.


Command:

show ip eigrp topology

Mode:

Router#

Syntax:

show ip eigrp topology [autonomous-system-number | [[ip-address] mask]]

Syntax Description:

number | (Optional) Autonomous system number.
ip-address | (Optional) IP address. When specified with a mask, a detailed description of the entry is provided.
mask | (Optional) Subnet mask.
active | (Optional) Displays only active entries in the EIGRP topology table.
all-links | (Optional) Displays all entries in the EIGRP topology table.
pending | (Optional) Displays all entries in the EIGRP topology table that are waiting for an update from a neighbor or are waiting to reply to a neighbor.
summary | (Optional) Displays a summary of the EIGRP topology table.
zero-successors | (Optional) Displays available routes in the EIGRP topology table.

Command Description:

To display the EIGRP topology table, use the show ip eigrp topology EXEC command. This command is also used to determine Diffusing Update Algorithm (DUAL) states and to debug possible DUAL problems.

Example:

Router#show ip eigrp topology

IP-EIGRP Topology Table for process 77

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,

r - Reply status

P 172.16.90.0 255.255.255.0, 2 successors, FD is 0

via 172.16.80.28 (46251776/46226176), Ethernet0

via 172.16.81.28 (46251776/46226176), Ethernet1

via 172.16.80.31 (46277376/46251776), Serial0

P 172.16.81.0 255.255.255.0, 1 successors, FD is 307200

via Connected, Ethernet1

via 172.16.81.28 (307200/281600), Ethernet1

via 172.16.80.28 (307200/281600), Ethernet0

via 172.16.80.31 (332800/307200), Serial0

Table 61 describes the significant fields shown in the display.

Table 61 show ip eigrp topology Field Descriptions

Field | Description
Codes | State of this topology table entry. Passive and Active refer to the EIGRP state with respect to this destination; Update, Query, and Reply refer to the type of packet that is being sent.
P - Passive | No EIGRP computations are being performed for this destination.
A - Active | EIGRP computations are being performed for this destination.
U - Update | Indicates that an update packet was sent to this destination.
Q - Query | Indicates that a query packet was sent to this destination.
R - Reply | Indicates that a reply packet was sent to this destination.
r - Reply status | Flag that is set after the software has sent a query and is waiting for a reply.
172.16.90.0 | Destination IP network number.
255.255.255.0 | Destination subnet mask.
successors | Number of successors. This number corresponds to the number of next hops in the IP routing table. If "successors" is capitalized, then the route or next hop is in a transition state.
FD | Feasible distance. The feasible distance is the best metric to reach the destination or the best metric that was known when the route went active. This value is used in the feasibility condition check. If the reported distance of the router (the metric after the slash) is less than the feasible distance, the feasibility condition is met and that path is a feasible successor. Once the software determines it has a feasible successor, it need not send a query for that destination.
replies | Number of replies that are still outstanding (have not been received) with respect to this destination. This information appears only when the destination is in Active state.
state | Exact EIGRP state that this destination is in. It can be the number 0, 1, 2, or 3. This information appears only when the destination is in the Active state.
via | IP address of the peer that told the software about this destination. The first n of these entries, where N is the number of successors, are the current successors. The remaining entries on the list are feasible successors.
(46251776/46226176) | The first number is the EIGRP metric that represents the cost to the destination. The second number is the EIGRP metric that this peer advertised.
Ethernet0 | Interface from which this information was learned.
Serial0 | Interface from which this information was learned.

Misconceptions:

None

Related commands:

show ip eigrp


Command:

show ip eigrp traffic

Mode:

Router>

Syntax:

show ip eigrp traffic [as-number]

Syntax Description:

as-number

(Optional) Autonomous system number.

Command Description:

To display the number of Enhanced IGRP (EIGRP) packets sent and received, use the show ip eigrp traffic command in EXEC mode.

Example:

The following is sample output from the show ip eigrp traffic command:

Router#show ip eigrp traffic

IP-EIGRP Traffic Statistics for process 77

Hellos sent/received: 218/205

Updates sent/received: 7/23

Queries sent/received: 2/0

Replies sent/received: 0/2

Acks sent/received: 21/14

Table 24 describes the significant fields shown in the display.

Table 24 show ip eigrp traffic Field Descriptions

Field

Description

process 77

Autonomous system number specified in the ip router command.

Hellos sent/received

Number of hello packets sent and received.

Updates sent/received

Number of update packets sent and received.

Queries sent/received

Number of query packets sent and received.

Replies sent/received

Number of reply packets sent and received.

Acks sent/received

Number of acknowledgment packets sent and received.

Misconceptions:

None.

Related Commands:

None.


Command:

banner motd

Mode:

Router(config)#

Syntax:

banner motd d message d

no banner motd

Syntax Description:

d

Delimiting character of your choice, a pound sign (#) for example. You cannot use the delimiting character in the banner message.

message

Message text

Command Description:

To specify a message-of-the-day (MOTD) banner, use the banner motd global configuration command. The no form of this command deletes the MOTD banner.

Follow this command with one or more blank spaces and a delimiting character of your choice. Then enter one or more lines of text, terminating the message with the second occurrence of the delimiting character.

This MOTD banner is displayed to all terminals connected and is useful for sending messages that affect all users (such as impending system shutdowns). Use the no exec-banner or no motd-banner command to disable the MOTD banner on a line. The no exec-banner command also disables the EXEC banner on the line.

When someone connects to the router, the MOTD banner appears before the login prompt. After the user successfully logs in to the router, the EXEC banner or incoming banner will be displayed, depending on the type of connection. For a reverse Telnet login, the incoming banner will be displayed. For all other connections, the router will display the EXEC banner.

The banner command without any keywords specified defaults to the banner motd command. When a new banner motd command is added to the configuration, it overwrites the existing banner command if no keyword is specified. Similarly, if a banner command is added to the configuration, any existing banner motd command is overwritten.

Example:

The following example sets a MOTD banner. The pound sign (#) is used as a delimiting character.

Router(config)#banner motd # Building power will be off from 7:00 AM until 9:00 AM this coming Tuesday.# /

Misconceptions:

None

Related Commands:

None


Command:

boot

Mode:

> rommon # > The # is the line number and increases incrementally at each prompt.

Syntax:

boot
boot file-url
boot filename [tftp-ip-address]
boot flash [flash-fs:][partition-number:][filename]

Cisco 7000 Series, 7200 Series, 7500 Series Routers
boot flash-fs:[filename]

Cisco 1600 and Cisco 3600 Series Routers
boot [flash-fs:][partition-number:][filename]

Syntax Description:

file-url | URL of the image to boot (for example, boot tftp://172.16.15.112/routertest).
filename When used in conjunction with the ip-address argument, the filename argument is the name of the system image file to boot from a network server. The filename is case sensitive.

When used in conjunction with the flash keyword, the filename argument is the name of the system image file to boot from Flash memory.

On all platforms except the Cisco 1600 series, Cisco 3600 series, and Cisco 7000 family routers, the system obtains the image file from internal Flash memory.

On the Cisco 1600 series, Cisco 3600 series and Cisco 7000 family routers, the flash-fs: argument specifies the Flash memory device from which to obtain the system image. (See the flash-fs: argument later in this table for valid device values.) The filename is case sensitive. Without the filename argument, the first valid file in Flash memory is loaded.

tftp-ip-address | (optional) IP address of the TFTP server on which the system image resides. If omitted, this value defaults to the IP broadcast address of 255.255.255.255.
flash | Boots the router from Flash memory. Note that this keyword is required in some boot images.
flash-fs: (Optional) Specifying the Flash file system is optional for all platforms except the Cisco 7500 series routers. Possible file systems are:

flash: Internal Flash memory on the Cisco 1600 series routers and Cisco 3600 series routers. This is the only valid Flash file system for the Cisco 1600 series routers.
bootflash: Internal Flash memory on the Cisco 7000 family.
slot0: Flash memory card in the first PCMCIA slot on the Cisco 7000 family and Cisco 3600 series routers.
slot1: Flash memory card in the second PCMCIA slot on the Cisco 7000 family and Cisco 3600 series routers.

partition-number: (Optional) Specifies the partition number of the file system the file should be loaded from. This argument is not available on all platforms.

Command Description:

To boot the router manually, use the boot ROM monitor command. The syntax of this command varies according to the platform and ROM monitor version.

To determine which form of this command to use, refer to the documentation for your platform or use the CLI help (?) feature.

Use this command only when your router cannot find the boot configuration information needed in NVRAM. To enter ROM monitor mode, use one of the following methods:

Enter the reload EXEC command, then press the Break key during the first 60 seconds of startup.

Set the configuration register bits 0 to 3 to zero (for example, set the configuration register to 0x0) and enter the reload command.

The ROM Monitor prompt is either ">" or, for newer platforms, "rommon x>". Enter only lowercase commands.

These commands work only if there is a valid image to boot. Also, from the ROM monitor prompt, issuing a prior reset command is necessary for the boot to be consistently successful.

Refer to your hardware documentation for information on correct jumper settings for your platform.

Defaults:

For most platforms, if you enter the boot command and press Return, the router boots from ROM by default. However, for some platforms, such as the Cisco 3600 series routers, if you enter the boot command and press Return, the router boots the first image in Flash memory. Refer to the documentation for your platform for information about the default image.

If the partition-number is not specified, the first partition is used.

If the filename is not specified, the first file in the partition or file system is used.

For other defaults, see the "Syntax Description" section.

Example:

In the following example, a router is manually booted from ROM:

> boot
F3:
(ROM Monitor copyrights)

In the following example, a router boots the file named routertest from a network server with the IP address 172.16.15.112 using the file-url syntax:

> boot tftp://172.16.15.112/routertest
F3
(ROM Monitor copyrights)

The following example shows the boot flash command without the filename argument. The first valid file in Flash memory is loaded.

> boot flash
F3: 1858656+45204+166896 at 0x1000
Booting gs7-k from flash memory RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR [OK - 1903912/13765276 bytes]
F3: 1858676+45204+166896 at 0x1000
(ROM Monitor copyrights)

The following example boots from Flash memory using the file named gs7-k:

> boot flash gs7-k
F3: 1858656+45204+166896 at 0x1000
Booting gs7-k from flash memory RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
RRRRRRRRRRRRRR [OK - 1903912/13765276 bytes]
F3: 1858676+45204+166896 at 0x1000
(ROM Monitor copyrights)

In the following example, the boot flash flash: command boots the relocatable image file named igs-bpx-l from partition 2 in Flash memory:

> boot flash flash:2:igs-bpx-l
F3: 3562264+98228+303632 at 0x30000B4
(ROM Monitor copyrights)

In the following command, the Cisco 7000 family router accepts the flash keyword for compatibility but ignores it, and boots from slot 0:

> boot flash slot0:gs7-k-mz.103-9
F3: 8468+3980384+165008 at 0x1000

In the following example, the command did not function because it must be entered in lowercase:

rommon 10 > BOOT
command "BOOT" not found

The following example boots the first file in the first partition of internal Flash memory of a Cisco 3600 series router:

> boot flash:

The following example boots the first image file in the first partition of the Flash memory card in slot 0 of a Cisco 3600 series router:

> boot slot0:

The following example shows the ROM monitor booting the first file in the first Flash memory partition on a Cisco 1600 series router:

> boot flash:

Misconceptions:

For some platforms the flash keyword is now required. If your attempts to use the boot command are failing using the older boot flash:x:[filename] syntax, try using the boot flash flash:x:[filename] syntax.

Related Commands:

None


Command:

boot system

Mode:

Router(config)#

Syntax:

boot system file-url

no boot system file-url

boot system flash [flash-fs:][partition-number:][filename]

no boot system flash [flash-fs:][partition-number:][filename]

boot system mop filename [mac-address] [interface]

no boot system mop filename [mac-address] [interface]

boot system rom

no boot system rom

boot system {rcp | tftp | ftp} filename [ip-address]

no boot system {rcp | tftp | ftp} filename [ip-address]

no boot system

Syntax Description:

file-url

URL of the system image to load at system startup.

flash

On all platforms except the Cisco 1600 series, Cisco 3600 series, and Cisco 7000 family, this keyword boots the router from internal Flash memory. If you omit all arguments that follow this keyword, the system searches internal Flash for the first bootable image.

On the Cisco 1600 series, Cisco 3600 series, and Cisco 7000 family, this keyword boots the router from a Flash device, as specified by the device: argument. On the Cisco 1600 series and Cisco 3600 series, if you omit all optional arguments, the router searches internal Flash memory for the first bootable image. On the Cisco 7000 family, when you omit all arguments that follow this keyword, the system searches the PCMCIA slot 0 for the first bootable image.

flash-fs:

(Optional) Flash file system containing the system image to load at startup. The colon (:) is required. Valid file systems are as follows:

  • flash:—Internal Flash memory on the Cisco 1600 series and Cisco 3600 series. For the Cisco 1600 series and Cisco 3600 series, this file system is the default if you do not specify a file system. This is the only valid file system for the Cisco 1600 series.
  • bootflash—Internal Flash memory in the Cisco 7000 family.
  • slot0—First PCMCIA slot on the Cisco 3600 series and Cisco 7000 family. For the Cisco 7000 family, this file system is the default if you do not specify a file system.
  • slot1—Flash memory card in the second PCMCIA slot on the Cisco 3600 series and Cisco 7000 family.

partition-number:

(Optional) Number of the Flash memory partition that contains the system image to boot, specified by the optional filename argument. If you do not specify a filename, the router loads the first valid file in the specified partition of Flash memory. This argument is only valid on routers which can be partitioned.

filename

(Optional when used with boot system flash) Name of the system image to load at startup. It is case sensitive. If you do not specify a filename, the router loads the first valid file in the specified Flash file system, the specified partition of Flash memory, or the default Flash file system if you also omit the flash-fs: argument.

mop

Boots the router from a system image stored on a Digital MOP server. Do not use this keyword with the Cisco 3600 series or Cisco 7000 family.

mac-address

(Optional) Media Access Control (MAC) address of the MOP server containing the specified system image file. If you do not include the MAC address argument, the router sends a broadcast message to all MOP boot servers. The first MOP server to indicate that it has the specified file is the server from which the router gets the boot image.

interface

(Optional) Interface the router uses to send out MOP requests to the MOP server. The interface options are async, dialer, ethernet, serial, and tunnel. If you do not specify the interface argument, the router sends a request out on all interfaces that have MOP enabled. The interface that receives the first response is the interface the router uses to load the software.

rom

Boots the router from ROM. Do not use this keyword with the Cisco 3600 series or the Cisco 7000 family.

rcp

Boots the router from a system image stored on a network server using rcp.

tftp

Boots the router from a system image stored on a TFTP server.

ftp

Boots the router from a system image stored on an FTP server.

ip-address

(Optional) IP address of the server containing the system image file. If omitted, this value defaults to the IP broadcast address of 255.255.255.255.

Command Description:

To specify the system image that the router loads at startup, use one of the following boot system global configuration commands. Use a no form of this command to remove the startup system image specification.

For this command to work, the config-register command must be set properly.

Enter several boot system commands to provide a fail-safe method for booting your router. The router stores and executes the boot system commands in the order in which you enter them in the configuration file. For example, if you enter two commands that instruct the router to boot from different network servers, the router will execute them in the order in which they appear in the configuration file. If a boot system command entry in the list specifies an invalid device, the router skips that entry. Use the boot system rom command to specify use of the ROM system image as a backup to other boot commands in the configuration.

For some platforms, the boot image must be loaded before the system image is loaded. However, on many platforms, the boot image is loaded only if the router is booting from a network server or if the flash file system is not specified. If the file system is specified, the router will boot faster because it does not have to load the boot image first.

This section contains the following usage guideline sections:

  • Change the List of Boot System Commands
  • Boot Compressed Images
  • Understand the rcp Protocol
  • Stop Booting and Enter ROM Monitor Mode
  • Cisco1600 series, Cisco 3600 series, and Cisco 7000 family notes

Change the List of Boot System Commands

To remove a single entry from the bootable image list, use the no form of the command with an argument. For example, to remove the entry that specifies a bootable image on a Flash memory card inserted in the second slot, use the no boot system flash slot1:[filename] command. All other entries in the list remain.

To eliminate all entries in the bootable image list, use the no boot system command. At this point, you can redefine the list of bootable images using the previous boot system commands. Remember to save your changes to your startup configuration by issuing the copy system:running-config nvram:startup-config command.

Each time you write a new software image to Flash memory, you must delete the existing filename in the configuration file with the no boot system flash filename command. Then add a new line in the configuration file with the boot system flash filename command.

Note If you want to rearrange the order of the entries in the configuration file, you must first issue the no boot system command and then redefine the list.

Boot Compressed Images

You can boot the router from a compressed image on a network server. When a network server boots software, both the image being booted and the running image must fit into memory. Use compressed images to ensure that enough memory is available to boot the router. You can compress a software image on any UNIX platform using the compress command. Refer to your UNIX platform's documentation for the exact usage of the compress command. (You can also uncompress data with the UNIX uncompress command.)

Understand the rcp Protocol

The rcp protocol requires a client to send the remote username in an rcp request to a server. When the router executes the boot system rcp command, the Cisco IOS software sends the host name as both the remote and local usernames by default. For the rcp protocol to execute properly, an account must be defined on the network server for the remote username configured on the router.

If the server has a directory structure, the rcp software searches for the system image to boot from the remote server relative to the directory of the remote username.

By default, the router software sends host name as the remote username. You can override the default remote username by using the ip rcmd remote-username command. For example, if the system image resides in the home directory of a user on the server, you can specify that user's name as the remote username.

Understand TFTP

You need a TFTP server running in order to fetch the router image from the host.

Understand FTP

You need to an FTP server running in order to fetch the router image from the host. You also need an account on the server or anonymous file access to the server.

Stop Booting and Enter ROM Monitor Mode

During the first 60 seconds of startup, you can force the router to stop booting by pressing the Break key. The router will enter ROM Monitor mode, where you can change the configuration register value or boot the router manually.

Cisco 1600 series, Cisco 3600 series, and Cisco 7000 family notes

For the Cisco 3600 series and Cisco 7000 family, the boot system command modifies the BOOT environment variable in the running configuration. The BOOT environment variable specifies a list of bootable images on various devices.

Note When you use the boot system global configuration command on the Cisco 1600 series, Cisco 3600 series, and Cisco 7000 family, you affect only the running configuration. You must save the BOOT environment variable settings to your startup configuration to place the information under ROM monitor control and to have the environment variable function as expected. Use the copy system:running-config nvram:startup-config command to save the environment variable from your running configuration to your startup configuration.

To view the contents of the BOOT environment variable, use the show bootenv command.

Example:

Router(config)#boot system ftp cz2600-120tomz.bin 10.0.0.2

Misconceptions:

None

Related Commands:

None


Command:

cd

Mode:

Router#

Syntax:

cd [filesystem: ]

Syntax Description:

filesystem:

(Optional) The URL or alias of the directory or file systems followed by a colon

Command Description:

To change the default directory or file system, use the cd EXEC command. The initial default file system is flash: . For platforms that do not have a physical device named flash: the keyword flash: is aliased to the default Flash device. If you do not specify a directory on a file system, the default is the root directory on that file system.

Example:

Router# cd flash:

Misconceptions:

None

Related Commands:

dir


Command:

cdp run

Mode:

Router(config)#

Syntax:

cdp run

no cdp run

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable CDP, use the cdp run global configuration command. Use the no form of this command to disable CDP. CDP is enabled on your router by default, which means the Cisco IOS software will receive CDP information. CDP also is enabled on supported interfaces by default. To disable CDP on an interface, use the no cdp enable interface configuration command.

Example:

The following example disables CDP:

Router(config)#no cdp run

Misconceptions:

None

Related Commands:

show cdp

show cdp entry

show cdp neighbors


Command:

config-register

Mode:

Router(config)#

Syntax:

config-register register-value

Syntax Description:

register-value

Hexadecimal number or value that represents the 16-bit configuration register value that you want to use the next time the router is restarted. The value range is from 0x0 to 0xFFFF (0 to 65535 in decimal)

Command Description:

This command is used to define the configuration register. The register is a hexadecimal value from 0x0 to 0xFFFF. This command only applies to platforms which use a software configuration register. The lowest four bits of the configuration register (bits 3, 2, 1, and 0) form the boot field. The boot field determines if the router boots manually, from ROM, or from Flash, or from the network. To change the boot field value and leave all other bits set to their default values, follow these guidelines:

If you set the configuration register boot field value to 0x0, you must boot the operating system manually with the boot command.

If you set the configuration register boot field value to 0x1, the router boots using the default ROM software. If you set the configuration register boot field to any value from 0x2 to 0xF, the router uses the boot field value to form a default boot filename for booting from a network server. For more information about the configuration register bit settings and default filenames, see the appropriate router hardware installation guide.

Example:

The following sets the config register value to 0x2102 at next boot:

Router(config)#config-register 0x2102

Misconceptions:

Unlike most commands, the changing of the config register does not occur until next boot.

Related Commands:

show version

configure


confreg

Command:

confreg

Mode:

>
rommon # >
The # is the line number and increases incrementally at each prompt

Syntax:

confreg [value]

Syntax Description:

value (Optional) Hexadecimal value that represents the 16-bit configuration register value that you want to use the next time the router is restarted. The value range is from 0x0 to 0xFFFF.

Command Description:

To change the configuration register settings while in ROM monitor mode, use the confreg ROM monitor command.

Not all versions in the ROM monitor support this command. Refer to your platform documentation for more information on ROM monitor mode.

If you use this command without specifying the configuration register value, the router prompts for each bit of the configuration register.

The lowest four bits of the configuration register (bits 3, 2, 1, and 0) form the boot field. The boot field determines if the router boots manually, from ROM, or from Flash or the network.

To change the boot field value and leave all other bits set to their default values, follow these guidelines:

If you set the configuration register boot field value to 0x0, you must boot the operating system manually with the boot command.

If you set the configuration register boot field value to 0x1, the router boots using the default ROM software.

If you set the configuration register boot field to any value from 0x2 to 0xF, the router uses the boot field value to form a default boot filename for booting from a network server.

For more information about the configuration register bit settings and default filenames, refer to the appropriate router hardware installation guide. Defaults: Refer to your platform documentation for the default configuration register value.

Example:

In the following example, the configuration register is set to boot the system image from Flash memory:

>confreg 0x210F

In the following example, no configuration value is entered, so the system prompts for each bit in the register:

rommon 7>confreg
Configuration Summary
enabled are:
console baud: 9600
boot: the ROM Monitor
do you wish to change the configuration? y/n [n]: y
enable "diagnostic mode"? y/n [n]: y
enable "use net in IP bcast address"? y/n [n]:
enable "load rom after netboot fails"? y/n [n]:
enable "use all zero broadcast"? y/n [n]:
enable "break/abort has effect"? y/n [n]:
enable "ignore system config info"? y/n [n]:
change console baud rate? y/n [n]: y
enter rate: 0 = 9600, 1 = 4800, 2 = 1200, 3 = 2400 [0]: 0
change the boot characteristics? y/n [n]: y
enter to boot:
0 = ROM Monitor
1 = the boot helper image
2-15 = boot system
[0]: 0
Configuration Summary
enabled are:
diagnostic mode
console baud: 9600
boot: the ROM Monitor
do you wish to change the configuration? y/n [n]:
You must reset or power cycle for new config to take effect.
rommon 8>

Misconceptions:

None.

Related commands:

None.


 Command:

copy

Mode:

Router#

Syntax:

copy {flash | ftp | nvram | running-config|startup-config | system | tftp} {flash | ftp | nvram | running-config | startup-config | system | tftp}

Syntax Description:

Specify a source filesystem and destination filesystem.

Command Description:

To copy any file from a source to a destination, use the copy EXEC command. Use the /erase option to erase the destination file system before copying.

Example:

Router(config)#copy tftp flash

Misconceptions:
None

Related Commands:
cd
dir
erase
delete


Command:

continue

Mode:

>
rommon # >
The # is the line number and increases incrementally at each prompt

Syntax:

continue

Syntax Description:

This command has no arguments or keywords.

Command Description:

To return to EXEC mode from ROM monitor mode, use the continue ROM monitor command.

Use this command to return to EXEC mode from ROM monitor mode, to use the system image instead of reloading. On older platforms, the angle bracket (>) indicates that the router is in ROM monitor mode. On newer platforms, rommon number> is the default ROM monitor prompt. Typically, the router is in ROM monitor mode when you manually load a system image or perform diagnostic tests. Otherwise, the router will most likely never be in this mode.

Caution: While in ROM monitor mode, the Cisco IOS system software is suspended until you issue either a reset or the continue command.

Example:

In the following example, the continue command switches the router from ROM monitor to EXEC mode:

> continue

Router#

Misconceptions:

None.

Related Commands:

boot


 Command:

delete

Mode:

Router#

Syntax:

delete flash-url
undelete flash-url

Syntax Description:

flash-url

URL of the file to be deleted.

Command Description:

To delete a file on a Flash memory device, use the delete EXEC command.

When you delete a file, the software simply marks the file as deleted, but it does not erase the file. This feature allows you to later recover a "deleted" file using the undelete command. You can delete and undelete a file up to 15 times. To permanently delete all files marked "deleted" on a Flash memory device, use the squeeze command.

If you attempt to delete the configuration file or image specified by the CONFIG_FILE or BOOTLDR environment variable, the system prompts you to confirm the deletion. Also, if you attempt to delete the last valid system image specified in the BOOT environment variable, the system prompts you to confirm the deletion.

Example:

The following example deletes the file named test from the Flash card inserted in slot 0:

Router#delete slot0:test

Delete slot0:test? [confirm]
Misconceptions:
None

Related Commands:
erase
copy
dir
cd


 Command:

dir

Mode:

Router#

Syntax:

dir [/all] [filesystem: | file-url]

Syntax Description:

/all

(Optional) Lists deleted files, undeleted files, and files with errors.

filesystem:

(Optional) File system or directory containing the file(s) to list followed by a colon.

file-url

(Optional) Name of the file(s) to display on a specified device. The files can be of any type. You can use wildcards in the filename. A wildcard character (*) matches all patterns. Strings after a wildcard are ignored.

Command Description:

To display a list of files on a file system, use the dir EXEC command.

Use the show (Flash file system) command to display more detail about the files in a particular file system.

Example:

The following is sample output from the dir command:

Router#dir slot0:

Directory of slot0:/

  1  -rw-     4720148   Aug 29 1997 17:49:36  hampton/nitro/c7200-j-mz
  2  -rw-     4767328   Oct 01 1997 18:42:53  c7200-js-mz
  5  -rw-         639   Oct 02 1997 12:09:32 rally
  7  -rw-         639   Oct 02 1997 12:37:13  the_time

20578304 bytes total (3104544 bytes free)

Router#dir /all slot0:

Directory of slot0:/

  1  -rw-     4720148   Aug 29 1997 17:49:36  hampton/nitro/c7200-j-mz
  2  -rw-     4767328   Oct 01 1997 18:42:53  c7200-js-mz
  3  -rw-     7982828   Oct 01 1997 18:48:14  [rsp-jsv-mz]
  4  -rw-         639   Oct 02 1997 12:09:17  [the_time]
  5  -rw-         639   Oct 02 1997 12:09:32  rally
  6  -rw-         639   Oct 02 1997 12:37:01  [the_time]
  7  -rw-         639   Oct 02 1997 12:37:13  the_time

The following table describes the fields shown in these displays.

Table: dir Field Descriptions
Field Description

1

Index number of the file.

-rw-

Permissions. The file can be any or all of the following:

  • d—directory
  • r—readable
  • w—writable
  • x—executable

4720148

Size of the file.

Aug 29 1997 17:49:36

Last modification date.

hampton/nitro/c7200-j-mz

Filename. Deleted files are indicated by square brackets around the filename.

Misconceptions:
None

Related Commands:
cd
delete
erase
copy


 Command:

enable password

Mode:

Router(config)#

Syntax:

enable password [level level] {password | [encryption-type] encrypted-password}

no enable password [level level] {password | [encryption-type] encrypted-password}

Syntax Description:
level | (Optional) Level for which the password applies. You can specify up to 16 privilege levels, using numbers 0 through 15. Level 1 is normal EXEC-mode user privileges. If this argument is not specified in the command or the no form of the command, the privilege level defaults to 15 (traditional enable privileges).
password | Password users type to enter enable mode.
encryption-type | (Optional) Cisco-proprietary algorithm used to encrypt the password. Currently the only encryption type available is 7. If you specify encryption-type, the next argument you supply must be an encrypted password (a password already encrypted by a Cisco router).
encrypted-password | Encrypted password you enter, copied from another router configuration.

Command Description:

To set a local password to control access to various privilege levels, use the enable password global configuration command. Use the no form of this command to remove the password requirement. The encryption-type argument specifies a pre-encrypted password (using a proprietary Cisco algorithm). Currently the only encryption type available is 7. If you specify encryption-type, the next argument you supply must be an encrypted password (a password already encrypted by a Cisco router).

Example:

Router(config)#enable password 7 $1$nnCO$Hp3iCaDMrTvJIRI9IGRsa0

Misconceptions:
None

Related Commands:
enable secret


 Command:

enable secret

Mode:

Router(config)#

Syntax:

enable secret [level level] {password | [encryption-type] encrypted-password}

no enable secret [level level]

Syntax Description:

level level

(Optional) Level for which the password applies. You can specify up to sixteen privilege levels, using numbers 0 through 15. Level 1 is normal EXEC-mode user privileges. If this argument is not specified in the command or in the no form of the command, the privilege level defaults to 15 (traditional enable privileges). The same holds true for the no form of the command.

password

Password for users to enter enable mode. This password should be different from the password created with the enable password command.

encryption-type

(Optional) Cisco-proprietary algorithm used to encrypt the password. Currently the only encryption type available for this command is 5. If you specify encryption-type, the next argument you supply must be an encrypted password (a password encrypted by a Cisco router).

encrypted-password

Encrypted password you enter, copied from another router configuration.

Command Description:

To specify an additional layer of security over the enable password command, use the enable secret global configuration command. Use the no form of this command to turn off the enable secret function.

Use this command to provide an additional layer of security over the enable password. The enable secret command provides better security by storing the enable secret password using a non-reversible cryptographic function. The added layer of security encryption provides is useful in environments where the password crosses the network or is stored on a TFTP server.

You will not ordinarily enter an encryption type. Typically you enter an encryption type only if you paste into this command an encrypted password that you copied from a router configuration file.

Caution

If you specify an encryption-type and then enter a clear text password, you will not be able to reenter enable mode. You cannot recover a lost password that has been encrypted by any method.

If you use the same password for the enable password and enable secret commands, you receive an error message warning that this practice is not recommended, but the password will be accepted. By using the same password, however, you undermine the additional security the enable secret command provides.

Note After you set a password using enable secret command, a password set using the enable password command works only if the enable secret is disabled or an older version of Cisco IOS software is being used. Additionally, you cannot recover a lost password that has been encrypted by any method.

If service password-encryption is set, the encrypted form of the
password you create here is displayed when a more nvram:startup-config
command is entered.

You can enable or disable password encryption with the service
password-encryption command.

An enable password is defined as follows:

  • Must contain from 1 to 25 uppercase and lowercase alphanumeric characters
  • Must not have a number as the first character
  • Can have leading spaces, but they are ignored. However, intermediate and trailing spaces are recognized.
  • Can contain the question mark (?) character if you precede the question mark with the key combination Crtl-V when you create the password; for example, to create the password abc?123, do the following:

    • Enter abc.
    • Type Crtl-V.
    • Enter ?123.

When the system prompts you to enter the enable password, you need not precede the question mark with the Ctrl-V; you can simply enter abc?123 at the password prompt.
Example:

The following example specifies the enable secret password of gobbledegook:

Router(config)#enable secret gobbledegook

After specifying an enable secret password, users must enter this password to gain access. Any passwords set through enable password will no longer work.

Password: gobbledegook

The following example enables the encrypted password $1$FaD0$Xyti5Rkls3LoyxzS8, which has been copied from a router configuration file, for privilege level 2 using encryption type 5:

Router(config)#enable password level 2 5 $1$FaD0$Xyti5Rkls3LoyxzS8
Misconceptions:
None

Related Commands:
enable password


 Command:

erase

Mode:

Router#

Syntax:

erase {filesystem:| start-up config}

Syntax Description:

filesystem:

File system name followed by a colon.

start-up config Erase contents of configuration memory

Command Description:

To erase a file system, use the erase EXEC command.The erase nvram: command replaces the write erase command and the erase startup-config command.

When a file system is erased, none of the files in the file system can be recovered.

The erase command can be used on both Class B and Class C Flash file systems only. To reclaim space on Flash file systems after deleting files using the delete command, you must use the erase command. This command erases all of the files in the Flash file system.

Class A Flash file systems cannot be erased. You can delete individual files using the delete command and then reclaim the space using the squeeze command. You can also use the format command to format the Flash file system.

On Class C Flash file systems, space is dynamically reclaimed when you use the delete command. You can also use either the format or erase command to reinitialize a Class C Flash file system.

The erase nvram: command erases NVRAM. On Class A file system platforms, if the CONFIG_FILE variable specifies a file in Flash memory, the specified file will be marked "deleted."
Example:

The following example erases the NVRAM, including the startup configuration located there:

erase nvram:

The following example erases all of partition 2 in internal Flash memory:

Router#erase flash:2

System flash directory, partition 2:
File  Length   Name/status
  1   1711088  dirt/images/c3600-i-mz
[1711152 bytes used, 15066064 available, 16777216 total]

Erase flash device, partition 2? [confirm]
Are you sure? [yes/no]: yes

Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased

The following example erases Flash memory when Flash is partitioned, but no partition is specified in the command:

Router#erase flash:

System flash partition information:
Partition   Size     Used    Free    Bank-Size   State       Copy-Mode
    1       4096K    2048K   2048K   2048K       Read Only   RXBOOT-FLH
    2       4096K    2048K   2048K   2048K       Read/Write  Direct

[Type ?<no> for partition directory; ? for full directory; q to abort]
Which partition? [default = 2]

The system will prompt only if there are two or more read/write partitions. If the partition entered is not valid or is the read-only partition, the process terminates. You can enter a partition number, a question mark (?) for a directory display of all partitions, or a question mark and a number (?number) for directory display of a particular partition. The default is the first read/write partition.

System flash directory, partition 2:
File  Length   Name/status
  1   3459720  master/igs-bfpx.100-4.3
[3459784 bytes used, 734520 available, 4194304 total]

Erase flash device, partition 2? [confirm] <Return>

Misconceptions:
None

Related Commands:
delete
copy
dir
cd


Command:

flash-update-threshold

Mode:

Router(config-router)#

Syntax:

flash-update-threshold seconds
no flash-update-threshold

Syntax Description:

seconds The time interval in seconds for which the suppression of flash updates can be configured.

Command Description:

To suppress regularly scheduled flash updates, use the flash-update-threshold command in router configuration mode. To return to the default state, use the no form of this command.

This command suppresses flash updates when the arrival of a regularly scheduled update matches the number of seconds that is configured with the seconds argument. The range of seconds that can be configure is from 0 to 30 seconds. If the number of seconds matches the number of seconds or is less than the number seconds that is configured with the seconds argument, the flash update is suppressed. If the numbers seconds until the flash update arrives exceeds the number of seconds that is configured with the seconds argument, the flash update is not suppressed. The regular scheduled interval for flash updates and the configuration of the suppression of flash updates can be verified with the show ip protocol command.

Example:

The following example configures a router to suppress a regularly scheduled flash update if the update is due in 10 seconds or less:

Router(config)#router rip
Router(config-router)# flash-update-threshold 10

Misconceptions:

None

Related Commands:

show ip protocols


Command:

hostname

Mode:

Router(config)#

Syntax:

hostname name

Syntax Description:

name

New host name for the network server.

Defaults

The factory-assigned default host name is Router.

Command Description:

To specify or modify the host name for the network server, use the hostname global configuration command.

The host name is used in prompts and default configuration filenames.

The name must also follow the rules for ARPANET host names. They must start with a letter, end with a letter or digit, and have as interior characters only letters, digits, and hyphens. Names must be 63 characters or fewer. For more information, refer to RFC 1035, Domain Names—Implementation and Specification.

Example:

The following example changes the host name to "sandbox":

      Router(config)#hostname sandbox

Misconceptions:

None.

Related Commands:

setup


Command:

ip cef

Mode:

Switch(config)#

Syntax:

ip cef [distributed]
no ip cef [distributed]

Syntax Description:

distributed (Optional) Enables distributed CEF (dCEF) operation. Distributes CEF information to line cards. Line cards perform express forwarding.

Command Description:

To enable Cisco Express Forwarding (CEF) on the Route Processor card, use the ip cef command in global configuration mode. To disable CEF, use the no form of this command.

CEF is disabled by default, excluding these platforms:

CEF is enabled on the Cisco 7100 series router.
CEF is enabled on the Cisco 7500 series Internet router.
Distributed CEF is enabled on the Cisco 6500 series router
Distributed CEF is enabled on the Cisco 12000 series Internet router.

This command is not available on the Cisco 12000 series because that router series operates only in dCEF mode.

CEF is advanced Layer 3 IP switching technology. CEF optimizes network performance and scalability for networks with dynamic, topologically dispersed traffic patterns, such as those associated with web-based applications and interactive sessions.

If you enable CEF and then create an access list that uses the log keyword, the packets that match the access list are not CEF switched. They are fast switched. Logging disables CEF.

Example:

The following example enables standard CEF operation:

Switch(config)#ip cef

The following example enables dCEF operation:

Switch(config)#ip cef distributed

Misconceptions:

None

Related Commands:

None


Command:

ip domain-list

Mode:

Router(config)#

Syntax:

ip domain-list name
no ip domain-list name

Syntax Description:

name Domain name. Do not include the initial period that separates an unqualified name from the domain name.

Command Description:

To define a list of default domain names to complete unqualified host names, use the ip domain-list\ global configuration command. To delete a name from a list, use the no form of this command.

If there is no domain list, the domain name that you specified with the ip domain-name global configuration command is used. If there is a domain list, the default domain name is not used. The ip domain-list command is similar to the ip domain-name command, except that with the ip domain-list command you can define a list of domains, each to be tried in turn.

Example:

The following example adds several domain names to a list:

Router(config)#ip domain-list company.com
Router(config)#ip domain-list school.edu
The following example adds a name to and then deletes a name from the list:
Router(config)#ip domain-list school.edu
Router(config)#no ip domain-list school.edu

Misconceptions:

None

Related Commands:

ip domain-name


%command%

Command:

ip http access-class

Mode:

Router(config)#

Syntax:

ip http access-class {access-list-number | access-list-name}

no ip http access-class {access-list-number | access-list-name}

Syntax Description:

access-list-number

Standard IP access list number in the range 0 to 99, as configured by the access-list (standard) global configuration command.

access-list-name

Name of a standard IP access list, as configured by the ip access-list command.

Command Description:

To assign an access list to the HTTP server used by the Cisco IOS ClickStart software or the Cisco Web browser UI, use the ip http access-class global configuration command. To remove the assigned access list, use the no form of this command.

Example:

The following example assigns the access list named marketing to the HTTP server:

ip http access-class marketing

ip access-list standard marketing

permit 192.168.34.0 0.0.0.255

permit 172.16.0.0 0.0.255.255

permit 10.0.0.0 0.255.255.255

! (Note: all other access implicitly denied)

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

ip irdp

Mode:

Router(config)#

Syntax:

ip irdp [multicast | holdtime seconds | maxadvertinterval seconds | minadvertinterval seconds | preference number | address address [number]]

no ip irdp

Syntax Description:

multicast | (Optional) Use the multicast address (224.0.0.1) instead of IP broadcasts.
holdtime seconds | (Optional) Length of time in seconds that advertisements are held valid. Default is three times the maxadvertinterval value. Must be greater than maxadvertinterval and cannot be greater than 9000 seconds.
maxadvertinterval seconds | (Optional) Maximum interval in seconds between advertisements. The range is from 1 to 1800. A value of 0 means only advertise when solicited. The default is 600 seconds.
minadvertinterval seconds | (Optional) Minimum interval in seconds between advertisements. The range is from 1 to 1800. The default is 450 seconds.
preference number | (Optional) Preference value. The allowed range is -231 to 231. The default is 0. A higher value increases the preference level of the router. You can modify a particular router so that it will be the preferred router to which other routers will home.
address address [number] | (Optional) IP address (address) to proxy advertise, and optionally, its preference value (number).

Command Description:

To enable ICMP Router Discovery Protocol (IRDP) processing on an interface, use the ip irdp interface configuration command. To disable IRDP routing, use the no formof this command.

Example:

The following running-config excerpt sets the various IRDP processes:

! enable irdp on interface Ethernet 0
interface ethernet 0
ip irdp

! send IRDP advertisements to the multicast address
ip irdp multicast

! increase router preference from 100 to 50

ip irdp preference 50

! set maximum time between advertisements to 400 secs
ip irdp maxadvertinterval 400

! set minimum time between advertisements to 100 secs
ip irdp minadvertinterval 100

! advertisements are good for 6000 seconds

ip irdp holdtime 6000

! proxy-advertise 131.108.14.5 with default router preference

ip irdp address 131.108.14.5

! proxy-advertise 131.108.14.6 with preference of 50
ip irdp address 131.108.14.6 50

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


Command:

ip telnet source-interface

Mode:

Router(config)#

Syntax:

ip telnet source-interface interface
no ip telnet source-interface

Syntax Description:

interface The interface whose address is to be used as the source for Telnet connections.

Command Description:

To specify the IP address of an interface as the source address for Telnet connections, use the ip telnet source-interface global configuration command. To reset the source address to the default for each connection, use the no form of this command.

Use this command to set the IP address of an interface as the source for all Telnet connections.

If the specified interface is not up, the Cisco IOS software selects the address of the interface closest to the destination as the source address.

Example:

The following example forces the IP address for Ethernet interface 1 as the source address for Telnet connections:

Router(config)# ip telnet source-interface Ethernet1

Misconceptions:

None

Related Commands:

None


Command:

logging buffered

Mode:

Router(config)#

Syntax:

logging buffered [buffer-size | level]
no logging buffered
default logging buffered

Syntax Description:

buffer-size | (Optional) Size of the buffer from 4096 to 4,294,967,295 bytes. The default size varies by platform.
level | (Optional) Limits the logging of messages to the buffer to a specified level. You can enter the level name or level number. See table below for a list of the accepatable level name or level number keywords.

Command Description:

To limit messages logged to an internal buffer based on severity, use the logging buffered global configuration command. To cancel the use of the buffer, use the no form of this command. The default form of this command returns the buffer size to the default size.

For most platforms, the Cisco IOS software logs messages to the internal buffer by default.

This command copies logging messages to an internal buffer. The buffer is circular in nature, so newer messages overwrite older messages after the buffer is filled.

Specifying a level causes messages at that level and numerically lower levels to be logged in an internal buffer. See table below for a list of level arguments.

Do not make the buffer size too large because the router could run out of memory for other tasks. You can use the show memory EXEC command to view the free processor memory on the router; however, this is the maximum available and should not be approached. The default logging buffered command resets the buffer size to the default for the platform.

To display the messages that are logged in the buffer, use the show logging EXEC command. The first message displayed is the oldest message in the buffer.

The show logging EXEC command displays the addresses and levels associated with the current logging setup, and any other logging statistics.

Error Message Logging Priorities and Corresponding Level Names/Numbers
Level Name | Level Number | Description | Syslog Definition
emergencies | 0 | System unusable | LOG_EMERG
alerts | 1 | Immediate action needed | LOG_ALERT
critical | 2 | Critical conditions | LOG_CRIT
errors | 3 | Error conditions | LOG_ERR
warnings | 4 | Warning conditions | LOG_WARNING
notifications | 5 | Normal but significant condition | LOG_NOTICE
informational | 6 | Informational messages only | LOG_INFO
debugging | 7 | Debugging messages | LOG_DEBUG

Example:

In the following example, the user enables logging to an internal buffer:

Router(config)# logging buffered

Misconceptions:

None

Related Commands:

None


 Command:

logging console

Mode:

Router(config)#

Syntax:

logging console level

no logging console

Syntax Description:

level

Limits the logging of messages displayed on the console terminal to a specified level. You can enter the level number or level name. See the table for a list of the level keywords.

Command Description:

To limit messages logged to the console based on severity, use the logging console global configuration command. The no form of this command disables logging to the console terminal.

Specifying a level causes messages at that level and numerically lower levels to be displayed at the console terminal.

The EXEC command show logging displays the addresses and levels associated with the current logging setup, as well as any other logging statistics. See Table below.

Table: Logging Console Error Message Logging Priorities
Level Keyword Level Description Syslog Definition

emergencies

0

System unusable

LOG_EMERG

alerts

1

Immediate action needed

LOG_ALERT

critical

2

Critical conditions

LOG_CRIT

errors

3

Error conditions

LOG_ERR

warnings

4

Warning conditions

LOG_WARNING

notifications

5

Normal but significant condition

LOG_NOTICE

informational

6

Informational messages only

LOG_INFO

debugging

7

Debugging messages

LOG_DEBUG

The effect of the log keyword with the IP access list (extended) command depends on the setting of the logging console command. The log keyword takes effect only if the logging console level is set to 6 or 7. If you change the default to a level lower than 6 and specify the log keyword with the IP access list (extended) command, no information is logged or displayed.
Example:

The following example changes the level of messages displayed to the console terminal to alerts, which means alerts and emergencies are displayed:

Router(config)#logging console alerts
Misconceptions:
None

Related Commands:
None


Command:

logging monitor

Mode:

Router(config)#

Syntax:

logging monitor [severity-level]
no logging monitor [severity-level]

Syntax Description:

severity-level Limits the logging of messages logged to the terminal lines (monitors) to a specified level. You can enter the level number or level name. See the table below for a list of acceptable severity-level keywords.

Command Description:

To limit messages logged to the terminal lines (monitors) based on severity, use the logging monitor global configuration command. This command limits the logging messages displayed on terminal lines other than the console line to messages with a level at or above the level argument. To disable logging to terminal lines other than the console line, use the no form of this command.

The default is set at debugging (severity-level 7).

Specifying a level causes messages at that level and numerically lower levels to be displayed to the monitor.

Error Message Logging Priorities and Corresponding Level Names/Numbers
Level Name | Level Number | Description | Syslog Definition
emergencies | 0 | System unusable | LOG_EMERG
alerts | 1 | Immediate action needed | LOG_ALERT
critical | 2 | Critical conditions | LOG_CRIT
errors | 3 | Error conditions | LOG_ERR
warnings | 4 | Warning conditions | LOG_WARNING
notifications | 5 | Normal but significant condition | LOG_NOTICE
informational | 6 | Informational messages only | LOG_INFO
debugging | 7 | Debugging messages | LOG_DEBUG

Example:

In the following example, the user specifies that only messages of the levels errors, critical, alerts, and emergencies be displayed on terminals:

Router(config)# logging monitor 3

Misconceptions:

None

Related Commands:

terminal monitor


Command:

logging on

Mode:

Router(config)#

Syntax:

logging on
no logging on

Syntax Description:

This command has no arguments or keywords.

Command Description:

To control logging of error messages, use the logging on global configuration command. This command sends debug or error messages to a logging process, which logs messages to designated locations asynchronously to the processes that generated the messages. To disable the logging process, use the no form of this command.

By default, the Cisco IOS software sends messages to the asynchronous logging process.

The logging process controls the distribution of logging messages to the various destinations, such as the logging buffer, terminal lines, or syslog server. You can turn logging on and off for these destinations individually using the logging buffered, logging monitor, and logging global configuration commands. However, if the logging on command is disabled, no messages will be sent to these destinations. Only the console will receive messages.

Additionally, the logging process logs messages to the console and the various destinations after the processes that generated them have completed. When the logging process is disabled, messages are displayed on the console as soon as they are produced, often appearing in the middle of command output.

The logging synchronous line configuration command also affects the displaying of messages to the console. When the logging synchronous command is enabled, messages will appear only after the user types a carriage return.

Example:

The following example shows command output and message output when logging is enabled. The ping process finishes before any of the logging information is printed to the console (or any other destination).

Router(config)# logging on
Router(config)# end
Router#
%SYS-5-CONFIG_I: Configured from console by console
Router# ping dirt
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.129, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 ms
Router#
IP: s=172.21.96.41 (local), d=172.16.1.129 (Ethernet1/0), len 100, sending
IP: s=171.69.1.129 (Ethernet1/0), d=172.21.96.41, len 114, rcvd 1
IP: s=172.21.96.41 (local), d=172.16.1.129 (Ethernet1/0), len 100, sending
IP: s=171.69.1.129 (Ethernet1/0), d=172.21.96.41, len 114, rcvd 1
IP: s=172.21.96.41 (local), d=172.16.1.129 (Ethernet1/0), len 100, sending
IP: s=171.69.1.129 (Ethernet1/0), d=172.21.96.41, len 114, rcvd 1
IP: s=172.21.96.41 (local), d=172.16.1.129 (Ethernet1/0), len 100, sending
IP: s=171.69.1.129 (Ethernet1/0), d=172.21.96.41, len 114, rcvd 1
IP: s=172.21.96.41 (local), d=172.16.1.129 (Ethernet1/0), len 100, sending
IP: s=171.69.1.129 (Ethernet1/0), d=172.21.96.41, len 114, rcvd 1

In the following example, logging is disabled. The message output is displayed as messages are generated, causing the debug messages to be interspersed with the message "Type escape sequence to abort."

Router(config)# no logging on
Router(config)# end
%SYS-5-CONFIG_I: Configured from console by console
Router#
Router# ping dirt
IP: s=172.21.96.41 (local), d=172.16.1.129 (Ethernet1/0), len 100, sendingTyp
IP: s=171.69.1.129 (Ethernet1/0), d=172.21.96.41, len 114, rcvd 1e
IP: s=172.21.96.41 (local), d=172.16.1.129 (Ethernet1/0), len 100, sending esc
IP: s=171.69.1.129 (Ethernet1/0), d=172.21.96.41, len 114, rcvd 1
IP: s=172.21.96.41 (local), d=172.16.1.129 (Ethernet1/0), len 100, sendingape
IP: s=171.69.1.129 (Ethernet1/0), d=172.21.96.41, len 114, rcvd 1
IP: s=172.21.96.41 (local), d=172.16.1.129 (Ethernet1/0), len 100, sendingse
IP: s=171.69.1.129 (Ethernet1/0), d=172.21.96.41, len 114, rcvd 1
IP: s=172.21.96.41 (local), d=172.16.1.129 (Ethernet1/0), len 100, sendingquen
IP: s=171.69.1.129 (Ethernet1/0), d=172.21.96.41, len 114, rcvd 1ce to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.129, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 152/152/156 ms
Router#

Misconceptions:

Disabling the logging on command will substantially slow down the router. Any process generating debug or error messages will wait until the messages have been displayed on the console before continuing.

Related Commands:

logging buffered
logging monitor
logging synchronous


Command:

logging synchronous

Mode:

Router(config-line)#

Syntax:

logging synchronous [level {severity-level | all}] [limit number-of-buffers]
no logging synchronous

Syntax Description:

level severity-level | all | (Optional) Specifies the message severity level. Messages with a severity level equal to or higher than this value are printed asynchronously. Low numbers indicate greater severity and high numbers indicate lesser severity. The all option specifies all messages are printed asynchronously, regardless of the severity level. The default value is 2.
limit number-of-buffers | (Optional) Specifies the number of buffers to be queued for the terminal after which new messages are dropped. The default value is 20.

Command Description:

To synchronize unsolicited messages and debug output with solicited Cisco IOS software output and prompts for a specific console port line, auxiliary port line, or vty, use the logging synchronous line configuration command. To disable synchronization of unsolicited messages and debug output, use the no form of this command.

This feature is turned off by default.

If you do not specify a severity level, the default value of 2 is assumed.

If you do not specify the maximum number of buffers to be queued, the default value of 20 is assumed.

When synchronous logging of unsolicited messages and debug output is turned on, unsolicited Cisco IOS software output is displayed on the console or printed after solicited Cisco IOS software output is displayed or printed. Unsolicited messages and debug output is displayed on the console after the prompt for user input is returned. To keep unsolicited messages and debug output from being interspersed with solicited software output and prompts. After the unsolicited messages are displayed, the console displays the user prompt again.

When specifying a severity level number, consider that for the logging system, low numbers indicate greater severity and high numbers indicate lesser severity.

When a message queue limit of a terminal line is reached, new messages are dropped from the line, although these messages might be displayed on other lines. If messages are dropped, the notice "%SYS-3-MSGLOST number-of-messages due to overflow" follows any messages that are displayed. This notice is displayed only on the terminal that lost the messages. It is not sent to any other lines, any logging servers, or the logging buffer.

Example:

In the following example, line 4 is identified and synchronous logging for line 4 is enabled with a severity level of 6. Then another line, line 2, is identified and the synchronous logging for line 2 is enabled with a severity level of 7 and is specified with a maximum number of buffers to be 70,000.

Router(config)# line 4
Router(config-line)# logging synchronous level 6
Router(config-line)# line 2
Router(config-line)# logging synchronous level 7 limit 70000

Misconceptions:

Caution By configuring abnormally large message queue limits and setting the terminal to "terminal monitor" on a terminal that is accessible to intruders, you expose yourself to "denial of service" attacks. An intruder could carry out the attack by putting the terminal in synchronous output mode, making a Telnet connection to a remote host, and leaving the connection idle. This could cause large numbers of messages to be generated and queued, and these messages would unlikely consume all available RAM. You should guard against this type of attack through proper configuration.

Related Commands:

line
logging on


Command:

logging trap

Mode:

Router(config)#

Syntax:

logging trap level
no logging trap

Syntax Description:

level Limits the logging of messages to the syslog servers to a specified level. You can enter the level number or level name. See the table below for a list of acceptable level keywords.

Command Description:

To limit messages logged to the syslog servers based on severity, use the logging trap global configuration command. The command limits the logging of error messages sent to syslog servers to only those messages at the specified level. To disable logging to syslog servers, use the no form of this command.

The default is informational (level 6).

The show logging EXEC command displays the addresses and levels associated with the current logging setup. The command output also includes ancillary statistics.

Use the logging and logging trap commands to send messages to a UNIX syslog server.
Level Name | Level Number | Description | Syslog Definition
emergencies | 0 | System unusable | LOG_EMERG
alerts | 1 | Immediate action needed | LOG_ALERT
critical | 2 | Critical conditions | LOG_CRIT
errors | 3 | Error conditions | LOG_ERR
warnings | 4 | Warning conditions | LOG_WARNING
notifications | 5 | Normal but significant condition | LOG_NOTICE
informational | 6 | Informational messages only | LOG_INFO
debugging | 7 | Debugging messages | LOG_DEBUG

Example:

In the following example, the messages to a host named john is logged:

Router(config)# logging john
Router(config)# logging trap notifications

Misconceptions:

None

Related Commands:

None


Command:

logging

Mode:

Router(config)#

Syntax:

logging host-name
no logging host-name

Syntax Description:

host-name

Name or IP address of the host to be used as a syslog server.

Defaults

No messages are logged to a syslog server host.

Command Description:

To log messages to a syslog server host, use the logging global configuration command. To delete the syslog server with the specified address from the list of syslogs, use the no form of this command.

This command identifies a syslog server host to receive logging messages. By issuing this command more than once, you build a list of syslog servers that receive logging messages.

Example:

In the following example, messages are logged to a host named john:

logging john

Misconceptions:

None.

Related Commands:

logging trap


%command%

Command:

refuse-message

Mode:

Router(config-line)#

Syntax:

refuse-message d message d

no refuse-message

Syntax Description:

d | Delimiting character of your choice—a pound sign (#), for example. You cannot use the delimiting character in the message.
message | Message text.

Command Description:

To define and enable a line-in-use message, use the refuse-message line configuration command. To disable the message, use the no form of this command.

Example:

In the following example, line 5 is configured with a line-in-use message, and the user is instructed to try again later:

Router(config)#line 5

Router(config-line)#refuse-message /The dial-out modem is currently in use. Please try again later./

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


 Command:

reload

Mode:

Router#

Syntax:

reload [text | in [hh:]mm [text] | at hh:mm [month day | day month] [text] | cancel]

Syntax Description:

text

(Optional) Reason for the reload, 1 to 255 characters long.

in [hh:]mm

(Optional) Schedule a reload of the software to take effect in the specified minutes or hours and minutes. The reload must take place within approximately 24 days.

at hh:mm

(Optional) Schedule a reload of the software to take place at the specified time (using a 24-hour clock). If you specify the month and day, the reload is scheduled to take place at the specified time and date. If you do not specify the month and day, the reload takes place at the specified time on the current day (if the specified time is later than the current time), or on the next day (if the specified time is earlier than the current time). Specifying 00:00 schedules the reload for midnight. The reload must take place within approximately 24 days.

month

(Optional) Name of the month, any number of characters in a unique string.

day

(Optional) Number of the day in the range 1 to 31.

cancel

(Optional) Cancel a scheduled reload.

Command Description:

To reload the operating system, use the reload EXEC command.

The reload command halts the system. If the system is set to restart on error, it reboots itself. Use the reload command after configuration information is entered into a file and saved to the startup configuration.

You cannot reload from a virtual terminal if the system is not set up for automatic booting. This prevents the system from dropping to the ROM monitor and thereby taking the system out of the remote user's control.

If you modify your configuration file, the system prompts you to save the configuration. During a save operation, the system asks you if you want to proceed with the save if the CONFIG_FILE environment variable points to a startup configuration file that no longer exists. If you say "yes" in this situation, the system goes to setup mode upon reload.

When you schedule a reload to occur at a later time, it must take place within approximately 24 days.

The at keyword can only be used if the system clock has be set on the router (either through NTP, the hardware calendar, or manually). The time is relative to the configured time zone on the router. To schedule reloads across several routers to occur simultaneously, the time on each router must be synchronized with NTP.

To display information about a scheduled reload, use the show reload command.

Example:

The following example immediately reloads the software on the router:

Router#reload

The following example reloads the software on the router in 10 minutes:

Router#reload in 10

Router# Reload scheduled for 11:57:08 PDT Fri Apr 21 1996 (in 10 minutes)
Proceed with reload? [confirm]
Router#

The following example reloads the software on the router at 1:00 p.m. today:

Router#reload at 13:00

Router# Reload scheduled for 13:00:00 PDT Fri Apr 21 1996 (in 1 hour and 2 minutes)
Proceed with reload? [confirm]
Router#

The following example reloads the software on the router on April 20 at 2:00 a.m.:

Router#reload at 02:00 apr 20

Router# Reload scheduled for 02:00:00 PDT Sat Apr 20 1996 (in 38 hours and 9 minutes)
Proceed with reload? [confirm]
Router#

The following example cancels a pending reload:

Router#reload cancel

%Reload cancelled.

Misconceptions:

None

Related Commands:
None


Command:

send

Mode:

Router#

Syntax:

send {line-number | * | aux number | console number | tty number | vty number}

Syntax Description:

line-number | Line number to which the message will be sent
* Sends a message to all TTY lines
aux line-number | Sends a message to the AUX port
console line-number | Sends a message to the console port

tty line-number

 Sends a message to an asynchronous line

vty line-number

 Sends a message to a VTY

Command Description:

To send messages to one or all terminal lines, use the send EXEC command.

Example:

Router#send *

  Enter message, end with CTRL/Z; abort with CTRL/C:

  Router going offline in 10 minutes.^Z

  Send message? [confirm]

  Router#

Misconceptions:

None

Related Commands:

None


Command:

service password-encryption

Mode:

Router(config)#

Syntax:

service password-encryption

no service password-encryption

Syntax Description:

This command has no arguments or keywords.

Command Description:

To encrypt passwords, use the service password-encryption command in global configuration mode. To restore the default, use the no form of this command.

The actual encryption process occurs when the current configuration is written or when a password is configured. Password encryption is applied to all passwords, including username passwords, authentication key passwords, the privileged command password, console and virtual terminal line access passwords, and Border Gateway Protocol neighbor passwords. This command is primarily useful for keeping unauthorized individuals from viewing your password in your configuration file.

When password encryption is enabled, the encrypted form of the passwords is displayed when a more system:running-config command is entered.

Example:

The following example causes password encryption to take place:

service password-encryption

Misconception

This command does not provide a high level of network security. If you use this command, you should also take additional network security measures.

Related Commands

enable password
key-string (authentication)


Command:

service timestamps

Mode:

Router(config)#

Syntax:

service timestamps message-type [uptime]
service timestamps message-type datetime [msec] [localtime] [show-timezone]
no service timestamps type

Syntax Description:

message-type | Type of message to time stamp: debug or log.
uptime | (Optional) Time stamp with the time since the system was rebooted.
datetime | Time stamp with the date and time.
msec | (Optional) Include milliseconds in the date and time stamp.
localtime | (Optional) Time stamp relative to the local time zone.
show-timezone | (Optional) Include the time zone name in the time stamp.

Command Description:

To configure the system to time-stamp debugging or logging messages, use one of the service timestamps global configuration commands. To disable this service, use the no form of this command.

Time stamps can be added to either debugging or logging messages independently. The uptime form of the command adds time stamps in the format HHHH:MM:SS, indicating the time since the system was rebooted. The datetime form of the command adds time stamps in the format MMM DD HH:MM:SS, indicating the date and time according to the system clock. If the system clock has not been set, the date and time are preceded by an asterisk (*) to indicate that the date and time are probably not correct.

By default:

No time-stamping.

If the service timestamps command is specified with no arguments or keywords, the default is service timestamps debug uptime.

The default for the service timestamps type datetime command is to format the time in Coordinated Universal Time (UTC), with no milliseconds and no time zone name.

The no service timestamps command by itself disables time stamps for both debug and log messages

Example:

In the following example, the user enables time stamps on debugging messages, showing the time since reboot:

Router(config)# service timestamps debug uptime

In the following example, the user enables time stamps on logging messages, showing the current time and date relative to the local time zone, with the time zone name included:

Router(config)# service timestamps log datetime localtime show-timezone

Misconceptions:

None

Related Commands:

clock set


%command%

Command:

service-policy output

Mode:

Router(config-if)#

Router(config-map-class)#

Syntax:

service-policy {input | output} policy-map-name

no service-policy {input | output} policy-map-name

Syntax Description:

Input | Attaches the specified policy map to the input interface or input VC.
output | Attaches the specified policy map to the output interface or output VC.
policy-map-name | The name of a service policy map (created using the policy-map command) to be attached.

Command Description:

To attach a policy map to an input interface or virtual circuit (VC), or an output interface or VC, to be used as the service policy for that interface or VC, use the service-policy interface configuration command. To remove a service policy from an input or output interface or input or output VC, use the no form of this command.

Example:

The following example shows how to attache the service policy map called policy9 to data-link connection identifier (DLCI) 100 on output serial interface 1 and enables LLQ for Frame Relay:

interface Serial 1/0.1 point-to-point

frame-relay interface-dlci 100

class fragment

!

map-class frame-relay fragment

service-policy output policy9

The following example attaches the service policy map called policy9 to input serial interface 1:

interface Serial 1

service-policy input policy9

The following example attaches the service policy map called policy9 to the input PVC called cisco:

pvc cisco 0/34
service-policy input policy9

vbr-nt 5000 3000 500
precedence 4-7

The following example attaches the policy called policy9 to output serial interface 1 to specify the service policy for the interface and enable CBWFQ on it:

interface serial 1

service-policy output policy9

The following example attaches the service policy map called policy9 to the output PVC called cisco:

pvc cisco 0/5
service-policy output policy9
vbr-nt 4000 2000 500
precedence 2-3

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


 Command:

setup

Mode:

Router#

Syntax:

setup

Syntax Description:

This command has no arguments or keywords.

Command Description:
To enter the setup command facility, use the setup privileged EXEC command. You can use the setup command facility to create a basic configuration to get a router up and running, but for advanced features and fine tuning of router processes, use the command line. You might want to use setup to add a protocol suite, to make major addressing scheme changes, or to configure a newly installed interface. While you can use the command parser to make these major changes, the setup command facility provides you with a high-level view of the configuration and guides you through the configuration change process.

Additionally, if you are not familiar with Cisco products and the command parser, the setup command facility is a particularly valuable tool because it asks you the questions required to make configuration changes.

Note If you use setup to modify a configuration because you have added or modified the hardware, be sure to verify the physical connections using the show version command. Also, verify the logical port assignments using the show running-config command to ensure that you configure the correct port. Refer to your platform's hardware publications for details on physical and logical port assignments.

Whenever you use the setup command facility, be sure that you have the following information:

  • Interfaces the router has
  • Protocols the router is routing
  • Whether the router is to perform bridging
  • Network addresses for the protocols being configured
  • Password strategy for your environment

When you enter the setup command facility after first-time startup, an interactive dialog called the System Configuration Dialog appears on the system console screen. The System Configuration Dialog guides you through the configuration process. It prompts you first for global parameters and then for interface parameters. The values shown in brackets next to each prompt are the default values last set using either the setup command facility or the configure command.

Note The prompts and the order in which they appear on the screen vary depending on the platform and the interfaces installed in the device.

You must run through the entire System Configuration Dialog until you come to the item that you intend to change. To accept default settings for items that you do not want to change, press the Enter key.

To return to the privileged EXEC prompt without making changes and without running through the entire System Configuration Dialog, press Ctrl-C.

The facility also provides help text for each prompt. To access help text, press the question mark (?) key at a prompt.

When you complete your changes, the setup command facility shows you the configuration command script that was created during the setup session. The router displays the following options:

[0] Go to the IOS command prompt without saving this config.
[1] Return back to the setup without saving this config.
[2] Save this configuration to nvram and exit. Enter your selection [2]:

The Cisco IOS software automatically puts you in the streamlined setup command facility when your router is accidentally or intentionally rebooted (or you are attempting to load a system image from a network server) after any of the following circumstances:

  • You issued an erase startup-config or erase nvram command, thereby deleting the startup configuration file.
  • You have bit 6 (ignore NVRAM configuration) set in the configuration register.
  • Your startup configuration has been corrupted.
  • You configured the router to boot from a network server (the last four bits of the configuration register are not equal to 0 or 1) and there is no Flash or no valid image in Flash.
  • You configured the router to boot the RXBOOT image.

The streamlined setup command facility permits your router to load a system image from a network server when there are problems with the startup configuration.

The streamlined setup command facility differs from the standard setup command facility because the streamlined facility does not ask you to configure global router parameters. You are prompted only to configure interface parameters, which permit your router to boot.

The streamlined setup command facility is available only if your router is running from ROM monitor and has RXBOOT ROMs installed. The following routers can have this type of ROM installed:

  • Cisco 2500 running the IGS-RXBOOT image
  • Cisco 3000 running the IGS-RXBOOT image
  • Cisco 4000 running the XX-RXBOOT image
  • Other routers running the RXBOOT image

Examples:

The following example shows how to use the setup command facility to configure interface serial 0/0 and to add ARAP and IP/IPX PPP support on the asynchronous interfaces.

Router#setup
         --- System Configuration Dialog ---
At any point you may enter a question mark '?' for help.
Use ctrl-c to abort configuration dialog at any prompt.
Default settings are in square brackets '[]'.
Continue with configuration dialog? [yes]:
First, would you like to see the current interface summary? [yes]:
Interface          IP-Address      OK?  Method    Status                 Protocol
FastEthernet0/0         172.16.72.2     YES  manual    up                     up
Serial0            unassigned      YES  not set   administratively down  down
Serial1            172.16.72.2     YES  not set   up                     up
Configuring global parameters:
  Enter host name [Router]:
The enable secret is a one-way cryptographic secret used
instead of the enable password when it exists.
  Enter enable secret [<Use current secret>]:
The enable password is used when there is no enable secret
and when using older software and some boot images.
  Enter enable password [ww]:
  Enter virtual terminal password [ww]:
  Configure SNMP Network Management? [yes]:
    Community string [public]:
  Configure DECnet? [no]:
  Configure AppleTalk? [yes]:
    Multizone networks? [no]: yes
  Configure IPX? [yes]:
  Configure IP? [yes]:
    Configure IGRP routing? [yes]:
      Your IGRP autonomous system number [15]:
  Configure Async lines? [yes]:
    Async line speed [9600]: 57600
    Configure for HW flow control? [yes]:
    Configure for modems? [yes/no]: yes
      Configure for default chat script? [yes]: no
    Configure for Dial-in IP SLIP/PPP access? [no]: yes
      Configure for Dynamic IP addresses? [yes]: no
      Configure Default IP addresses? [no]: yes
      Configure for TCP Header Compression? [yes]: no
      Configure for routing updates on async links? [no]:
    Configure for Async IPX? [yes]:
    Configure for Appletalk Remote Access? [yes]:
      AppleTalk Network for ARAP clients [1]: 20
      Zone name for ARAP clients [ARA Dialins]:
Configuring interface parameters:
Configuring interface FastEthernet0/0:
  Is this interface in use? [yes]:
  Configure IP on this interface? [yes]:
    IP address for this interface [172.16.72.2]:
    Number of bits in subnet field [8]:
    Class B network is 172.16.0.0, 8 subnet bits; mask is /24
  Configure AppleTalk on this interface? [yes]:
    Extended AppleTalk network? [yes]:
    AppleTalk starting cable range [1]:
    AppleTalk ending cable range [1]:
    AppleTalk zone name [Sales]:
    AppleTalk additional zone name:
  Configure IPX on this interface? [yes]:
    IPX network number [1]:
Configuring interface Serial0:
  Is this interface in use? [no]: yes
  Configure IP on this interface? [no]: yes
  Configure IP unnumbered on this interface? [no]: yes
    Assign to which interface [FastEthernet0/0]:
  Configure AppleTalk on this interface? [no]: yes
    Extended AppleTalk network? [yes]:
    AppleTalk starting cable range [2]: 3
    AppleTalk ending cable range [3]: 3
    AppleTalk zone name [myzone]: ZZ Serial
    AppleTalk additional zone name:
  Configure IPX on this interface? [no]: yes
    IPX network number [2]: 3
Configuring interface Serial1:
  Is this interface in use? [yes]:
  Configure IP on this interface? [yes]:
  Configure IP unnumbered on this interface? [yes]:
    Assign to which interface [FastEthernet0/0]:
  Configure AppleTalk on this interface? [yes]:
    Extended AppleTalk network? [yes]:
    AppleTalk starting cable range [2]:
    AppleTalk ending cable range [2]:
    AppleTalk zone name [ZZ Serial]:
    AppleTalk additional zone name:
  Configure IPX on this interface? [yes]:
    IPX network number [2]:
Configuring interface Async1:
    IPX network number [4]:
    Default client IP address for this interface [none]: 172.16.72.4
Configuring interface Async2:
    IPX network number [5]:
    Default client IP address for this interface [172.16.72.5]:
Configuring interface Async3:
    IPX network number [6]:
    Default client IP address for this interface [172.16.72.6]:
Configuring interface Async4:
    IPX network number [7]:
    Default client IP address for this interface [172.16.72.7]:
Configuring interface Async5:
    IPX network number [8]:
    Default client IP address for this interface [172.16.72.8]:
Configuring interface Async6:
    IPX network number [9]:
    Default client IP address for this interface [172.16.72.9]:
Configuring interface Async7:
    IPX network number [A]:
    Default client IP address for this interface [172.16.72.10]:
Configuring interface Async8:
    IPX network number [B]:
    Default client IP address for this interface [172.16.72.11]:
Configuring interface Async9:
    IPX network number [C]:
    Default client IP address for this interface [172.16.72.12]:
Configuring interface Async10:
    IPX network number [D]:
    Default client IP address for this interface [172.16.72.13]:
Configuring interface Async11:
    IPX network number [E]:
    Default client IP address for this interface [172.16.72.14]:
Configuring interface Async12:
    IPX network number [F]:
    Default client IP address for this interface [172.16.72.15]:
Configuring interface Async13:
    IPX network number [10]:
    Default client IP address for this interface [172.16.72.16]:
Configuring interface Async14:
    IPX network number [11]:
    Default client IP address for this interface [172.16.72.17]:
Configuring interface Async15:
    IPX network number [12]:
    Default client IP address for this interface [172.16.72.18]:
Configuring interface Async16:
    IPX network number [13]:
    Default client IP address for this interface [172.16.72.19]:
The following configuration command script was created:
hostname Router
enable secret 5 $1$krIg$emfYm/1OwHVspDuS8Gy0K1
enable password ww
line vty 0 4
password ww
snmp-server community public
!
no decnet routing
appletalk routing
ipx routing
ip routing
!
line 1 16
speed 57600
flowcontrol hardware
modem inout
!
arap network 20 ARA Dialins
line 1 16
arap enable
autoselect
!
! Turn off IPX to prevent network conflicts.
interface FastEthernet0/0
no ipx network
interface Serial0
no ipx network
interface Serial1
no ipx network
!
interface FastEthernet0/0
ip address 172.16.72.2 255.255.255.0
appletalk cable-range 1-1 1.204
appletalk zone Sales
ipx network 1
no mop enabled
!
interface Serial0
no shutdown
no ip address
ip unnumbered FastEthernet0/0
appletalk cable-range 3-3
appletalk zone ZZ Serial
ipx network 3
no mop enabled
!
interface Serial1
no ip address
ip unnumbered FastEthernet0/0
appletalk cable-range 2-2 2.2
appletalk zone ZZ Serial
ipx network 2
no mop enabled
!
Interface Async1
ipx network 4
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.4
async mode interactive
!
Interface Async2
ipx network 5
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.5
async mode interactive
!
Interface Async3
ipx network 6
ip unnumbered Ethernet0/0
peer default ip address 172.16.72.6
async mode interactive
!
Interface Async4
ipx network 7
ip unnumbered Ethernet0/0
peer default ip address 172.16.72.7
async mode interactive
async dynamic address
!
Interface Async5
ipx network 8
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.8
async mode interactive
!
Interface Async6
ipx network 9
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.9
async mode interactive
!
Interface Async7
ipx network A
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.10
async mode interactive
!
Interface Async8
ipx network B
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.11
async mode interactive
!
Interface Async9
ipx network C
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.12
async mode interactive
!
Interface Async10
ipx network D
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.13
async mode interactive
!
Interface Async11
ipx network E
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.14
async mode interactive
!
Interface Async12
ipx network F
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.15
async mode interactive
!
Interface Async13
ipx network 10
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.16
async mode interactive
!
Interface Async14
ipx network 11
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.17
async mode interactive
!
Interface Async15
ipx network 12
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.18
async mode interactive
!
Interface Async16
ipx network 13
ip unnumbered FastEthernet0/0
peer default ip address 172.16.72.19
async mode interactive
!
router igrp 15
network 172.16.0.0
!
end
Use this configuration? [yes/no]: yes

Building configuration...
Use the enabled mode 'configure' command to modify this configuration.

Router#

The following example shows a router entering the streamlined setup command facility:

---
System Configuration Dialog ---
Default settings are in square brackets
  '[]'.
Configuring interface IP parameters for netbooting:

Note The message "Configuring interface IP parameters for netbooting" only appears if you are booting over a network server and your configuration has insufficient IP information.

The streamlined setup command facility continues by prompting you for interface parameters for each installed interface. The facility asks if an interface is in use. If so, the facility then prompts you to provide an IP address and subnet mask bits for the interface. Enter the subnet mask bits as a decimal value, such as 5. Continuing with the streamlined setup command facility example, the following output shows the portion of the facility that prompts for interface parameters. In the example, the facility is prompting for FastEthernet 0/0 interface parameters and Serial 0 interface parameters:

Configuring interface FastEthernet0/0:
  Is this interface in use? [yes]:
  Configure IP on this interface? [yes]:
    IP address for this interface: 192.195.78.50
    Number of bits in subnet field [0]: 5
    Class C network is 192.195.78.0, 5 subnet bits; mask is 255.255.255.248
Configuring interface Serial0:
  Is this interface in use? [yes]:
  Configure IP on this interface? [yes]:
    IP address for this interface: 192.195.78.34
    Number of bits in subnet field [5]:
    Class C network is 192.195.78.0, 5 subnet bits; mask is 255.255.255.248

The configuration information you provide on this screen is temporary and exists only so that you can proceed with booting your system. When you reload the system, your original configuration is left intact. If your startup configuration is corrupted, enter the setup command facility, and configure the basic parameters. Then issue the copy running-config startup-config or copy system:running-config nvram:startup-config command to write this configuration to NVRAM.

Misconceptions:
None

Related Commands:
show version
configure


 Command:

squeeze

Mode:

Switch#
Router#

Syntax:

squeeze filesystem:

Syntax Description:

filesystem:

Flash file system followed by a colon.

Command Description:

To permanently delete Flash files by squeezing a Class A Flash file system, use the squeeze EXEC command.

When Flash memory is full, you might need to rearrange the files so that the space used by the files marked "deleted" can be reclaimed. When you issue the squeeze command, the router copies all valid files to the beginning of Flash memory and erases all files marked "deleted." At this point, you cannot recover "deleted" files and you can write to the reclaimed Flash memory space.

In addition to removing deleted files, the squeeze command removes any files that the system has marked as error. An error file is created when a file write fails (for example, the device is full). To remove error files, you must use the squeeze command.
Example:

The following example instructs the router to permanently erase the files marked "deleted" from the Flash memory card inserted in slot 1:

Router#squeeze slot1:
Misconceptions:

The squeeze operation might take as long as several minutes because it can involve erasing and rewriting almost an entire Flash memory space

Related commands:
delete
erase
dir
cd


Command:

traceroute

Mode:

Router#

Syntax:

traceroute

Syntax Description:

Protocol [ip]: Prompts for a supported protocol. Enter appletalk, clns, ip, novell, apollo, vines, decnet, or xns. Default: ip.
Target IP address: You must enter a host name or an IP address. There is no default.
Source address: The interface or IP address of the router to use as a source address for the probes. The router normally picks the IP address of the outbound interface to use.
Numeric display [n]: The default is to have both a symbolic and numeric display; however, you can suppress the symbolic display.
Timeout in seconds [3]: The number of seconds to wait for a response to a probe packet. The default is 3 seconds.
Probe count [3]: The number of probes to be sent at each TTL level. The default count is 3.
Minimum Time to Live [1]: The TTL value for the first probes. The default is 1, but it can be set to a higher value to suppress the display of known hops.
Maximum Time to Live [30]: The largest TTL value that can be used. The default is 30. The traceroute command terminates when the destination is reached or when this value is reached.
Port Number [33434]: The destination port used by the UDP probe messages. The default is 33434.
Loose, Strict, Record, Timestamp, Verbose[none]: IP header options. You can specify any combination. The traceroute command issues prompts for the required fields. Note that the traceroute command will place the requested options in each probe; however, there is no guarantee that all routers (or end nodes) will process the options.

Command Description:

The purpose behind the traceroute command is to record the source of each ICMP "time exceeded" message to provide a trace of the path the packet took to reach the destination.

Example:

The following is sample output from the traceroute command:

Router#traceroute
Protocol [ip]:
Target IP address: 192.168.40.2
!--- The address to which the path is being traced.
Source address: 172.16.23.2
Numeric display [n]:
Timeout in seconds [3]:
Probe count [3]:
Minimum Time to Live [1]:
Maximum Time to Live [30]:
Port Number [33434]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Type escape sequence to abort.
Tracing the route to 192.168.40.2
  1 172.31.20.2 16 msec 16 msec 16 msec
  2 172.20.10.2 28 msec 28 msec 32 msec
  3 192.168.40.2 32 msec 28 msec *
!--- Traceroute is successful.

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

terminal editing

Mode:

Router#

Syntax:

terminal editing

terminal no editing

Syntax Description:

This command has no arguments or keywords.

Command Description:

To reenable the enhanced editing mode for only the current terminal session, use the terminal editing EXEC command. To disable the enhanced editing mode on the current line, use the no form of this command.

Example:

In the following example, enhanced editing mode is reenabled for only the current terminal session:

Router> terminal editing

Misconceptions:

This command is identical to the editing EXEC mode command, except that it controls (enables or disables) enhanced editing for only the terminal session you are using.

Related Commands:

None


Command:

terminal history size

Mode:

Router#

Syntax:

terminal history size number-of-lines

no terminal history size

Syntax Description:

number-of-lines

Number of command lines that the system will record in its history buffer. The range is from 0 to 256. The default is 10.

Defaults

10 lines of command history

Command Description:

To change the size of the command history buffer for the current terminal session, use the terminal history size EXEC mode command. To reset the command history buffer to its default size of 10 lines, use the no form of this command.

The history feature provides a record of commands you have entered. This feature is particularly useful for recalling long or complex commands or entries for the purposes of modifying them slightly and reissuing them.

The terminal history size command enables the command history feature and sets the command history buffer size. The terminal no history size command resets the buffer size to the default of 10 command lines.

Example:

In the following example, the number of command lines recorded is set to 15 for the current terminal session. The user then checks to see what line he/she is connected to using the show users command. The user uses this line information to issue the show line command. (In this example, the user uses the show begin option in the show line command to start the output at the "Editing is enabled/disabled" line).

Router# terminal history size 15

Router# show users

Line User Host(s) Idle Location

* 50 vty 0 admin idle 00:00:00

! the * symbol indicates the active terminal session for the user (line 50)

Router# show line 50 | begin Editing

Editing is enabled.

! the following line shows the history settings for the line

History is enabled, history size is 15.

DNS resolution in show commands is enabled

Full user help is disabled

Allowed transports are telnet. Preferred is none.

No output characters are padded

No special data dispatching characters

Misconceptions:

None.

Related Commands:

show history


Command:

terminal monitor

Mode:

Router#

Syntax:

table-map map-name
no table-map map-name

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display debug command output and system error messages for the current terminal and session, use the terminal monitor EXEC command.

Remember that all terminal parameter-setting commands are set locally and do not remain in effect after a session is ended.

Example:

In the following example the system is configured to display debug command output and error messages during the current terminal session:

Router#terminal monitor

Misconceptions:

None

Related Commands:

None


%command%

Command:

vacant-message

Mode:

Router(config-line)#

Syntax:

vacant-message [d message d]

no vacant-message

Syntax Description:

d | (Optional) Delimiting character that marks the beginning and end of the vacant-message. Text delimiters are characters that do not ordinarily appear within the text of a title, such as slash ( / ), double quote ("), or tilde (~). ^C is reserved for special use and should not be used in the message.
message | (Optional) Vacant terminal message.

Command Description:

To display an idle terminal message, use the vacant-message line configuration command. To remove the default vacant message or any other vacant message that may have been set, use the no form of this command.

Example:

The following example turns on the system banner and displays this message:

Router(config)#line 0

Router(config-line)#vacant-message # Welcome to Cisco Systems, Inc. Press Return to get started. #

Misconceptions:

None

Related commands:

banner motd

refuse-message

© Cisco Systems, Inc. 2001, 2002


 Command:

write

Mode:

Router#

Syntax:

write [ erase | memory | network | terminal | ]

Syntax Description:
erase | Erases the startup-configuration
memory | Writes the running-configuration to the startup-configuration
terminal | Dumps the running-configuration to the terminal (console/line)
network | Dumps the startup-configuration to a tftp-server

Command Description:

The default write command without any parameters is the same as "write memory." See write memory for more information about this topic. This command provides several different methods for output of configuration files. Much of the same functionality can be accomplished using the copy command.

Example:
Router#write

Misconceptions:
This command has been replaced with the command copy run start

Related commands:
copy
write memory


 Command:

write erase

Mode:

Router#

Syntax:

write erase

Syntax Description:
erase Clear the Flash memory configuration.

Command Description:

This command erases the startup-config in NVRAM.

Example:

Router#write erase

Misconceptions:
None

Related commands:
write memory


 Command:

write memory

Mode:

Router#

Syntax:

write memory

Syntax Description:
memory Store current configuration in Flash memory.

Command Description:

This command copies the running-config to the startup-config. In fact, it is basically the same command. Copy running-config startup-config is preferred.

Example:

Router#write memory

Misconceptions:
None.

Related commands:
copy
write erase


Command:

xmodem

Mode:

rommon>

Syntax:

xmodem [-c] [-y] [-e] [-f] [-r] [-x] [-s data-rate] [filename]

Syntax Description:

-c

(Optional) CRC-16 checksumming, which is more sophisticated and thorough than standard checksumming.

-y

(Optional) Uses the Ymodem protocol for higher throughput.

-e

(Optional) Erases the first partition in Flash memory before starting the download. This option is only valid for the Cisco 1600 series.

-f

(Optional) Erases all of Flash memory before starting the download. This option is only valid for the Cisco 1600 series.

-r

(Optional) Downloads the file to DRAM. The default is Flash memory.

-x

(Optional) Do not execute Cisco IOS image on completion of the download.

-s data-rate

(Optional) Sets the console port's data rate during file transfer. Values are 1200, 2400, 4800, 9600, 19200, 38400, and 115200 bps. The default rate is specified in the configuration register. This option is only valid for the Cisco 1600 series.

filename

(Optional) Filename to copy. This argument is ignored when the -r keyword is specified, because only one file can be copied to DRAM. On the Cisco 1600 series routers, files are loaded to the ROM for execution.

Defaults

Xmodem protocol with 8-bit CRC, file downloaded into Flash memory and executed on completion.

Command Description:

To copy a Cisco IOS image to a router using the ROM monitor and the Xmodem or Ymodem protocol, use the xmodem ROM monitor command.

The Cisco 3600 series routers does not support XBOOT functionality. If your Cisco IOS image is erased or damaged, you cannot load a new image over the network.

Use the xmodem ROM monitor command to download a new system image to your router from a local personal computer (such as a PC, Mac, or UNIX workstation), or a remote computer over a modem connection, to the router's console port. The computer must have a terminal emulation application that supports these protocols.

Cisco 3600 Series Routers

Your router must have enough DRAM to hold the file being transferred, even if you are copying to Flash memory. The image is copied to the first file in internal Flash memory. Any existing files in Flash memory are erased. There is no support for partitions or copying as a second file.

Cisco 1600 Series Routers

If you include the -r option, your router must have enough DRAM to hold the file being transferred. To run from Flash, an image must be positioned as the first file in Flash memory. If you are copying a new image to boot from Flash, erase all existing files first.

Caution: A modem connection from the telephone network to your console port introduces security issues that you should consider before enabling the connection. For example, remote users can dial in to your modem and access the router's configuration settings.

Note: If the file to be downloaded is not a valid router image, the copy operation is automatically terminated.

Example:

The following example uses the xmodem -c filename ROM monitor command to copy the file named new-ios-image from a remote or local computer:

rommon > xmodem -c new-ios-image

Do not start the sending program yet...

File size Checksum File name

1738244 bytes (0x1a8604) 0xdd25 george-admin/c3600-i-mz

WARNING: All existing data in bootflash will be lost!

Invoke this application only for disaster recovery.

Do you wish to continue? y/n [n]: yes

Ready to receive file new-ios-image ...

Misconceptions:

None.

Related Commands:

copy


 Command:

show cdp

Mode:

Router#

Syntax:

show cdp

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display global CDP information, including timer and hold-time information, use the show cdp privileged EXEC command.

Example:

The following is sample output from the show cdp command. Global CDP timer and hold-time parameters are set to the defaults of 60 and 180 seconds, respectively.

Router#show cdp

Global CDP information:
        Sending CDP packets every 60 seconds
        Sending a holdtime value of 180 seconds

Misconceptions:
None

Related Commands:
show cdp neighbors
show cdp entry
cdp run


 Command:

show cdp entry

Mode:

Router#

Syntax:

show cdp entry {* | entry-name [protocol | version]}

Syntax Description:

*

Shows all of the CDP neighbors.

entry-name

Name of neighbor about which you want information.

You can enter an asterisk (*) at the end of an entry-name, such as show cdp entry dev*, which would show information about the neighbor, device.cisco.com.

protocol

(Optional) Limits the display to information about the protocols enabled on a router.

version

(Optional) Limits the display to information about the version of software running on the router.

Command Description:

To display information about a neighbor device listed in the CDP table, use the show cdp entry privileged EXEC command.

Example:

The following is a sample of output from the show cdp entry command with no limits. Information about the neighbor device.cisco.com is displayed including device ID, address and protocol, platform, interface, hold time, and version.

Router#show cdp entry device.cisco.com

-------------------------
Device ID: device.cisco.com
Entry address(es):
  IP address: 192.168.68.18
  CLNS address: 490001.1111.1111.1111.00
  DECnet address: 10.1
Platform: cisco 4500,  Capabilities: Router
Interface: Ethernet0/1,  Port ID (outgoing port): Ethernet0
Holdtime : 125 sec

Version :
Cisco Internetwork Operating System Software
IOS (tm) 4500 Software (C4500-J-M), Version 11.1(10.4), MAINTENANCE INTERIM SOFTWARE
Copyright (c) 1986-1997 by cisco Systems, Inc.
Compiled Mon 07-Apr-97 19:51 by dschwart

The following is a sample of output from the show cdp entry protocol command. Only information about the protocols enabled on device.cisco.com is displayed.

Router#show cdp entry device.cisco.com protocol

Protocol information for device.cisco.com:
  IP address: 192.168.68.18
  CLNS address: 490001.1111.1111.1111.00
  DECnet address: 10.1

The following is a sample of output from the show cdp entry version command. Only information about the version of software running on device.cisco.com is displayed.

Router#show cdp entry device.cisco.com version

Version information for device.cisco.com:
  Cisco Internetwork Operating System Software
IOS (tm) 4500 Software (C4500-J-M), Version 11.1(10.4), MAINTENANCE INTERIM SOFTWARE
Copyright (c) 1986-1997 by cisco Systems, Inc.
Compiled Mon 07-Apr-97 19:51 by dschwart

Misconceptions:
None

Related Commands:
cdp run
show cdp


Command:

show cdp interface

Mode:

Router#

Syntax:

show cdp interface [type number]

Syntax Description:

type

(Optional) Type of interface about which you want information.

number

(Optional) Number of the interface about which you want information.

Command Description:

To display information about the interfaces on which Cisco Discovery Protocol (CDP) is enabled, use the show cdp interface privileged EXEC command.

Example:

The following is sample output from the show cdp interface command. Status information and information about CDP timer and hold-time settings is displayed for all interfaces on which CDP is enabled.

Router# show cdp interface

Serial0 is up, line protocol is up, encapsulation is SMDS

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

Ethernet0 is up, line protocol is up, encapsulation is ARPA

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

The following is sample output from the show cdp interface command with an interface specified. Status information and information about CDP timer and hold-time settings is displayed for Ethernet interface 0 only.

Router# show cdp interface ethernet 0

Ethernet0 is up, line protocol is up, encapsulation is ARPA

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

Misconceptions:

None.

Related Commands:

show cdp

show cdp entry

show cdp neighbors

show cdp traffic


Command:

show cdp neighbors

Mode:

Router#

Syntax:

show cdp neighbors [type number] [detail]

Syntax Description:

type

(Optional) Type of the interface connected to the neighbors about which you want information.

number

(Optional) Number of the interface connected to the neighbors about which you want information.

detail

(Optional) Displays detailed information about a neighbor (or neighbors) including network address, enabled protocols, hold time, and software version.

Command Description:

To display information about neighbors, use the show cdp neighbors privileged EXEC command.

Example:

The following is a sample of output from the show cdp neighbors command. Device ID, interface type and number, holdtime settings, capabilities, platform, and port ID information about neighbors is displayed:

Router#show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
device1.cisco.com   Eth 0/1        122          T S       WS-C2900  2/11
device2.cisco.com   Eth 0/1        179           R        4500      Eth 0
device3.cisco.com   Eth 0/1        155           R        2500      Eth 0
device4.cisco.com   Eth 0/1        155           R        2509      Eth 0

The following is a sample of output for one neighbor from the show cdp neighbors detail command. Additional detail is shown about neighbors including network address, enabled protocols, and software version:

Router#show cdp neighbors detail

-------------------------
Device ID: device2.cisco.com
Entry address(es):
  IP address: 171.68.162.134
Platform: cisco 4500,  Capabilities: Router
Interface: Ethernet0/1,  Port ID (outgoing port): Ethernet0
Holdtime : 156 sec

Version :
Cisco Internetwork Operating System Software
IOS (tm) 4500 Software (C4500-J-M), Version 11.1(10.4), MAINTENANCE INTERIM SOFTWARE
Copyright (c) 1986-1997 by Cisco Systems, Inc.
Compiled Mon 07-Apr-97 19:51 by dschwart

Misconceptions:
None

Related Commands:
cdp run
show cdp


Command:

show cdp traffic

Mode:

Router#

Syntax:

show cdp traffic

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information about traffic between devices gathered using Cisco Discovery Protocol (CDP), use the show cdp traffic privileged EXEC command.

Example:

The following example specifies information associated with the show cdp traffic command:

router# show cdp traffic

Total packets output: 543, Input: 333

Hdr syntax: 0, Chksum error: 0, Encaps failed: 0

No memory: 0, Invalid: 0, Fragmented: 0

CDP version 1 advertisements output: 191, Input: 187

CDP version 2 advertisements output: 352, Input: 146

Table 111 describes the significant fields shown in the display.

Table 111 show cdp traffic Field Descriptions

Field

Definition

Total packets output

The number of CDP advertisements sent by the local device. Note that this value is the sum of the CDP Version 1 advertisements output and CDP Version 2 advertisements output fields.

Input

The number of CDP advertisements received by the local device. Note that this value is the sum of the CDP Version 1 advertisements input and CDP Version 2 advertisements input fields.

Hdr syntax

The number of CDP advertisements with bad headers, received by the local device.

Chksum error

The number of times the checksum (verifying) operation failed on incoming CDP advertisements.

Encaps failed

The number of times CDP failed to send advertisements on an interface because of a failure caused by the bridge port of the local device.

No memory

The number of times the local device did not have enough memory to store the CDP advertisements in the advertisement cache table when the device was attempting to assemble advertisement packets for transmission and parse them when receiving them.

Invalid

The number of invalid CDP advertisements received and sent by the local device.

Fragmented

The number of times fragments or portions of a single CDP advertisement were received by the local device instead of the complete advertisement.

CDP version 1 advertisements output

The number of CDP Version 1 advertisements sent by the local device.

Input

The number of CDP Version 1 advertisements received by the local device.

CDP version 2 advertisements output

The number of CDP Version 2 advertisements sent by the local device.

Input

The number of CDP Version 2 advertisements received by the local device.

Misconceptions:

None.

Related Commands:

show cdp

show cdp entry

show cdp interface

show cdp neighbors


 Command:

show flash

Mode:

Router>
Router#

Syntax:

Class A Flash file systems

show flash-filesystem: [all | chips | filesys]

Class B Flash file systems

show flash-filesystem: [partition number] [all | chips | detailed | err | summary]

Class C Flash file systems

show flash-filesystem:

Syntax Description:

flash-filesystem

Flash memory file system (bootflash:, flash:, slot0:, slot1:,slavebootflash:, slaveslot0:, or slaveslot1:)

all

(Optional) On Class B Flash file systems, all shows complete information about Flash memory, including information about the individual ROM devices in Flash memory and the names and sizes of all system image files stored in Flash memory, including those that are invalid.

On Class A Flash file systems, all shows the following information:

  • The information displayed when no keywords are used.
  • The information displayed by the filesys keyword.
  • The information displayed by the chips keyword.

chips

(Optional) Shows information per partition and per chip, including which bank the chip is in plus its code, size, and name

filesys

(Optional) Shows the Device Info Block, the Status Info, and the Usage Info

detailed

(Optional) Shows detailed file directory information per partition, including file length, address, name, Flash memory checksum, computer checksum, bytes used, bytes available, total bytes, and bytes of system Flash memory

err

(Optional) Shows write or erase failures in the form of number of retries

partition number

(Optional) Shows output for the specified partition number

If you do not specify a partition in the command, the router displays output for all partitions. You can use this keyword only when Flash memory has multiple partitions.

summary

(Optional) Shows summary information per partition, including the partition size, bank size, state, and method by which files can be copied into a particular partition

You can use this keyword only when Flash memory has multiple partitions.

Command Description:

To display the layout and contents of a Flash memory file system, use the show EXEC command.

If Flash memory is partitioned, the command displays the requested output for each partition, unless you use the partition keyword.

The command also specifies the location of the current image.

To display the contents of boot Flash memory, use the show bootflash: command as follows:

Class A Flash file systems

show bootflash [all | chips | filesys]

Class B Flash file systems

show bootflash [partition number] [all| chips | detailed | err]

To display the contents of internal Flash memory, use the show flash command as follows:

Class A Flash file systems

show flash [all | chips | filesys]

Class B Flash file systems

show flash [partition number][all | chips | detailed | err | summary]

The show (Flash file system) command replaces the show flash devices command.

Examples:

The output of the show command depends on the type of Flash file system you select. Types include flash:, bootflash:, slot0:, slot1:, slavebootflash:, slaveslot0:, and slaveslot1:.

This section contains examples of output from show flash:.

  • Class A Flash File System
  • Class B Flash File Systems

Although the examples below use flash: as the Flash file system, you may also use the other Flash file systems listed above.

Class A Flash File System

The following three examples show sample output for Class A Flash file systems. The following table describes the fields shown in the output.

Table: show (Class A Flash File System) Field Descriptions
Field Description

#

File's index number

ED

Whether the file contains an error (E) or is deleted (D)

type

File's type (1 = configuration file, 2 = image file). The software displays these values only when the file's type is certain. When the file's type is unknown, the system displays unknown in this field.

crc

File's cyclic redundant check

seek

Offset into the file system of the next file

nlen

Length of the file's name

length

Length of the file itself

date/time

Date and time the file was created

name

File's name

The following is sample output from the show flash: command.

RouterA#show flash:

-#- ED --type-- --crc--- -seek-- nlen -length- -----date/time------ name
1   .. unknown  317FBA1B  4A0694   24  4720148 Aug 29 1997 17:49:36 hampton/nitro/c7200-j-mz
2   .. unknown  9237F3FF  92C574   11  4767328 Oct 01 1997 18:42:53 c7200-js-mz
3   .D unknown  71AB01F1 10C94E0   10  7982828 Oct 01 1997 18:48:14 rsp-jsv-mz
4   .D unknown  96DACD45 10C97E0    8      639 Oct 02 1997 12:09:17 the_time
5   .. unknown  96DACD45 10C9AE0    3      639 Oct 02 1997 12:09:32 the_time
6   .D unknown  96DACD45 10C9DE0    8      639 Oct 02 1997 12:37:01 the_time
7   .. unknown  96DACD45 10CA0E0    8      639 Oct 02 1997 12:37:13 the_time

3104544 bytes available (17473760 bytes used)

The following is a sample of output from the show flash: chips command:

RouterA#show flash: chips

******** Intel Series 2+ Status/Register Dump ********

ATTRIBUTE MEMORY REGISTERS:
  Config Option Reg (4000): 2
  Config Status Reg (4002): 0
  Card Status   Reg (4100): 1
  Write Protect Reg (4104): 4
  Voltage Cntrl Reg (410C): 0
  Rdy/Busy Mode Reg (4140): 2

COMMON MEMORY REGISTERS: Bank 0
  Intelligent ID Code  : 8989A0A0
  Compatible Status Reg: 8080
  Global     Status Reg: B0B0
  Block Status Regs:
    0  :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    8  :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    16 :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    24 :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0

COMMON MEMORY REGISTERS: Bank 1
  Intelligent ID Code  : 8989A0A0
  Compatible Status Reg: 8080
  Global     Status Reg: B0B0
  Block Status Regs:
    0  :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    8  :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    16 :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    24 :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0

COMMON MEMORY REGISTERS: Bank 2
  Intelligent ID Code  : 8989A0A0
  Compatible Status Reg: 8080
  Global     Status Reg: B0B0
  Block Status Regs:
    0  :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    8  :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    16 :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    24 :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0

COMMON MEMORY REGISTERS: Bank 3
  Intelligent ID Code  : 8989A0A0
  Compatible Status Reg: 8080
  Global     Status Reg: B0B0
  Block Status Regs:
    0  :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    8  :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    16 :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    24 :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0

COMMON MEMORY REGISTERS: Bank 4
  Intelligent ID Code  : 8989A0A0
  Compatible Status Reg: 8080
  Global     Status Reg: B0B0
  Block Status Regs:
    0  :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    8  :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    16 :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0
    24 :  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0  B0B0

The following is a sample of output from the show flash: filesys command:

RouterA#show flash: filesys

-------- F I L E   S Y S T E M   S T A T U S --------
  Device Number = 0
DEVICE INFO BLOCK:
  Magic Number          = 6887635   File System Vers = 10000    (1.0)
  Length                = 1400000   Sector Size      = 20000
  Programming Algorithm = 4         Erased State     = FFFFFFFF
  File System Offset    = 20000     Length = 13A0000
  MONLIB Offset         = 100       Length = C730
  Bad Sector Map Offset = 1FFEC     Length = 14
  Squeeze Log Offset    = 13C0000   Length = 20000
  Squeeze Buffer Offset = 13E0000   Length = 20000
  Num Spare Sectors     = 0
    Spares:
STATUS INFO:
  Writable
  NO File Open for Write
  Complete Stats
  No Unrecovered Errors
  No Squeeze in progress
USAGE INFO:
  Bytes Used     = 10AA0E0  Bytes Available = 2F5F20
  Bad Sectors    = 0       Spared Sectors  = 0
  OK Files       = 4       Bytes = 90C974
  Deleted Files  = 3       Bytes = 79D3EC
  Files w/Errors = 0       Bytes = 0

Class B Flash File Systems

The table below describes fields in the sample output for Class B Flash file systems

Table: show (Class BFlash File System) all Fields
Field Description

addr

Address of the file in Flash memory

available

Total number of bytes available in Flash memory

Bank

Bank number

Bank-Size

Size of bank in bytes

bytes used

Total number of bytes used in Flash memory

ccksum

Computed checksum

Chip

Chip number

Code

Code number

Copy-Mode

Method by which the partition can be copied to:

  • RXBOOT-MANUAL indicates a user can copy manually by reloading to the boot ROM image.
  • RXBOOT-FLH indicates user can copy via Flash load helper.
  • Direct indicates user can copy directly into Flash memory.
  • None indicates that it is not possible to copy into that partition.

fcksum

Checksum recorded in Flash memory

File

Number of the system image file. If no filename is specified in the boot system flash command, the router boots the system image file with the lowest file number.

Free

Number of bytes free in partition

Length

Size of the system image file (in bytes)

Name

Name of chip manufacturer and chip type

Name/status

Filename and status of a system image file. The status [invalidated] appears when a file has been rewritten (recopied) into Flash memory. The first (now invalidated) copy of the file is still present within Flash memory, but it is rendered unusable in favor of the newest version. The [invalidated] status can also indicate an incomplete file that results from the user abnormally terminating the copy process, a network timeout, or a Flash memory overflow.

Partition

Partition number in Flash memory

Size

Size of partition in bytes or size of chip

State

State of the partition. It can be one of the following values:

  • Read-Only indicates the partition that is being executed from.
  • Read/Write is a partition that can be copied to.

System flash directory

Flash directory and its contents

total

Total size of Flash memory, in bytes

Used

Number of bytes used in partition

The following is a sample of output from the show flash: command:

RouterB> show flash:

System flash directory:
File  Length   Name/status
  1   4137888  c3640-c2is-mz.Feb24
[4137952 bytes used, 12639264 available, 16777216 total]
16384K bytes of processor board System flash (Read/Write)\

The following example shows detailed information about the second partition in internal Flash memory:

RouterB#show flash: partition 2

System flash directory, partition 2:
File  Length   Name/status
  1   1711088  dirt/images/c3600-i-mz
[1711152 bytes used, 15066064 available, 16777216 total]
16384K bytes of processor board System flash (Read/Write)

The following is a sample of output from the show flash: all command:

RouterB> show flash: all

Partition   Size    Used      Free      Bank-Size  State          Copy Mode
  1        16384K   4040K    12343K     4096K      Read/Write     Direct

System flash directory:
File  Length   Name/status
        addr      fcksum  ccksum
  1   4137888  c3640-c2is-mz.Feb24
        0x40      0xED65  0xED65
[4137952 bytes used, 12639264 available, 16777216 total]
16384K bytes of processor board System flash (Read/Write)

   Chip    Bank    Code      Size      Name
    1      1       01D5      1024KB    AMD   29F080
    2      1       01D5      1024KB    AMD   29F080
    3      1       01D5      1024KB    AMD   29F080
    4      1       01D5      1024KB    AMD   29F080
    1      2       01D5      1024KB    AMD   29F080
    2      2       01D5      1024KB    AMD   29F080
    3      2       01D5      1024KB    AMD   29F080
    4      2       01D5      1024KB    AMD   29F080
    1      3       01D5      1024KB    AMD   29F080
    2      3       01D5      1024KB    AMD   29F080
    3      3       01D5      1024KB    AMD   29F080
    4      3       01D5      1024KB    AMD   29F080
    1      4       01D5      1024KB    AMD   29F080
    2      4       01D5      1024KB    AMD   29F080
    3      4       01D5      1024KB    AMD   29F080
    4      4       01D5      1024KB    AMD   29F080

The following is a sample of output from the show flash: all command on a router with Flash memory partitioned:

Router#show flash: all

System flash partition information:
Partition   Size    Used       Free     Bank-Size     State         Copy-Mode
    1       4096K    3459K     637K     4096K         Read Only     RXBOOT-FLH
    2       4096K    3224K     872K     4096K         Read/Write    Direct

System flash directory, partition 1:
File     Length     Name/status
        addr     fcksum     ccksum
  1     3459720     master/igs-bfpx.100-4.3
        0x40     0x3DE1     0x3DE1
[3459784 bytes used, 734520 available, 4194304 total]
4096K bytes of processor board System flash (Read ONLY)

   Chip    Bank     Code      Size      Name
    1      1        89A2      1024KB    INTEL 28F008SA
    2      1        89A2      1024KB    INTEL 28F008SA
    3      1        89A2      1024KB    INTEL 28F008SA
    4      1        89A2      1024KB    INTEL 28F008SA
Executing current image from System flash [partition 1]

 System flash directory, partition2:
File     Length     Name/status
        addr     fcksum     ccksum
  1     3224008     igs-kf.100
        0x40     0xEE91     0xEE91
[3224072 bytes used, 970232 available, 4194304 total]
4096K bytes of processor board System flash (Read/Write)

   Chip    Bank     Code      Size      Name
    1      2        89A2      1024KB    INTEL 28F008SA
    2      2        89A2      1024KB    INTEL 28F008SA
    3      2        89A2      1024KB    INTEL 28F008SA
    4      2        89A2      1024KB    INTEL 28F008SA

The following is a sample of output from the show flash: chips command:

RouterB>show flash: chips

16384K bytes of processor board System flash (Read/Write)

   Chip    Bank    Code      Size      Name
    1      1       01D5      1024KB    AMD   29F080
    2      1       01D5      1024KB    AMD   29F080
    3      1       01D5      1024KB    AMD   29F080
    4      1       01D5      1024KB    AMD   29F080
    1      2       01D5      1024KB    AMD   29F080
    2      2       01D5      1024KB    AMD   29F080
    3      2       01D5      1024KB    AMD   29F080
    4      2       01D5      1024KB    AMD   29F080
    1      3       01D5      1024KB    AMD   29F080
    2      3       01D5      1024KB    AMD   29F080
    3      3       01D5      1024KB    AMD   29F080
    4      3       01D5      1024KB    AMD   29F080
    1      4       01D5      1024KB    AMD   29F080
    2      4       01D5      1024KB    AMD   29F080
    3      4       01D5      1024KB    AMD   29F080
    4      4       01D5      1024KB    AMD   29F080

The following is a sample of output from the show flash: detailed command:

RouterB>show flash: detailed

System flash directory:
File  Length   Name/status
        addr      fcksum  ccksum
  1   4137888  c3640-c2is-mz.Feb24
        0x40      0xED65  0xED65
[4137952 bytes used, 12639264 available, 16777216 total]
16384K bytes of processor board System flash (Read/Write)

The following is a sample of output from the show flash: err command:

RouterB>show flash: err

System flash directory:
File  Length   Name/status
  1   4137888  c3640-c2is-mz.Feb24
[4137952 bytes used, 12639264 available, 16777216 total]
16384K bytes of processor board System flash (Read/Write)

   Chip    Bank    Code      Size      Name                erase  write
    1      1       01D5      1024KB    AMD   29F080      0      0
    2      1       01D5      1024KB    AMD   29F080      0      0
    3      1       01D5      1024KB    AMD   29F080      0      0
    4      1       01D5      1024KB    AMD   29F080      0      0
    1      2       01D5      1024KB    AMD   29F080      0      0
    2      2       01D5      1024KB    AMD   29F080      0      0
    3      2       01D5      1024KB    AMD   29F080      0      0
    4      2       01D5      1024KB    AMD   29F080      0      0
    1      3       01D5      1024KB    AMD   29F080      0      0
    2      3       01D5      1024KB    AMD   29F080      0      0
    3      3       01D5      1024KB    AMD   29F080      0      0
    4      3       01D5      1024KB    AMD   29F080      0      0
    1      4       01D5      1024KB    AMD   29F080      0      0
    2      4       01D5      1024KB    AMD   29F080      0      0
    3      4       01D5      1024KB    AMD   29F080      0      0
    4      4       01D5      1024KB    AMD   29F080      0      0
Refer to tables above for a description of the fields. The show flash: err command also displays two extra fields, erase and write. The erase field indications the number of erase errors. The write field indicates the number of write errors.
The following is a sample of output from the show flash summary command on a router with Flash memory partitioned. The partition in the Read Only state is the partition from which the Cisco IOS image is being executed.
Router#show flash summary

System flash partition information:
Partition   Size     Used      Free    Bank-Size   State       Copy-Mode
    1       4096K    2048K     2048K   2048K       Read Only   RXBOOT-FLH
    2       4096K    2048K     2048K   2048K       Read/Write  Direct

Misconceptions:

None

Related Commands:
None


Command:

show history

Mode:

Router#
Router>

Syntax:

show history

Syntax Description:

This command has no arguments or keywords.

Command Description:

To list the commands you have entered in the current EXEC session, use the show history EXEC command. The command history feature provides a record of EXEC commands you have entered. The number of commands that the history buffer will record is determined by the history size line configuration command or the terminal history size EXEC command. The table lists the keys and functions you can use to recall commands from the command history buffer.

Table of History Keys

Key

Function

Ctrl-P or Up Arrow1

Recalls commands in the history buffer in a backward sequence, beginning with the most recent command. Repeat the key sequence to recall successively older commands.

Ctrl-N or Down Arrow1

Returns to more recent commands in the history buffer after recalling commands with Ctrl-P or the Up Arrow. Repeat the key sequence to recall successively more recent commands.

1The arrow keys function only with ANSI-compatible terminals.

Example:

The following is sample output from the show history command, which lists the commands the user has entered in EXEC mode for this session:

Router# show history

help

where

show hosts

show history

Misconceptions:

This command does not provide a high level of network security. If you use this command, you should also take additional network security measures.
Related Commands:

history size
terminal history size


 Command:

show interface

Mode:

Switch> (enable)

Syntax:

show interface

show interface trap

Syntax Description:

trap

Keyword that displays the trap interface

Command Description:

Use the show interface command to display information about network interfaces and standard SNMP link trap operation.

Example:

This example shows how to display information on all network interfaces:

Console> show interface

sl0: flags=50<DOWN,POINTOPOINT,RUNNING>

        slip 0.0.0.0 dest 0.0.0.0

sc0: flags=63<UP,BROADCAST,RUNNING>

        vlan 100 inet 172.20.52.37 netmask 255.255.255.248 broadcast 172.20.52.39

me1: flags=62<DOWN,BROADCAST,RUNNING>

        inet 172.20.52.37 netmask 255.255.255.224 broadcast 172.20.52.63

Console>

This example shows how to display whether the trap interface is enabled or
disabled:

Console> (enable) show interface trap

Interface  Trap
--------  ----
sc0       enabled
me1       disabled
sl0       disabled
Console> (enable)

The table below describes the fields in the show interface command output:

Table: show interface Command Output Fields
Field Description

me1

Information on the me1 interface

flags

Flags indicating the interface state (decoded in the subsequent field).

<UP,BROADCAST, RUNNING>

Interface state (UP, DOWN, BROADCAST, LOOPBACK, POINTOPOINT, or RUNNING)

inet

IP address of the interface

netmask

Network mask for the interface

broadcast

Broadcast address for the interface

sl0

Information on the SLIP interface

<UP,POINTOPOINT, RUNNING>

Interface state (UP, DOWN, BROADCAST, LOOPBACK, POINTOPOINT, or RUNNING)

slip

IP address of the SLIP interface

dest

IP address of the host to which the console port will be connected

sc0

Information on the in-band interface

vlan

Number of the VLAN to which the sc0 interface has been assigned (known as the management VLAN)

Interface

Type of interface

Trap

Status of whether the trap is enabled or disabled

Misconceptions:
None

Related commands:
set interface


Command:

show ip cache policy

Mode:

Router>

Syntax:

show ip cache policy

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the cache entries in the policy route cache, use the show ip cache policy command in EXEC mode.

Example:

The following is sample output from the show ip cache policy command:

Router#show ip cache policy
Total adds 10, total deletes 10
Type Routemap/sequence Age Interface Next Hop
NH george/10 00:04:31 Ethernet0 172.110.1.2
Int george/30 00:01:23 Serial4 172.110.5.129

Misconceptions:

None.

Related Commands:

ip route-cache

© Cisco Systems, Inc. 2001, 2002


Command:

show ip cef

Mode:

Switch>

Syntax:

show ip cef [vrf vrf-name] [[unresolved [detail]] | [detail | summary]]

Specific FIB Entries Based on IP Address Information

show ip cef [vrf vrf-name] [network [mask]] [longer-prefixes] [detail]

Specific FIB Entries Based on Interface Information
show ip cef [vrf vrf-name] [type number] [detail]

Specific FIB Entries Based on Nonrecursive Routes
show ip cef [vrf vrf-name] non-recursive [detail]

Syntax Description:

vrf | (Optional) A Virtual Private Network (VPN) routing and forwarding (VRF) instance.
unresolved | (Optional) Displays unresolved FIB entries.
detail | (Optional) Displays detailed FIB entry information.
summary | (Optional) Displays a summary of the FIB.
longer-prefixes | (Optional) Displays FIB entries for more specific destinations.
non-recursive | Displays only nonrecursive routes.
vrf-name | (Optional) Name assigned to the VRF.
network | (Optional) Displays the FIB entry for the specified destination network.
mask | (Optional) Displays the FIB entry for the specified destination network and mask.
type number | (Optional) Interface type and number for which to display FIB entries.

Command Description:

To display entries in the forwarding information base (FIB) or to display a summary of the FIB, use the show ip cef command in EXEC mode.

The show ip cef command without any keywords or arguments shows a brief display of all FIB entries.

Example:

The following is sample output from the show ip cef unresolved command:

Router#show ip cef unresolved
IP Distributed CEF with switching (Table Version 136632)
45776 routes, 13 unresolved routes (0 old, 13 new)
45776 leaves, 2868 nodes, 8441480 bytes, 136632 inserts, 90856 invalidations
1 load sharing elements, 208 bytes, 1 references
1 CEF resets, 1 revisions of existing leaves
refcounts: 527292 leaf, 465617 node
148.214.0.0/16, version 136622
0 packets, 0 bytes
  via 171.69.233.56, 0 dependencies, recursive
  unresolved
148.215.0.0/16, version 136623
0 packets, 0 bytes
  via 171.69.233.56, 0 dependencies, recursive
  unresolved
148.218.0.0/16, version 136624
0 packets, 0 bytes

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip ssh

Mode:

Router#

Syntax:

show ip ssh

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the version and configuration data for Secure Shell (SSH), use the show ip ssh privileged EXEC command.

Use the show ip ssh command to view the status of configured options such as retries and timeouts. This command allows you to see if SSH is enabled or disabled.

Example:

The following is sample output from the show ip ssh command when SSH has been enabled:

Router#show ip ssh
SSH Enabled - version 1.5
Authentication timeout: 120 secs; Authentication retries: 3

The following is sample output from the show ip ssh command when SSH has been disabled:

Router#show ip ssh
%SSH has not been enabled

Misconceptions:

None

Related Commands:

None


 Command:

show memory

Mode:

Router>

Syntax:

show memory [memory-type] [free] [summary]

Syntax Description:

memory-type

(Optional) Memory type to display (processor, multibus, io,sram). If type is not specified, statistics for all memory types present are displayed.

free

(Optional) Displays free memory statistics.

summary

(Optional) Displays a summary of memory usage including the size and number of blocks allocated for each address of the system call that allocated the block.

Command Description:

Use the show memory EXEC command to show statistics about memory, including memory-free pool statistics.

The show memory command displays information about memory available after the system image decompresses and loads.

Examples:

The following is a sample of output from the show memory command:

Router#show memory

               Head   Total(b)    Used(b)    Free(b)  Lowest(b) Largest(b)
Processor    B0EE38    5181896    2210036    2971860    2692456    2845368

          Processor memory
Address   Bytes Prev.    Next     Ref  PrevF   NextF   Alloc PC  What
B0EE38     1056 0        B0F280     1                  18F132    List Elements
B0F280     2656 B0EE38   B0FD08     1                  18F132    List Headers
B0FD08     2520 B0F280   B10708     1                  141384    TTY data
B10708     2000 B0FD08   B10F00     1                  14353C    TTY Input Buf
B10F00      512 B10708   B11128     1                  14356C    TTY Output Buf
B11128     2000 B10F00   B11920     1                  1A110E    Interrupt Stack
B11920       44 B11128   B11974     1                  970DE8    *Init*
B11974     1056 B11920   B11DBC     1                  18F132    messages
B11DBC       84 B11974   B11E38     1                  19ABCE    Watched Boolean
B11E38       84 B11DBC   B11EB4     1                  19ABCE    Watched Boolean
B11EB4       84 B11E38   B11F30     1                  19ABCE    Watched Boolean
B11F30       84 B11EB4   B11FAC     1                  19ABCE    Watched Boolean
Router#

The following is a sample of output from the show memory free command:

Router#show memory free

               Head   Total(b)    Used(b)    Free(b)  Lowest(b) Largest(b)
Processor    B0EE38    5181896    2210076    2971820    2692456    2845368

          Processor memory
Address  Bytes Prev.    Next     Ref  PrevF   NextF   Alloc PC  What
             24    Free list 1
CEB844       32 CEB7A4   CEB88C     0  0       0       96B894    SSE Manager
             52    Free list 2
             72    Free list 3
             76    Free list 4
             80    Free list 5
D35ED4       80 D35E30   D35F4C     0  0       D27AE8  96B894    SSE Manager
D27AE8       80 D27A48   D27B60     0  D35ED4  0       22585E    SSE Manager
             88    Free list 6
            100    Free list 7
D0A8F4      100 D0A8B0   D0A980     0  0       0       2258DA    SSE Manager
            104    Free list 8
B59EF0      108 B59E8C   B59F84     0  0       0       2258DA    (fragment)

The display of show memory free contains the same types of information as the show memory display, except that only free memory is displayed, and the information is displayed in order for each free list.

The first section of the display includes summary statistics about the activities of the system memory allocator. The table below describes significant fields shown in the first section of the display.

Table: show memory Field Descriptions—First Section
Field Description

Head

Hexadecimal address of the head of the memory allocation chain

Total(b)

Sum of used bytes plus free bytes

Used(b)

Amount of memory in use

Free(b)

Amount of memory not in use

Lowest(b)

Smallest amount of free memory since last boot

Largest(b)

Size of largest available free block

The second section of the display is a block-by-block listing of memory use.
Table below describes significant fields shown in the second section of the display.

Table: Characteristicsof Each Block of Memory—Second Section
Field Description

Address

Hexadecimal block of addresses

Bytes

Size of block in bytes

Prev.

Address of previous block (should match Address on previous line)

Next

Address of next block (should match address on next line)

Ref

Reference count for that memory block, indicating how many different processes are using that block of memory

PrevF

Address of previous free block (if free)

NextF

Address of next free block (if free)

Alloc PC

Address of the system call that allocated the block

What

Name of process that owns the block, or "(fragment)" if the block
is a fragment, or "(coalesced)" if the block was coalesced from
adjacent free blocks

The show memory io command displays the free I/O memory blocks. On the Cisco 4000, this command quickly shows how much unused I/O memory is available.

The following is a sample of output from the show memory io command:

Router#show memory io

Address   Bytes Prev.   Next     Ref  PrevF   NextF   Alloc PC  What
6132DA0   59264 6132664 6141520  0    0      600DDEC  3FCF0     *Packet Buffer*
600DDEC     500 600DA4C 600DFE0  0   6132DA0 600FE68  0
600FE68     376 600FAC8 600FFE0  0   600DDEC 6011D54  0
6011D54     652 60119B4 6011FEO  0   600FE68 6013D54  0
614FCA0     832 614F564 614FFE0  0   601FD54 6177640  0
6177640 2657056 6172E90 0        0   614FCA0 0        0
Total: 2723244

The show memory sram command displays the free SRAM memory blocks. For the Cisco 4000, this command supports the high-speed static RAM memory pool to make it easier to debug or diagnose problems with allocation or freeing of such memory.

The following is a sample of output from the show memory sram command:

Router#show memory sram

Address   Bytes Prev.   Next     Ref  PrevF   NextF   Alloc PC  What
7AE0      38178 72F0    0        0    0       0       0
Total     38178

The show memory command on the Cisco 4000 includes information about SRAM memory and I/O memory, and appears as follows:

Router#show memory

               Head   Total(b)    Used(b)    Free(b)  Lowest(b) Largest(b)
Processor    49C724   28719324    1510864   27208460   26511644   15513908
      I/O   6000000    4194304    1297088    2897216    2869248    2896812
     SRAM      1000      65536      63400       2136       2136       2136

Address   Bytes Prev.   Next     Ref  PrevF   NextF   Alloc PC  What
1000       2032 0       17F0       1                  3E73E     *Init*
17F0       2032 1000    1FE0       1                  3E73E     *Init*
1FE0        544 17F0    2200       1                  3276A     *Init*
2200         52 1FE0    2234       1                  31D68     *Init*
2234         52 2200    2268       1                  31DAA     *Init*
2268         52 2234    229C       1                  31DF2     *Init*
72F0       2032 6E5C    7AE0       1                  3E73E     Init
7AE0      38178 72F0    0          0    0      0      0

The show memory summary command displays a summary of all memory pools as well as memory usage per Alloc PC (address of the system call that allocated the block).

The following is a partial sample output from the show memory summary command. This command shows the size, blocks, and bytes allocated. Bytes equal the size multiplied by the blocks. For a description of the other fields, see Table 20 and Table 21.

Router#show memory summary

Head   Total(b)    Used(b)    Free(b)  Lowest(b) Largest(b)
Processor    B0EE38    5181896    2210216    2971680    2692456    2845368

          Processor memory
Alloc PC        Size     Blocks      Bytes    What
0x2AB2           192          1        192    IDB: Serial Info
0x70EC            92          2        184    Init
0xC916           128         50       6400    RIF Cache
0x76ADE         4500          1       4500    XDI data
0x76E84         4464          1       4464    XDI data
0x76EAC          692          1        692    XDI data
0x77764          408          1        408    Init
0x77776          116          1        116    Init
0x777A2          408          1        408    Init
0x777B2          116          1        116    Init
0xA4600           24          3         72    List
0xD9B5C           52          1         52    SSE Manager
.......................
0x0                0       3413    2072576    Pool Summary
0x0                0         28    2971680    Pool Summary (Free Blocks)
0x0               40       3441     137640    Pool Summary(All Block Headers)
0x0                0       3413    2072576    Memory Summary
0x0                0         28    2971680    Memory Summary (Free Blocks)

Misconceptions:

None

Related commands:
show processes


%command%

Command:

show privilege

Mode:

Router>

Syntax:

show privilege

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display your current level of privilege, use the show privilege command in EXEC mode.

Example:

The following example shows sample output from the show privilege command. The current privilege level is 15.

Router#show privilege

Current privilege level is 15

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


 Command:

show protocols

Mode:

Router>

Syntax:

show protocols

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the show protocols EXEC command to display the configured protocols.

This command shows the global and interface-specific status of any configured Level 3 protocol; for example, IP, DECnet, IPX, AppleTalk, and so forth.

Example:

The following is sample output from the show protocols command:

Router#show protocols

Global values:
  Internet Protocol routing is enabled
  DECNET routing is enabled
  XNS routing is enabled
  Appletalk routing is enabled
  X.25 routing is enabled
Ethernet 0 is up, line protocol is up
  Internet address is 192.168.1.1, subnet mask is 255.255.255.0
  Decnet cost is 5
  XNS address is 2001.AA00.0400.06CC
  AppleTalk address is 4.129, zone Twilight
Serial 0 is up, line protocol is up
  Internet address is 192.168.7.49, subnet mask is 255.255.255.240
Ethernet 1 is up, line protocol is up
  Internet address is 192.168.2.1, subnet mask is 255.255.255.0
  Decnet cost is 5
  XNS address is 2002.AA00.0400.06CC
  AppleTalk address is 254.132, zone Twilight
Serial 1 is down, line protocol is down
  Internet address is 192.168.7.177, subnet mask is 255.255.255.240
  AppleTalk address is 999.1, zone Magnolia Estates

Misconceptions:

This command displays information about routed protocols not routing protocols. For information about routing protocols, use the show ip protocols command.

Related commands:
show ip protocols


Command:

show sessions

Mode:

Router>

Syntax:

show sessions

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information about open local-area transport (LAT), Telnet, or rlogin connections, use the show sessions command in EXEC mode.

This command displays the host name, address, number of unread bytes for the user to receive, idle time, and connection name.

Example:

The following is sample output from the show sessions command:

Router# show sessions

Conn Host Address Byte Idle Conn Name

1 MATHOM 192.168.7.21 0 0 MATHOM

* 2 CHAFF 172.25.12.19  0 0 CHAFF

The asterisk (*) indicates the current terminal session.

Table 100 describes significant fields shown in the display.

Table 100 show sessions Field Descriptions

Field

Description

Conn

Name or address of the remote host to which the connection is made.

Host

Remote host to which the router is connected through a Telnet session.

Address

IP address of the remote host.

Byte

Number of unread bytes displayed for the user to receive.

Idle

Interval (in minutes) since data was last sent on the line.

Conn Name

Assigned name of the connection.

Misconceptions:

None.

Related Commands:

protocol (VPDN)

where


Command:

show ssh

Mode:

Router#

Syntax:

show ssh

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the status of Secure Shell (SSH) server connections, use the show ssh privileged EXEC command.

Use the show ssh command to display the status of the SSH connections on your router. This command does not display any SSH configuration data; use the show ip ssh command for SSH configuration information such as timeouts and retries.

Example:

The following is sample output from the show ssh command with SSH enabled:

Router# show ssh
Connection Version Encryption State Username
0 1.5 3DES Session Started guest

The following is sample output from the show ssh command with SSH disabled:

Router# show ssh

%No SSH server connections running.

Misconceptions:

None

Related Commands:

show ip ssh


Command:

show stacks

Mode:

Router>

Syntax:

show stacks

Syntax Description:

This command has no arguments or keywords.

Command Description:

To monitor the stack usage of processes and interrupt routines, use the show stacks EXEC command.

The display from this command includes the reason for the last system reboot. If the system was reloaded because of a system failure, a saved system stack trace is displayed. This information is of use only to your technical support representative in analyzing crashes in the field. It is included here in case you need to read the displayed statistics to an engineer over the phone.

Example:

The following is sample output from the show stacks command following a system failure:

Router# show stacks
Minimum process stacks:
Free/Size  Name
652/1000  Router Init
726/1000  Init
744/1000  BGP Open
686/1200  Virtual Exec
Interrupt level stacks:
Level Called Free/Size  Name
  1 0 1000/1000  env-flash
  3 738  900/1000  Multiport Communications Interfaces
  5 178  970/1000  Console UART
System was restarted by bus error at PC 0xAD1F4, address 0xD0D0D1A
GS Software (GS3), Version 9.1(0.16), BETA TEST SOFTWARE
Compiled Tue 11-Aug-92 13:27 by jthomas
Stack trace from system failure:
FP: 0x29C158, RA: 0xACFD4
FP: 0x29C184, RA: 0xAD20C
FP: 0x29C1B0, RA: 0xACFD4
FP: 0x29C1DC, RA: 0xAD304
FP: 0x29C1F8, RA: 0xAF774
FP: 0x29C214, RA: 0xAF83E
FP: 0x29C228, RA: 0x3E0CA
FP: 0x29C244, RA: 0x3BD3C

Misconceptions:

None.

Related Commands:

show processes

© Cisco Systems, Inc. 2001, 2002


Command:

show tech-support

Mode:

Router#

Syntax:

show tech-support [page] [password]

Syntax Description:

page | (Optional) Causes the output to display a page of information at a time. Use the Return key to display the next line of output or use the space bar to display the next page of information. If not used, the output scrolls (that is, does not stop for page breaks).
password | (Optional) Leaves passwords and other security information in the output. If not used, passwords and other security-sensitive information in the output are replaced with the label "" (this is the default).

Command Description:

To display general information about the router when it reports a problem, use the show tech-support privileged EXEC command.

The show tech-support command is useful for collecting a large amount of information about your routing device for troubleshooting purposes. The output of this command can be provided to technical support representatives when reporting a problem.

The show tech-support command displays the output of a number of show commands at once. The output from this command will vary depending on your platform and configuration. For example, access servers will display voice-related show output. Additionally, the show protocol traffic commands will be displayed for only the protocols enabled on your device. The output of the show tech-support command can include the output of the following commands:

show apollo traffic

show appletalk traffic

show bootflash

show bootvar

show buffers

show clns traffic

show context

show controllers

show decnet traffic

show interfaces

show ip traffic

show novell traffic

show processes cpu

show processes memory

show running-config

show stacks

show version

show vines traffic

show xns traffic

Example:

For a sample display of the output of the show tech-support command, refer to the documentation for the show commands listed.

Misconceptions:

None.

Related Commands:

show apollo traffic

show appletalk traffic

show bootflash

show bootvar

show buffers

show clns traffic

show context

show controllers

show decnet traffic

show interfaces

show ip traffic

show novell traffic

show processes cpu

show processes memory

show running-config

show stacks

show version

show vines traffic

show xns traffic

© Cisco Systems, Inc. 2001, 2002


 Command:

show version

Mode:

Router>
Router#

Syntax:

show version

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the configuration of the system hardware, the software version, the names and sources of configuration files and the boot images, use the show version EXEC command.

Example:
Router>show version
Cisco Internetwork Operating System Software
IOS (tm) 1600 Software (C1600-NY-M), Version 12.1(3), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Wed 05-Jul-00 11:06 by cmong
Image text-base: 0x02005000, data-base: 0x025E3D40
ROM: System Bootstrap, Version 11.1(12)XA, EARLY DEPLOYMENT RELEASE SOFTWARE (f)
ROM: 1600 Software (C1600-RBOOT-R), Version 11.1(12)XA, EARLY DEPLOYMENT RELEAS
Router uptime is 2 days, 5 hours, 33 minutes
System returned to ROM by power-on
System image file is "flash:c1600-ny-mz.121-3.bin"
cisco 1605 (68360) processor (revision C) with 18432K/6144K bytes of memory.
Processor board ID 07708942, with hardware revision 00000000
Bridging software.
X.25 software, Version 3.0.0.
Basic Rate ISDN software, Version 1.1.2
FastEthernet/IEEE 802.3 interface(s)
1 ISDN Basic Rate interface(s)
U interface for ISDN Basic Rate interface.
 --More--

Misconceptions:
None

Related commands:
None


%command name%

Command:

clear frame-relay-inarp

Mode:

Router>
Router#

Syntax:

clear frame-relay-inarp

Syntax Description:

This command has no arguments or keywords.

Command Description:

To clear dynamically created Frame Relay maps, which are created by the use of Inverse Address Resolution Protocol (ARP), use the clear frame-relay-inarp EXEC command.

Example:

The following example clears dynamically created Frame Relay maps:

Router#clear frame-relay-inarp

Misconceptions:

None.

Related commands:

show frame-relay map


 Command:

frame-relay adaptive-shaping

Mode:

Router(config-map-class)#

Syntax:

frame-relay adaptive-shaping {becn  | foresight }

no frame-relay adaptive-shaping

Syntax Description:

becn

Enables rate adjustment in response to BECN.

foresight

Enables rate adjustment in response to ForeSight messages.

Command Description:

Use the frame-relay adaptive-shaping map-class subcommand to select the type of backward notification you want to use. Use the no form of the command to disable backward notification.

This command replaces the frame-relay becn-response-enable command, which will be removed in a future Cisco IOS release. If you use the frame-relay becn-response-enable command in scripts, you should replace it with the frame-relay adaptive-shaping command.

The frame-relay adaptive-shaping command configures a router to respond to either BECN or ForeSight backward congestion notification messages.

Include this command in a map-class definition and apply the map class to either the main interface or to a subinterface.

Example:

This example shows the map-class definition for a router configured with traffic shaping and Router ForeSight enabled.

 Router#interface Serial 0/0
 Router(config-if)#no ip address
 Router(config-if)#encapsulation frame-relay
 Router(config-if)#frame-relay traffic-shaping
 Router(config-if)#frame-relay class control-A
 Router(config)#map-class frame-relay control-A
 Router(config-map-class)#frame-relay adaptive-shaping foresight
 Router(config-map-class)#frame-relay cir 56000
 Router(config-map-class)#frame-relay bc 64000

Misconceptions:

None

Related Commands:
frame-relay traffic-shaping
map-class frame-relay


 Command:

frame-relay bc

Mode:

Router(config-map-class)#

Syntax:

frame-relay bc {in | out} bits

no frame-relay bc {in | out} bits

Syntax Description:
in | out | Incoming or outgoing; if neither is specified, both in and out values are set.
bits | Committed burst size, in bits.

Command Description:

To specify the incoming or outgoing committed burst size (Bc) for a Frame Relay virtual circuit, use the frame-relay bc map-class configuration command. To reset the committed burst size to the default, use the no form of this command.

Example:

In the following running-config excerpt, the serial interface already has a basic configuration, and a map group called bermuda has already been defined. The example shows a map-list configuration that defines the source and destination addresses for bermuda, provides IP and IPX addresses, and ties the map list definition to the map class called jamaica. Then traffic shaping parameters are defined for the map class.

map-list bermuda
 local-addr X121 31383040703500 dest-addr X121 31383040709000
 ip 172.21.177.26 class jamaica ietf
 ipx 123.0000.0c07.d530 class jamaica ietf

map-class frame-relay jamaica
 frame-relay cir in 2000000
 frame-relay mincir in 1000000
 frame-relay cir out 15000
 frame-relay mincir out 10000
 frame-relay bc in 15000
 frame-relay bc out 9600
 frame-relay be in 10000
 frame-relay be out 10000
 frame-relay idle-timer 30

Misconceptions:
None

Related Commands:
frame-relay traffic-rate
frame-relay be


 Command:

frame-relay be

Mode:

Router(config-map-class)#

Syntax:

frame-relay bc {in | out} bits

no frame-relay bc {in | out} bits

Syntax Description:

in | out | Incoming or outgoing
bits | Excess burst size, in bits.

Command Description:

To set the incoming or outgoing excess burst size (Be) for a Frame Relay virtual circuit, use the frame-relay be map-class configuration command. To reset the excess burst size to the default, use the no form of this command.

Example:

In the following running-config excerpt, the serial interface already has a basic configuration, and a map group called bermuda has already been defined. The example shows a map-list configuration that defines the source and destination addresses for bermuda, provides IP and IPX addresses, and ties the map list definition to the map class called jamaica. Then traffic shaping parameters are defined for the map class.

map-list bermuda
 local-addr X121 31383040703500 dest-addr X121 31383040709000
 ip 172.21.177.26 class jamaica ietf
 ipx 123.0000.0c07.d530 class jamaica ietf

map-class frame-relay jamaica
 frame-relay cir in 2000000
 frame-relay mincir in 1000000
 frame-relay cir out 15000
 frame-relay mincir out 10000
 frame-relay bc in 15000
 frame-relay bc out 9600
 frame-relay be in 10000
 frame-relay be out 10000
 frame-relay idle-timer 30

Misconceptions:
None

Related Commands:
frame-relay traffic-rate
frame-relay bc


 Command:

frame-relay cir

Mode:

Router(config-map-class)#

Syntax:

frame-relay cir {in | out} bps

no frame-relay cir {in | out} bps

Syntax Description:

in | Specifies incoming cir
out | Specifies outgoing cir
bps | CIR in bits per second

Command Description:

To specify the incoming or outgoing committed information rate (CIR) for a Frame Relay virtual circuit, use the frame-relay cir map-class configuration command. To reset the CIR to the default, use the no form of this command.

Example:

The following example sets a higher committed information rate for incoming traffic than for outgoing traffic (which is going out on a slow WAN line):

Router(config-map-class)#frame-relay cir in 2000000
Router(config-map-class)#frame-relay cir out 9600

Misconceptions:
None

Related Commands:
frame-relay traffic-rate
frame-relay bc
frame-relay be


 Command:

frame-relay class

Mode:

Router(config-if)#

Syntax:

frame-relay class name

no frame-relay class name
Syntax Description:
name

Name of the map class to associate with this interface or subinterface.

Command Description:

To associate a map class with an interface or subinterface, use the frame-relay class interface configuration command. To remove the association between in the interface or subinterface and the named map class, use the no form of this command.

This command can apply to interfaces or subinterfaces.

All relevant parameters defined in the name map class are inherited by each virtual circuit created on the interface or subinterface. For each virtual circuit, the precedence rules are as follows:

  1. Use the map class associated with the virtual circuit if it exists.
  2. If not, use the map class associated with the subinterface if the map class
    exists.
  3. If not, use map class associated with interface if the map class exists.
  4. If not, use the interface default parameters.

Example:

The following example associates the map class slow_vcs with the serial 0.1 subinterface. The map class slow_vcs is defined to have an outbound CIR value of 9600:

 Router(config)#interface serial 0/0.1
 Router(config-if)#frame-relay class slow_vcs
 Router(config)#map-class frame-relay slow_vcs
 Router(config-map-class)#frame-relay cir out 9600

If a virtual circuit exists on the serial 0/0.1 interface and is associated with some other map class, the parameter values of the second map class override those defined in the slow_vc map class for that virtual circuit.

Misconceptions:

None

Related Commands:
map-class frame-relay


 Command:

frame-relay custom-queue-list

Mode:

Router(config-map-class)#

Syntax:

frame-relay custom-queue-list list-number

no frame-relay custom-queue-list list-number
Syntax Description:
list-number

Custom queue list number.

Command Description:

To specify a custom queue to be used for the virtual circuit queuing associated with a specified map class, use the frame-relay custom-queue-list map-class configuration command. To remove the specified queuing from the virtual circuit and cause it to revert to the default first-come-first-served queuing, use the no form of this command.

Definition of the custom queue takes place in the existing manner (through queue-list commands).

Only one form of queuing can be associated with a particular map class; subsequent definitions overwrite previous ones.

Example:

The following example configures a custom queue list for the fast_vcs map class:

Router(config)#map-class frame-relay fast_vcs
Router(config-map-class)#frame-relay custom-queue-list 1
Router(config)#queue-list 1 queue 4 byte-count 100
Misconceptions:
None

Related Commands:
map-class frame-relay


 Command:

frame-relay interface-dlci

Mode:

Router(config-if)#

Syntax:

frame-relay interface-dlci dlci [ietf  | cisco] [voice-encap size]

no frame-relay interface-dlci dlci [ietf  | cisco] [voice-encap size]

    BOOTP server only:

frame-relay interface-dlci dlci [protocol ip ip-address]

Syntax Description:
dlci

DLCI number to be used on the specified subinterface.

ietf | cisco

(Optional) Encapsulation type: Internet Engineering Task Force (IETF) Frame Relay encapsulation or Cisco Frame Relay encapsulation.

protocol ip ip-address

(Optional) Indicates the IP address of the main interface of a new router or access server onto which a router configuration file is to be automatically installed over a Frame Relay network. Use this option only when this device will act as the BOOTP server for automatic installation over Frame Relay.

voice-encap size

(Supported on the Cisco MC3810 only.) Specifies that data segmentation will be used to support Voice over Frame Relay. The voice encapsulation size denotes the data segmentation size. For a list of recommended data segmentation sizes, see Usage Guidelines.

Command Description:

To assign a data link connection identifier (DLCI) to a specified Frame Relay subinterface on the router or access server, use the frame-relay interface-dlci interface configuration command. To remove this assignment, use the no form of this command.

This command is typically used for subinterfaces. However, it can also be used on main interfaces. Using the frame-relay interface-dlci command on main interfaces will enable the use of routing protocols on interfaces that use Inverse ARP . The frame-relay interface-dlci command on a main interface is also valuable for assigning a specific class to a single PVC where special characteristics are desired. Subinterfaces are logical interfaces associated with a physical interface. You must specify the interface and subinterface before you can use this command to assign any DLCIs and any encapsulation or broadcast options. See the "Examples" section for the sequence of commands.

This command is required for all point-to-point subinterfaces; it is also required for multipoint subinterfaces for which dynamic address resolution is enabled. It is not required for multipoint subinterfaces configured with static address mappings.

Use the protocol ip ip-address option only when this router or access server will act as the BOOTP server for auto installation over Frame Relay.

For the voice-encap option on the Cisco MC3810, set the data segmentation size based on the port access rate. The table below lists recommended data segmentation sizes for different port access rates. Also, when the voice-encap option is configured on the Cisco MC3810, all priority queuing, custom queuing, and weighted fair queuing is disabled on the interface.

Table: Recommended Data Segmentation Sizes for Port Access Rates

Port Access Rate | The data segmentation size is based for back-to-back Frame Relay. If sending traffic through an IGX with standard Frame Relay, add an extra 15 bytes to the recommended data segmentation size.
64 kbps | 80 bytes
128 kbps | 160 bytes
256 kbps | 320 bytes
512 kbps | 640 bytes
1536 kbps (full T1) | 1600 bytes
2048 kbps (full E1) | 1600 bytes

Example:

The following example assigns DLCI 100 to serial subinterface 0/0.17:

! Enter interface configuration and begin assignments on interface serial 0/0
Router#interface serial 0/0
! Enter subinterface configuration by assigning subinterface 17
interface serial 0/0.17
! Now assign a DLCI number to subinterface 0/0.17
Router(config-if)#frame-relay interface-dlci 100

Misconceptions:
None

Related Commands:
frame-relay class


 Command:

frame-relay lmi-type

Mode:

Router(config-if)#

Syntax:

frame-relay lmi-type {ansi  | cisco  | q933a }

no frame-relay lmi-type {ansi  | q933a }

Syntax Description:

ansi

Annex D defined by American National Standards Institute (ANSI) standard T1.617.

cisco

LMI type defined jointly by Cisco and three other companies.

q933a

ITU-T Q.933 Annex A.

Command Description:

To select the Local Management Interface (LMI) type, use the frame-relay lmi-type interface configuration command. To return to the default LMI type, use the no form of this command.

Cisco's implementation of Frame Relay supports three LMI types: Cisco, ANSI Annex D, and ITU-T Q.933 Annex A.

The LMI type is set on a per-interface basis and is shown in the output of the show interfaces EXEC command.

If you want to deactivate LMI autosense, use this command and the keepalive command to configure the LMI. For more information about LMI autosense and configuring the LMI, see the "Configuring Frame Relay" chapter in the Wide-Area Networking Configuration Guide.
Example:

The following is an example of the commands you might enter to configure an interface for the ANSI Annex D LMI type:

Router#interface Serial 0/1
Router(config-if)#encapsulation frame-relay
Router(config-if)#frame-relay lmi-type ansi
Router(config-if)#keepalive 15
Misconceptions:
None

Related Commands:
None


 Command:

frame-relay map

Mode:

Router(config-if)#

Syntax:

frame-relay map protocol protocol-address dlci [broadcast] [ietf | cisco] [payload-compress {packet-by-packet |frf9 stac [hardware-options]}]

no frame-relay map protocol protocol-address

Syntax Description:

protocol

Supported protocol, bridging, or logical link control keywords: appletalk, decnet, dlsw,ip, ipx, llc2, rsrb, vines and xns

protocol-address

Destination protocol address

dlci

DLCI number used to connect to the specified protocol address on the interface

broadcast

(Optional) Forwards broadcasts to this address when multicast is not enabled (see the frame-relay multicast-dlci command for more information about multicasts). This keyword also simplifies the configuration of Open Shortest Path First (OSPF) (see the "Usage Guidelines" section for more detail)

ietf

(Optional) Internet Engineering Task Force (IETF) form of Frame Relay encapsulation. Used when the router or access server is connected to another vendor's equipment across a Frame Relay network

cisco

(Optional) Cisco encapsulation method

payload-compress packet-by-packet

(Optional) Packet-by-packet payload compression using the Stacker method

payload-compress frf9 stac

(Optional) Enables FRF.9 compression using the Stacker method

  • If the router contains a compression service adapter (CSA), compression is performed in the CSA hardware (hardware compression).
  • If the CSA is not available, compression is performed in the software installed on the VIP2 (distributed compression).
  • If the VIP2 is not available, compression is performed in the router's main processor (software compression).

hardware-options

 distributed

(Optional) Specifies that compression is implemented in the software that is installed in a VIP2. If the VIP2 is not available, compression is performed in the router's main processor (software compression). This option applies only to the Cisco 7500 series.

software

(Optional) Specifies that compression is implemented in the Cisco IOS software installed in the router's main processor.

csa csa_number

(Optional) Specifies the CSA to use for a particular interface. This option applies only to Cisco 7200 series routers.

Command Description:

To define the mapping between a destination protocol address and the DLCI used to connect to the destination address, use the frame-relay map interface configuration command. Use the no form of this command to delete the map entry.

There can be many DLCIs known by a router or access server that can send data to many different places, but they are all multiplexed over one physical link. The Frame Relay map defines the logical connection between a specific protocol and address pair and the correct DLCI.

The optional ietf and cisco keywords allow flexibility in the configuration. If no keywords are specified, the map inherits the attributes set with the encapsulation frame-relay command. You can use the frame-relay map command to specify bridging that uses a Cisco encapsulation. You can also use the encapsulation options to specify that, for example, all interfaces use IETF encapsulation except one, which needs the original Cisco encapsulation method and can be configured through use of the cisco keyword with the frame-relay map command.

Packet-by-packet compression is Cisco-proprietary and will not interoperate with routers of other manufacturers.

You can disable payload compression by entering the no frame-relay map payload command and then entering the frame-relay map command again with one of the other encapsulation keywords (cisco or ietf).

Use the frame-relay map command to enable or disable payload compression on multipoint interfaces. Use the frame-relay payload-compress command to enable or disable payload compression on point-to-point interfaces.

We recommend that you shut down the interface prior to changing encapsulation types. Although this is not required, shutting down the interface ensures the interface is reset for the new encapsulation.

The broadcast keyword provides two functions: it forwards broadcasts when multicasting is not enabled, and it simplifies the configuration of OSPF for nonbroadcast networks that will use Frame Relay.

The broadcast keyword might also be required for some routing protocols—for example, AppleTalk—that depend on regular routing table updates, especially when the router at the remote end is waiting for a routing update packet to arrive before adding the route.

By requiring selection of a designated router, OSPF treats a nonbroadcast, multiaccess network such as Frame Relay in much the same way as it treats a broadcast network. In previous releases, this required manual assignment in the OSPF configuration using the neighbor interface router command. When the frame-relay map command is included in the configuration with the broadcast keyword, and the ip ospf network command (with the broadcast keyword) is configured, there is no need to configure any neighbors manually. OSPF will now automatically run over the Frame Relay network as a broadcast network. (Refer to the ip ospf network interface command for more detail.)

Note The OSPF broadcast mechanism assumes that IP class D addresses are never used for regular traffic over Frame Relay.

Example:

The following example maps the destination IP address 172.16.123.1 to DLCI 100:

Router(config)#interface serial 0/0
Router(config-if)#frame-relay map IP 172.16.123.1 100 broadcast

OSPF will use DLCI 100 to broadcast updates.

The following segment of the show running-config command, shows FRF.9 compression configuration using the frame-relay map command.

!
interface Serial0/1
 ip address 172.16.1.4 255.255.255.0
 no ip route-cache
 encapsulation frame-relay IETF
 no keepalive
 shutdown
 frame-relay map ip 172.16.1.1 105 IETF payload-compression FRF9 stac
!

The following segment of the show running-config command, shows IETF encapsulation on the interface, and stun traffic configured to use CISCO encapsulation:

!
interface Serial0/0
 no ip address
 no ip mroute-cache
 encapsulation frame-relay IETF
 no ip route-cache
 no keepalive
 no fair-queue
 clockrate 64000
 no frame-relay inverse-arp IP 100
 no frame-relay inverse-arp NOVELL 100
 no frame-relay inverse-arp APPLETALK 100
 no frame-relay inverse-arp XNS 100
 no frame-relay inverse-arp DECNET 100
 no frame-relay inverse-arp VINES 100
 frame-relay local-dlci 100
 frame-relay map stun 100 CISCO
!
interface Serial0/1
 no ip address
 no ip mroute-cache
 encapsulation stun
 no ip route-cache
 stun group 123
 stun sdlc-role primary
 sdlc address 62
 stun route address 62 interface Serial0/0 dlci 100 4 local-ack
Misconceptions:
None

Related Commands:
frame-relay payload-compress


 Command:

frame-relay payload-compress

Mode:

Router(config-if)#

Syntax:

frame-relay payload-compress {packet-by-packet | frf9 stac[hardware-options]}

no frame-relay payload-compress {packet-by-packet | frf9 stac}

Syntax Description:

packet-by-packet

Packet-by-packet payload compression, using the Stacker method.

frf9 stac

(Optional) Enables FRF.9 compression using the Stacker method.

  • If the router contains a compression service adapter (CSA), compression is performed in the CSA hardware (hardware compression).
  • If the CSA is not available, compression is performed in the software installed on the VIP2 (distributed compression).
  • If the VIP2 is not available, compression is performed in the router's main processor (software compression).

hardware-options

 distributed

(Optional) Specifies that compression is implemented in the software that is installed in a VIP2. If the VIP2 is not available, compression is performed in the router's main processor (software compression). This option applies only to the Cisco 7500 series.

software

(Optional) Specifies that compression is implemented in the Cisco IOS software installed in the router's main processor.

csa csa_number

(Optional) Specifies the CSA to use for a particular interface. This option applies only to Cisco 7200 series routers.

Command Description:

Use the frame-relay payload-compress interface configuration command to enable Stacker payload compression on a specified point-to-point interface or subinterface. To disable payload compression on a specified point-to-point interface or subinterface, use the no form of this command.

Use the frame-relay payload-compress command to enable or disable payload compression on a point-to-point interface or subinterface. Use the frame-relay map command to enable or disable payload compression on a multipoint interface or subinterface.

We recommend that you shut down the interface prior to changing encapsulation types. Although this is not required, shutting down the interface ensures the interface is reset for the new encapsulation.

Example:

The following running-config excerpt configures FRF.9 compression for subinterfaces:

!
interface Serial2/0/0
 no ip address
 no ip route-cache
 encapsulation frame-relay
 ip route-cache distributed
 no keepalive
 shutdown
!
interface Serial2/0/0.500 point-to-point
 ip address 172.16.1.4 255.255.255.0
 no cdp enable
 frame-relay interface-dlci 500 IETF
 frame-relay payload-compress FRF9 stac
!

Misconceptions:
None

Related Commands:
frame-relay map


 Command:

frame-relay priority-group

Mode:

Router(config-map-class)#

Syntax:

frame-relay priority-group list-number

no frame-relay priority-group list-number

Syntax Description:

list-number

Priority-list number to be associated with the specified map class

Command Description:

To assign a priority queue to virtual circuits associated with a map class, use the frame-relay priority-group map-class configuration command. To remove the specified queuing from the virtual circuit and cause it to revert to the default first-come-first-served queuing, use the no form of this command.

Definition of the priority queue takes place in the existing manner (through priority-list commands).

Because only one form of queuing can be associated with a particular map class, subsequent definitions overwrite previous ones.
Example:

The following example configures a map class for a specified DLCI, specifies a priority list for the map class, and then defines the priority list:

 Router(config)#interface serial 0/0
 Router(config-if)#encapsulation frame-relay
 Router(config-if)#frame-relay interface-dlci 100 class pri_vc

 Router(config)#map-class frame-relaypri_vc
 Router(config-map-class)#frame-relay priority-group 1 priority-list 1 protocol ip high
Misconceptions:
None

Related Commands:
frame-relay interface-dlci
map-class frame-relay


 Command:

frame-relay traffic-rate

Mode:

Router(config-map-class)#

Syntax:

frame-relay traffic-rate average [peak]

no frame-relay traffic-rate average [peak]

Syntax Description:
average

Average rate, in bits per second; equivalent to specifying the contracted CIR.

peak

(Optional) Peak rate, in bits per second; equivalent to CIR + Be/Tc = CIR (1 + Be/Bc) = CIR + EIR.

Command Description:

To configure all the traffic shaping characteristics of a virtual circuit in a single command, use the frame-relay traffic-rate map-class configuration command. To remove the specified traffic shaping from the map class, use the no form of this command.

Usage Guidelines

For SVCs, the configured peak and average rates are converted to the equivalent CIR, excess burst size (Be), and committed burst size (Bc) values for use by SVC signaling.

This command lets you configure all the traffic shaping characteristics of a virtual circuit in a single command. Using it is simpler than the alternative of entering the three subcommands frame-relay cir out, frame-relay be out and frame-relay bc out, but offers slightly less flexibility.

Example:

The following example associates a map class with specified DLCI and then sets a traffic rate for the map-class (and thus for the DLCI):

Router(config)#interface serial 0/0
Router(config-if)#frame-relay interface-dlci 100 class fast_vc

Router(config)#map-class frame-relay fast_vc
Router(config-map-class)#frame-relay traffic-rate 56000 128000

Misconceptions:
None

Related Commands:
frame-relay cir


 Command:

frame-relay traffic-shaping

Mode:

Router(config-if)#

Syntax:

frame-relay traffic-shaping

no frame-relay traffic-shaping
Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable both traffic shaping and per-virtual circuit queuing for all PVCs and SVCs on a Frame Relay interface, use the frame-relay traffic-shaping interface configuration command. To disable traffic shaping and per-virtual circuit queuing, use the no form of this command.

Usage Guidelines

For virtual circuits for which no specific traffic shaping or queuing parameters are specified, a set of default values are used. The default queuing is performed on a first-come-first-served basis.

Frame Relay traffic shaping is not effective for Layer 2 PVC switching using the frame-relay route command.

Example:

The following example enables both traffic shaping and per-virtual circuit queuing:

Router(config-if)#frame-relay traffic-shaping

Misconceptions:
None

Related Commands:
frame-relay class
frame-relay custom-queue-list
frame-relay priority-group
frame-relay traffic-rate
map-class frame-relay


 Command:

keepalive (LMI)

Mode:

Router(config-if)#

Syntax:

keepalive number

no keepalive number

Syntax Description:
number Number of seconds that defines the keepalive interval. The interval must be set as a positive integer that is less than the interval set on the switch.

Command Description:

To enable the Local Management Interface (LMI) mechanism for serial lines using Frame Relay encapsulation, use the keepalive interface configuration command. Use the no form of this command to disable this capability. The keepalive command enables the keepalive sequence, which is part of the Local Management Interface (LMI) protocol. When booting from a network server over Frame Relay, you might need to disable keepalives.

Example:

The following example sets the keepalive timer on the server for a period that is two or three seconds faster (shorter interval) than the interval set on the keepalive timer of the Frame Relay switch. The difference in keepalive intervals ensures proper synchronization between the Cisco server and the Frame Relay switch.

Router(config)#interface serial 0/0
Router(config-if)#keepalive 8

Misconceptions:
None

Related Commands:
encapsulation frame-relay
frame-relay lmi-type


 Command:

map-class frame-relay

Mode:

Router(config)#

Syntax:

map-class frame-relay map-class-name

no map-class frame-relay map-class-name
Syntax Description:
map-class-name

Name of this map class

Command Description:

To specify a map class to define quality of service (QoS) values for an SVC, use the map-class frame-relay global configuration command.

After you specify the named map class, you can specify the QoS parameters such as incoming and outgoing CIR, committed burst rate, excess burst rate, and the idle timer for the map class.

To specify the protocol-and-address combination to which the QoS parameters are to be applied, associate this map class with the static maps under a map list.
Example:

The following example specifies a map class called hawaii and defines three QoS parameters for it. The hawaii map class is associated with a protocol-and-address static map defined under the map-list command.

Router(config)#map-list bermuda source-addr E164 123456 dest-addr E164 654321
Router(config-map-list)#ip 131.108.177.100 class hawaii
Router(config-map-list)#appletalk 1000.2 class hawaii

Router(config)#map-class frame-relay hawaii
Router(config-map-class)#frame-relay cir in 2000000
Router(config-map-class)#frame-relay cir out 56000
Router(config-map-class)#frame-relay be out 9000
Misconceptions:
None

Related Commands:
None


%command%

Command:

traffic-shape adaptive

Mode:

Router(config-if)#

Syntax:

traffic-shape adaptive bit-rate

no traffic-shape adaptive

Syntax Description:

bit-rate

Lowest bit rate that traffic is shaped to, in bits per second. The default bit rate value is 0.

Command Description:

To configure a Frame Relay subinterface to estimate the available bandwidth when backward explicit congestion notification (BECN) signals are received, use the traffic-shape adaptive interface configuration command in interface configuration mode. To disregard the BECN signals and not estimate the available bandwidth, use the no form of this command.

Example:

The following example configures traffic shaping on serial interface 0.1 with an upper limit of 128 kbps and a lower limit of 64 kbps. This configuration allows the link to run from 64 to 128 kbps, depending on the congestion level.

interface serial 0

 encapsulation-frame-relay

interface serial 0.1

 traffic-shape rate 128000

 traffic-shape adaptive 64000

 traffic-shape fecn-adapt

Misconceptions:

None

Related commands:

traffic-shape rate

traffic-shape fecn-adapt

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

traffic-shape fecn-adapt

Mode:

Router(config-if)#

Syntax:

traffic-shape fecn-adapt

no traffic-shape fecn-adapt

Syntax Description:

This command has no arguments or keywords.

Command Description:

To reply to messages with the forward explicit congestion notification (FECN) bit (which are sent with TEST RESPONSE messages with the BECN bit set), use the traffic-shape fecn-adapt command in interface configuration mode. To stop backward explicit congestion notification (BECN) signal generation, use the no form of this command.

Example:

interface serial 0

 encapsulation-frame-relay

interface serial 0.1

 traffic-shape rate 128000

 traffic-shape adaptive 64000

 traffic-shape fecn-adapt

Misconceptions:

None

Related commands:

traffic-shape adaptive

traffic-shape rate

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

traffic-shape rate

Mode:

Router(config-if)#

Syntax:

traffic-shape rate bit-rate [burst-size [excess-burst-size][buffer-limit]

no traffic-shape rate

Syntax Description:

bit-rate | Bit rate that traffic is shaped to, in bits per second. This is the access bit rate that you contract with your service provider, or the service levels you intend to maintain. Bit rates can be in the range of 8,000 to 100,000,000 bps.
burst-size | (Optional) Sustained number of bits that can be sent per interval. On Frame Relay interfaces, this is the Committed Burst size contracted with your service provider. Valid entries are numbers in the range of 0 to 100,000,000.
excess-burst-size | (Optional) Maximum number of bits that can exceed the burst size in the first interval in a congestion event. On Frame Relay interfaces, this is the Excess Burst size contracted with your service provider. Valid entries are numbers in the range of 0 to 100,000,000. The default is equal to the burst-size argument.
buffer-limit | (Optional) Maximum buffer limit in bps. Valid entries are numbers in the range of 0 to 4,096.

Command Description:

To enable traffic shaping for outbound traffic on an interface, use the traffic-shape rate command in interface configuration mode. To disable traffic shaping on the interface, use the no form of this command.

Example:

The following example enables traffic shaping on serial interface 0 using the bandwidth required by the service provider:

interface serial 0

 traffic-shape rate 128000 16000 8000

Misconceptions:

None

Related commands:

traffic-shape adaptive

traffic-shape fecn-adapt

© Cisco Systems, Inc. 2001, 2002


 Command:

show frame-relay lmi

Mode:

Router#

Syntax:

show frame-relay lmi [type number]

Syntax Description:

type

(Optional) Interface type, it must be serial

number

(Optional) Interface number

Command Description:

To display statistics about the Local Management Interface (LMI), use the show frame-relay lm i EXEC command.

Enter the command without arguments to obtain statistics about all Frame Relay interfaces.

Example:

The following is a sample of output from the show frame-relay lmi command when the interface is a DTE:

Router#show frame-relay lmi

LMI Statistics for interface Serial0/1 (Frame Relay DTE) LMI TYPE = ANSI
  Invalid Unnumbered info 0             Invalid Prot Disc 0
  Invalid dummy Call Ref 0              Invalid Msg Type 0
  Invalid Status Message 0              Invalid Lock Shift 0
  Invalid Information ID 0              Invalid Report IE Len 0
  Invalid Report Request 0              Invalid Keep IE Len 0
  Num Status Enq. Sent 9                Num Status msgs Rcvd 0
  Num Update Status Rcvd 0              Num Status Timeouts 9

The following is a sample of output from the show frame-relay lmi command when the interface is an NNI:

Router#show frame-relay lmi

LMI Statistics for interface Serial0/2 (Frame Relay NNI) LMI TYPE = CISCO
  Invalid Unnumbered info 0             Invalid Prot Disc 0
  Invalid dummy Call Ref 0              Invalid Msg Type 0
  Invalid Status Message 0              Invalid Lock Shift 0
  Invalid Information ID 0              Invalid Report IE Len 0
  Invalid Report Request 0              Invalid Keep IE Len 0
  Num Status Enq. Rcvd 11               Num Status msgs Sent 11
  Num Update Status Rcvd 0              Num St Enq. Timeouts 0
  Num Status Enq. Sent 10               Num Status msgs Rcvd 10
  Num Update Status Sent 0              Num Status Timeouts 0

The table below describes significant fields shown in the output.

Table: show frame-relay lmi Field Descriptions
Field Description

LMI Statistics

Signaling or LMI specification: CISCO, ANSI, or ITU-T

Invalid Unnumbered info

Number of received LMI messages with invalid unnumbered information field

Invalid Prot Disc

Number of received LMI messages with invalid protocol discriminator

Invalid dummy Call Ref

Number of received LMI messages with invalid dummy call references

Invalid Msg Type

Number of received LMI messages with invalid message type

Invalid Status Message

Number of received LMI messages with invalid status message

Invalid Lock Shift

Number of received LMI messages with invalid lock shift type

Invalid Information ID

Number of received LMI messages with invalid information identifier

Invalid Report IE Len

Number of received LMI messages with invalid Report IE Length

Invalid Report Request

Number of received LMI messages with invalid Report Request

Invalid Keep IE Len

Number of received LMI messages with invalid Keep IE Length

Num Status Enq. Sent

Number of LMI status inquiry messages sent

Num Status Msgs Rcvd

Number of LMI status messages received

Num Update Status Rcvd

Number of LMI asynchronous update status messages received

Num Status Timeouts

Number of times the status message was not received within the keepalive time value

Num Status Enq. Rcvd

Number of LMI status enquiry messages received

Num Status Msgs Sent

Number of LMI status messages sent

Num Status Enq. Timeouts

Number of times the status enquiry message was not received within the T392 DCE timer value

Num Update Status Sent

Number of LMI asynchronous update status messages sent

Misconceptions:
None

Related commands:
None


 Command:

show frame-relay map

Mode:

Router#

Syntax:

show frame-relay map

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the current map entries and information about the connections, use the show frame-relay map EXEC command.

Example:

The following is a sample of output from the show frame-relay map command:

Router# show frame-relay map

Serial 1 (administratively down): ip 131.108.177.177
dlci 177 (0xB1,0x2C10), static, broadcast, CISCO
TCP/IP Header Compression (inherited), passive (inherited)

The following table describes significant fields shown in the display:

Table: show frame-relay map Field Descriptions
Field Description

Serial 1 (administratively down)

Identifies a Frame Relay interface and its status (up or down).

ip 131.108.177.177

Destination IP address.

dlci 177 (0xB1,0x2C10)

DLCI that identifies the logical connection being used to reach this interface. This value is displayed in three ways: its decimal value (177), its hexadecimal value (0xB1), and its value as it would appear on the wire (0x2C10).

static

Indicates whether this is a static or dynamic entry.

CISCO

Indicates the encapsulation type for this map, either CISCO or IETF.

TCP/IP Header Compression (inherited), passive (inherited)

Indicates whether the TCP/IP header compression characteristics were inherited from the interface or were explicitly configured for the IP map.

Misconceptions:

None

Related commands:

show frame-relay pvc


 Command:

show frame-relay pvc

Mode:

Router#

Syntax:

show frame-relay pvc [type number [dlci]]

Syntax Description:

type

(Optional) Interface type

number

(Optional) Interface number

dlci

(Optional) This represents one of the specific DLCI numbers used on the interface. Statistics for the specified PVC display when a DLCI is also specified.

Command Description:

To display statistics about PVCs for Frame Relay interfaces, use the show frame-relay pvc EXEC command.

Statistics Reporting

To obtain statistics about PVCs on all Frame Relay interfaces, use this command with no arguments.

Per VC counters are not incremented at all when either autonomous or SSE switching is configured. Therefore, PVC values will be inaccurate if either switching method is used.

DCE, DTE, and Logical Interfaces

When the interface is configured as a DCE and the DLCI usage is SWITCHED, the value displayed in the PVC STATUS field is determined by the status of outgoing interfaces (up or down) and the status of the outgoing PVC. The status of the outgoing PVC is updated in the Local Management Interface (LMI) message exchange. PVCs terminated on a DCE interface use the status of the interface to set the PVC STATUS.

In the case of a hybrid DTE switch, the PVC status on the DTE side is determined by the PVC status reported by the external Frame Relay network through the LMI.

If the outgoing interface is a tunnel, the PVC status is determined by what is learned from the tunnel.

Traffic Shaping

Congestion control mechanisms are currently not supported, but the switch passes forward explicit congestion notification (FECN) bits, backward explicit congestion notification (BECN) bits, and discard eligibility (DE) bits unchanged from entry to exit points in the network.

If an LMI status report indicates that a PVC is not active, then it is marked as inactive. A PVC is marked as deleted if it is not listed in a periodic LMI status message.

Example:

The following is a sample of output from the show frame-relay pvc command:

Router#show frame-relay pvc
    PVC Statistics for interface Serial (Frame Relay DCE)

DLCI = 22, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial3/1:1.1

input pkts 9   output pkts 300008   in bytes 2754
out bytes 161802283   dropped pkts 0   in FECN pkts 0
in BECN pkts 1   out FECN pkts 0   out BECN pkts 0
in DE pkts 0   out DE pkts 0
outbcast pkts 0   outbcast bytes 0
Shaping adapts to ForeSight   in ForeSight signals 1304
pvc create time 1d05h, last time pvc status changed 00:11:00

If the circuit is configured for shaping to adapt to BECN, it is indicated in the display:

  Shaping adapts to BECN

If traffic shaping on the circuit does not adapt to either BECN or ForeSight, nothing extra shows:

DLCI = 100, DLCI USAGE = SWITCHED, PVC STATUS = ACTIVE

input pkts 0   output pkts 0   in bytes 0
out bytes 0   dropped pkts 0   in FECN pkts 0
in BECN pkts 0   out FECN pkts 0   out BECN pkts 0
in DE pkts 0   out DE pkts 0
outbcast pkts 0   outbcast bytes 0
pvc create time 0:03:03 last time pvc status changed 0:03:03
Num Pkts Switched 0

The following is a sample of output from the show frame-relay pvc command for multipoint subinterfaces. The output displays both the subinterface number and the DLCI. This display is the same whether the PVC is configured for static or dynamic addressing:

DLCI = 300, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial0.103

input pkts 10   output pkts 7   in bytes 6222
out bytes 6034   dropped pkts 0   in FECN pkts 0
in BECN pkts 0   out FECN pkts 0   out BECN pkts 0
in DE pkts 0   out DE pkts 0
outbcast pkts 0   outbcast bytes 0
pvc create time 0:13:11  last time pvc status changed 0:11:46

DLCI = 400, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial0.104

input pkts 20   output pkts 8   in bytes 5624
out bytes 5222   dropped pkts 0   in FECN pkts 0
in BECN pkts 0   out FECN pkts 0   out BECN pkts 0
in DE pkts 0   out DE pkts 0
outbcast pkts 0   outbcast bytes 0
pvc create time 0:03:57  last time pvc status changed 0:03:48

The following table describes the additional fields shown in the display when traffic shaping is in effect:

Table: show frame-relay pvc
Field Descriptions
Field Description

DLCI

One of the data link connection identifier (DLCI) numbers for the PVC

DLCI USAGE

One of the following values:

  • SWITCHED—the router or access server is used as a switch
  • LOCAL—the router or access server is used as a DTE
  • UNUSED—the DLCI is not referenced by any user-entered configuration commands on the router

PVC STATUS

Status of the PVC: ACTIVE, INACTIVE, or DELETED

INTERFACE = Serial0.103

Specific subinterface associated with this DLCI

input pkts

Number of packets received on this PVC

output pkts

Number of packets sent on this PVC

in bytes

Number of bytes received

out bytes

Number of bytes sent

dropped pkts

Number of packets dropped by the router at Frame Relay level because an active outbound DLCI was not found

in FECN pkts

Number of packets received with the FECN bit set

in BECN pkts

Number of packets received with the BECN bit set

out FECN pkts

Number of packets sent with the FECN bit set

out BECN pkts

Number of packets sent with the BECN bit set

in DE pkts

Number of DE packets received

out DE pkts

Number of DE packets sent

outbcast pkts

Number of output broadcast packets

outbcast bytes

Number of output broadcast bytes

pvc create time

Time the PVC was created

last time pvc status changed

Time the PVC changed status (active to inactive)

Num Pkts Switched

Number of packets switched within the router or access server, this PVC is the source PVC

The following is a sample of output from the show frame-relay pvc command with no traffic shaping configured on the interface:

Router#show frame-relay pvc

PVC Statistics for interface Serial1 (Frame Relay DTE)

DLCI = 100, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial1

  input pkts 0             output pkts 0            in bytes 0
  out bytes 0              dropped pkts 0           in FECN pkts 0
  in BECN pkts 0           out FECN pkts 0          out BECN pkts 0
  in DE pkts 0             out DE pkts 0
  out bcast pkts 0          out bcast bytes 0

The following is a sample of output from the show frame-relay pvc command when traffic shaping is in effect:

Router#show frame-relay pvc

PVC Statistics for interface Serial1 (Frame Relay DTE)

DLCI = 101, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial1
input pkts 14046    output pkts 4339    in bytes 960362
  out bytes 675566    dropped pkts 0           in FECN pkts 0
  in BECN pkts 148    out FECN pkts 0          out BECN pkts 0
  in DE pkts 44       out DE pkts 0
  out bcast pkts 4034          out bcast bytes 427346

pvc create time 11:59:29, last time pvc status changed 11:59:29
CIR 64000         BC 8000         BE 1600     limit 2000      interval 125
mincir 32000      byte incremen 500           BECN response yes
pkts 9776         bytes 838676     pkts delayed 0         bytes delayed 0
shaping inactive

List   Queue  Args
1      4      byte-count 100
  Output queues: (queue #: size/max/drops)
     0: 0/20/0 1: 0/20/0 2: 0/20/0 3: 0/20/0 4: 0/20/0
     5: 0/20/0 6: 0/20/0 7: 0/20/0 8: 0/20/0 9: 0/20/0
     10: 0/20/0 11: 0/20/0 12: 0/20/0 13: 0/20/0 14: 0/20/0
     15: 0/20/0 16: 0/20/0

Table: show frame-relay pvc
Field Descriptions with Traffic Shaping in Effect
Field Description

CIR

Current committed information rate (CIR), in bits per second

BC

Current committed burst size, in bits

BE

Current excess burst size, in bits

limit

Maximum number of bytes transmitted per internal interval (excess plus
sustained)

interval

Interval being used internally interval being used internally (may be smaller than the interval derived from Bc/CIR, this happens when the router determines that traffic flow will be more stable with a smaller configured interval)

mincir

Minimum committed information rate (CIR) for the PVC

incremen

Number of bytes that will be sustained per internal interval

BECN response

Frame Relay has BECN Adaptation configured

List Queue Args

Identifier and parameter values for a custom queue list defined for the PVC (These identifiers and values correspond to the command queue-list 1
queue 4 byte-count 100)

Output queues

Output queues used for the PVC, with the current size, the maximum size, and the number of dropped frames shown for each queue

The packet and byte values are counts for the number of packets and bytes that have gone through the traffic shaping system.

Misconceptions:
None

Related commands:
None


 Command:

standby ip

Mode:

Router(config-if)#

Syntax:

standby [group-number] ip [ip-address [secondary]]

no standby [group-number] ip [ip-address]

Syntax Description:

group-number

(Optional) Group number on the interface for which HSRP is being activated. Default is 0.

ip-address

(Optional) IP address of the Hot Standby Router interface.

secondary

(Optional) Indicates the IP address is a secondary Hot Standby Router interface. Useful on interfaces with primary and secondary addresses; you can configure primary and secondary HSRP addresses.

Command Description:

To activate the Hot Standby Router Protocol (HSRP), use the standby ip interface configuration command. To disable HSRP, use the no form of this command.

The standby ip command activates HSRP on the configured interface. If an IP address is specified, that address is used as the designated address for the Hot Standby group. If no IP address is specified, the designated address is learned through the standby function. For HSRP to elect a designated router, at least one router on the cable must have been configured with, or learned, the designated address. Configuring the designated address on the active router always overrides a designated address that is currently in use.

When the standby ip command is enabled on an interface, the handling of proxy ARP requests is changed (unless proxy ARP was disabled). If the interface's Hot Standby state is active, proxy ARP requests are answered using the Hot Standby group's MAC address. If the interface is in a different state, proxy ARP responses are suppressed.

When group number 0 is used, no group number is written to NVRAM, providing backward compatibility.
Examples:

The following example activates HSRP for group 1 on FastEthernet interface 0/0. The IP address used by the Hot Standby group will be learned using HSRP.

Router(config)#interface fastethernet 0/0
 Router(config-if)#standby 1 ip

In the following example, all three virtual IP addresses appear in the ARP table using the same (single) virtual MAC address. All three virtual IP addresses are using the same HSRP group (group 0).

Router(config-if)#ip address 1.1.1.1 255.255.255.0
Router(config-if)#ip address 1.2.2.2 255.255.255.0 secondary
Router(config-if)#ip address 1.3.3.3 255.255.255.0 secondary
Router(config-if)#ip address 1.4.4.4 255.255.255.0 secondary
Router(config-if)#standby ip 1.1.1.254
Router(config-if)#standby ip 1.2.2.254 secondary
Router(config-if)#standby ip 1.3.3.254 secondary
Misconceptions:
None

Related commands:
None


 Command:

standby preempt or priority

Mode:

Router(config-if)#

Syntax:

standby [group-number] priority priority [preempt [delay delay]]

standby [group-number] [priority priority] preempt [delay delay]

no standby [group-number] priority priority [preempt [delay delay]]

no standby [group-number] [priority priority] preempt [delay delay]

Syntax Description:

group-number

(Optional) Group number on the interface to which the other arguments in this command apply.

priority priority

(Optional) Priority value that prioritizes a potential Hot Standby router. The range is 1 to 255, where 1 denotes the lowest priority and 255 denotes the highest priority. The default priority value is 100. The router in the HSRP group with the highest priority value becomes the active router.

preempt

(Optional) The router is configured to preempt, which means that when the local router has a Hot Standby priority higher than the current active router, the local router should attempt to assume control as the active router. If preempt is not configured, the local router assumes control as the active router only if it receives information indicating that there is no router currently in the active state (acting as the designated router).

delay delay

(Optional) Time in seconds. The delay argument causes the local router to postpone taking over the active role for delay seconds since that router was last restarted. The range is 0 to 3600 seconds (1 hour). The default is 0 seconds (no delay).

Command Description:

To configure Hot Standby Router Protocol (HSRP) priority, preemption, and preemption delay, use the standby interface configuration command. To restore the default values, use the no form of this command.

When using this command, you must specify at least one keyword (priority or preempt) or you can specify both.

When group number 0 is used, no group number is written to NVRAM, providing backward compatibility.

The assigned priority is used to help select the active and standby routers. Assuming preemption is enabled, the router with the highest priority becomes the designated active router. In case of ties, the primary IP addresses are compared, and the higher IP address has priority.

Note that the device's priority can change dynamically if an interface is configured with the standby track command and another interface on the router goes down.

When a router first comes up, it does not have a complete routing table. If it is configured to preempt, it will become the active router, yet it is unable to provide adequate routing services. This problem is solved by configuring a delay before the preempting router actually preempts the currently active router.

The assigned priority has a higher priority than the authentication string specified in the standby authentication command. A router with a higher HSRP priority will ignore the authentication string.
Example:

In the following example, the router has a priority of 120 (higher than the default value) and will wait for 300 seconds (5 minutes) before attempting to become the active router:

Router(config)#interface fastethernet 0

Router(config-if)#standby ip 172.19.108.254
Router(config-if)#standby priority 120 preempt delay 300
Misconceptions:
None

Related commands:
standby track


 Command:

standby timers

Mode:

Router(config-if)#

Syntax:

standby [group-number] timers [msec] hellotime [msec] holdtime

no standby [group-number] timers [msec] hellotime [msec] holdtime

Syntax Description:

group-number

(Optional) Group number on the interface to which the timers apply. The default is 0.

msec

(Optional) Interval in milliseconds. Millisecond timers allow for faster failover.

hellotime

Hello interval in seconds.This is an integer from 1 to 255. The default is 3 seconds. If the msec option is specified, hello interval is in milliseconds. This is an integer from 20 to 999.

holdtime

Time in seconds before the active or standby router is declared to be down. This is an integer from 1 to 255. The default is 10 seconds. If the msec option is specified, holdtime is in milliseconds. This is an integer from 20 to 999.

Command Description:

To configure the time between hellos and the time before other routers declare the active Hot Standby or standby router to be down, use the standby timers interface configuration command. To restore the timers to their default values, use the no form of this command.

The standby timers command configures the time between standby hellos and the time before other routers declare the active or standby router to be down. Routers or access servers on which timer values are not configured can learn timer values from the active or standby router. The timers configured on the active router always override any other timer settings. All routers in a Hot Standby group should use the same timer values. Normally, holdtime is greater than or equal to 3 times the value of hellotime, (holdtime > 3 * hellotime). The value of the standby timer will not be learned through HSRP hellos if it is less than 1 second.

When group number 0 is used, no group number is written to NVRAM, providing backward compatibility.

Examples:

The following example sets, for group number 1 on Ethernet interface 0, the time between hello packets to 5 seconds, and the time after which a router is considered to be down to 15 seconds:

Router(config)#interface ethernet 0
 Router(config-if)#standby 1 ip 1.1.1.1
 Router(config-if)#standby 1 timers 5 15

The following example sets, for the Hot Router interface located at 172.19.10.1 on Ethernet interface 0, the time between hello packets to 300 milliseconds, and the time after which a router is considered to be down to 900 milliseconds.

Router(config)#interface ethernet 0
 Router(config-if)#standby ip 172.19.10.1
 Router(config-if)#standby timers msec 300 msec 900

Misconceptions:
None

Related commands:
None


 Command:

standby track

Mode:

Router(config-if)#

Syntax:

standby [group-number]track type number [interface-priority]

no standby [group-number] track type number [interface-priority]

Syntax Description:

group-number

(Optional) Group number on the interface to which the tracking applies.

type

Interface type (combined with interface number) that will be tracked.

number

Interface number (combined with interface type) that will be tracked.

interface-priority

(Optional) Amount by which the Hot Standby priority for the router is decremented (or incremented) when the interface goes down (or comes back up). The default value is 10.

Command Description:

To configure an interface so that the Hot Standby priority changes based on the availability of other interfaces, use the standby track interface configuration command. To remove the tracking, use the no form of this command.

This command ties the router's Hot Standby priority to the availability of its interfaces. It is useful for tracking interfaces that are not configured for the Hot Standby Router Protocol.

When a tracked interface goes down, the Hot Standby priority decreases by 10. If an interface is not tracked, its state changes do not affect the Hot Standby priority. For each interface configured for Hot Standby, you can configure a separate list of interfaces to be tracked.

The optional argument interface-priority specifies how much to decrement the Hot Standby priority when a tracked interface goes down. When the tracked interface comes back up, the priority is incremented by the same amount.

When multiple tracked interfaces are down and interface-priority values have been configured, these configured priority decrements are cumulative. If tracked interfaces are down, but none of them were configured with priority decrements, the default decrement is 10 and it is noncumulative.

When group number 0 is used, no group number is written to NVRAM, providing backward compatibility.
Example:

In the following example, Ethernet interface 1 tracks Ethernet interface 0 and serial interface 0. If one or both of these two interfaces go down, the Hot Standby priority of the router decreases by 10. Because the default Hot Standby priority is 100, the priority becomes 90 when one or both of the tracked interfaces go down.

Router(config)#interface ethernet 1
 Router(config-if)#ip address 198.92.72.37 255.255.255.240
 Router(config-if)#no ip redirects
 Router(config-if)#standby track ethernet 0
 Router(config-if)#standby track serial 0
 Router(config-if)#standby preempt
 Router(config-if)#standby ip 198.92.72.46
Misconceptions:
None

Related commands:
standby preempt or priority


Command:

standby use-bia

Mode:

Router(config-if)#

Syntax:

standby use-bia [scope interface]
no standby use-bia

Syntax Description:

scope interface (Optional) Specifies that this command is configured just for the subinterface on which it was entered, instead of the major interface.

Command Description:

To configure the Hot Standby Router Protocol (HSRP) to use the burned-in address of the interface as its virtual MAC address, instead of the preassigned MAC address (on Ethernet and FDDI) or the functional address (on Token Ring), use the standby use-bia interface configuration command. To restore the default virtual MAC address, use the no form of this command.

By default, HSRP uses the preassigned MAC address on Ethernet and FDDI, or the functional address on Token Ring.

For an interface with this command configured, multiple standby group can be configured. Hosts on the interface must have a default gateway configured. We recommend that you set the no ip proxy-arp command on the interface. It is desirable to configure the standby use-bia command on a Token Ring interface if there are devices that reject ARP replies with source hardware addresses set to a functional address.

When HSRP runs on a multiple-ring, source-routed bridging environment and the HRSP routers reside on different rings, configuring the standby use-bia command can prevent confusion about the routing information field (RFI).

Without the scope interface keywords, the standby use-bia command applies to all subinterfaces on the major interface. The standby use-bia command may not be configured both with and without the scope interface keywords at the same time.

Example:

In the following example, the burned-in address of Token Ring interface 4/0 will be the virtual MAC address mapped to the virtual IP address:

Router(config)#interface token4/0
Router(config-if)#standby use-bia

Misconceptions:

None

Related Commands:

None


 Command:

show standby

Mode:

Router#

Syntax:

show standby [type number [group]] [brief]

Syntax Description:

type number

(Optional) Interface type and number for which output is displayed.

group

(Optional) Group number on the interface for which output is displayed.

brief

(Optional) A single line of output summarizes each standby group.

Command Description:

To display Hot Standby Router Protocol (HSRP) information, use the show standby EXEC command.

If you want to specify a group, you must also specify an interface type and number.

Examples:

The following is a sample of output from the show standby command:

Router#show standby

FastEthernet0/0 - Group 0
   Local state is Active, priority 100, may preempt
   Hellotime 3 holdtime 10
   Next hello sent in 0:00:00
   Hot standby IP address is 198.92.72.29 configured
   Active router is local
   Standby router is 198.92.72.21 expires in 0:00:07
  Tracking interface states for 2 interfaces, 2 up:
    Up    FastEthernet0/0
    Up    Serial0/0

The following is a sample of output from the show standby command with a specific interface and the brief keyword:

Router#show standby fastethernet0 brief

Interface   Grp Prio P State    Active addr     Standby addr    Group addr
Et0         0   100    Standby  171.69.232.33   local           172.19.48.254

The table below describes the fields in the display.

Table: show standby Field Descriptions
Field Description

Ethernet0 - Group 0

Interface type and number and Hot Standby group number for the interface

Local state is ...

State of local router; can be one of the following:

  • Active—Current Hot Standby router
  • Standby—Router next in line to be the Hot Standby router

priority

Priority value of the router based on the standby priority, standby preempt command

may preempt (indicated by P in the brief output)

Indicates that the router will attempt to assume control as the active router if its priority is greater than the current active router

Hellotime

Time between hello packets (in seconds), based on the standby timers command

holdtime

Time (in seconds) before other routers declare the active or standby router to be down, based on the standby timers command

Next hello sent in ...

Time in which the Cisco IOS software will send the next hello packet (in hours:minutes:seconds).

Hot Standby IP address is ... configured

IP address of the current Hot Standby router. The word "configured" indicates that this address is known through the standby ip command. Otherwise, the address was learned dynamically through HSRP hello packets from other routers that do have the HSRP IP address configured.

Active router is ...

Value can be "local" or an IP address. Address of the current active Hot Standby router

Standby router is ...

Value can be "local" or an IP address. Address of the "standby" router (the router that is next in line to be the Hot Standby router)

expires in

Time (in hours:minutes:seconds) in which the standby router will no longer be the standby router if the local router receives no hello packets from it.

Tracking interface states for ...

List of interfaces that are being tracked and their corresponding states. Based on the standby track command.

Misconceptions:

None

Related commands:
standby ip
standby preempt or priority
standby timers
standby track


 Command:

ip forward-protocol

Mode:

Router(config)#

Syntax:

ip forward-protocol {udp [port] | nd  | sdns | any-local-broadcast | spanning-tree | turbo-flood}

no ip forward-protocol {udp [port] | nd  | sdns | any-local-broadcast | spanning-tree | turbo-flood}

Syntax Description:
any-local-broadcast | Direct the router to forward any broadcasts including local subnet broadcasts.
spanning-tree | Permit IP broadcasts to be flooded throughout the internetwork in a controlled fashion.
turbo-flood | Speed up flooding of User Datagram Protocol (UDP) datagrams using the spanning-tree algorithm.
udp | Forward User Datagram Protocol (UDP) datagrams. See the "Default" section below for a list of port numbers forwarded by default.
nd | Forward Network Disk (ND) datagrams. This protocol is used by older diskless Sun workstations.
sdns | Secure Data Network Service.
port | (Optional) Destination port that controls which UDP services are forwarded.

Command Description:

To specify which protocols and ports the router forwards when forwarding broadcast packets, use the ip forward-protocol global configuration command. To remove a protocol or port, use the no form of this command.

Example:

Router(config)#ip forward-protocol udp 3001

Misconceptions:
None

Related Commands:
ip helper-address


 Command:

ip helper-address

Mode:

Router(config-if)#

Syntax:

ip helper-address address

no ip helper-address address

Syntax Description:
address Destination broadcast or host address to be used when forwarding UDP broadcasts. There can be more than one helper address per interface.

Command Description:

To have the Cisco IOS software forward User Datagram Protocol (UDP) broadcasts, including BOOTP, received on an interface, use the ip helper-address interface configuration command. To disable the forwarding of broadcast packets to specific addresses, use the no form of this command.

Example:
Router(config-if)#ip helper-address 121.24.43.2

Misconceptions:
None

Related Commands:
None


 Command:

ip unnumbered

Mode:

Router(config-if)#

Syntax:

ip unnumbered type number

no ip unnumbered

Syntax Description:
type | Interface type
number | Interface number

Command Description:

To enable IP processing on a serial interface without assigning an explicit IP address to the interface, use the ip unnumbered interface configuration command. To disable the IP processing on the interface, use the no form of this command.

Example:
Router(config-if)#ip unnumbered fastethernet 0/0

Misconceptions:

The ip unnumbered command is intended for serial interfaces; a common misconception is that ip unnumbered works with all physical and link layer standards. It does not, for example, work with smds or x25.

Related Commands:
None


 Command:

version

Mode:

Router(config-router)#

Syntax:
version {1 | 2}

no version {1 | 2}

Syntax Description:

1 Specifies RIP Version 1
2

Specifies RIP Version 2

Command Description:

To specify a RIP version used globally by the router, use the version router configuration command. Use the no form of this command to restore the default value.

Example:

Router(config-router)#version 2

Misconceptions:
None

Related commands:
None


Command:

show arp

Mode:

Router#

Syntax:

show arp

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the entries in the Address Resolution Protocol (ARP) table, use the show arp privileged EXEC command.

Example:

The following is sample output from the show arp command:

Router# show arp

Protocol   Address           Age (min)    Hardware Addr     Type    Interface

Internet   131.108.42.112    120         0000.a710.4baf    ARPA    Ethernet3

AppleTalk  4028.5            29           0000.0c01.0e56   SNAP     Ethernet2

Internet   131.108.42.114    105          0000.a710.859b   ARPA     Ethernet3

AppleTalk  4028.9            -           0000.0c02.a03c    SNAP    Ethernet2

Internet    131.108.42.121    42           0000.a710.68cd    ARPA     Ethernet3

Internet    131.108.36.9      -            0000.3080.6fd4    SNAP    TokenRing0

AppleTalk  4036.9            -            0000.3080.6fd4    SNAP    TokenRing0

Internet   131.108.33.9      -            0000.0c01.7bbd    SNAP     Fddi0

Table 3 describes the significant fields shown in the display.

Table 3 show arp Field Descriptions

Field

Description

Protocol

Protocol for network address in the Address field.

Address

The network address that corresponds to the Hardware Address.

Age (min)

Age in munutes of the cache entryh. A hyphen (-) means the address is local.

Hardware Addr

LAN hardware address of a MAC address that corresponds to the network address.

Type

Indicates the encapsulation type the Cisco IOS software is using for the network address in this entry. Possible values include:

  • ARPA
  • SNAP
  • ETLK (EtherTalk)
  • SMDS

Interface

Indicates the interface associated with this network address.

Misconceptions:

None.

Related Commands:

None.


 Command:

show ip arp

Mode:

Router#

Syntax:

show ip arp [ip-address] [hostname] [mac-address] [type number]

Syntax Description:

ip-address

(Optional) ARP entries matching this IP address are displayed.

hostname

(Optional) Host name.

mac-address

(Optional) 48-bit MAC address.

type number

(Optional) ARP entries learned via this interface type and number are displayed.

Command Description:

To display the Address Resolution Protocol (ARP) cache, where SLIP addresses appear as permanent ARP table entries, use the show ip arp EXEC command.

ARP establishes correspondences between network addresses (an IP address, for example) and LAN hardware addresses (Ethernet addresses). A record of each correspondence is kept in a cache for a predetermined amount of time and then discarded.

Example:

The following is a sample of output from the show ip arp command:

Router#show ip arp

Protocol  Address	Age(min)  Hardware Addr  Type   Interface
Internet  171.69.233.22	9	0000.0c59.f892 ARPA   Ethernet0/0
Internet  171.69.233.21	8	0000.0c07.ac00 ARPA   Ethernet0/0
Internet  171.69.233.19	-	0000.0c63.1300 ARPA   Ethernet0/0
Internet  171.69.233.30	9	0000.0c36.6965 ARPA   Ethernet0/0
Internet  172.19.168.11	-	0000.0c63.1300 ARPA   Ethernet0/0
Internet  172.19.168.254	9	0000.0c36.6965 ARPA   Ethernet0/0

The table describes significant fields shown in the display.

Table: show ip arp Field Descriptions
Field Description

Protocol

Protocol for network address in the Address field

Address

The network address that corresponds to Hardware Address

Age (min)

Age, in minutes, of the cache entry. A hyphen (-) means the address is local

Hardware Addr

LAN hardware address a MAC address that corresponds to network address

Type

Type of encapsulation:

  • ARPA—Ethernet
  • SNAP—RFC 1042
  • SAP—IEEE 802.3

Interface

Interface to which this address mapping has been assigned

Misconceptions:

None

Related commands:
None


Command:

show ip interface

Mode:

Router>
Router#

Syntax:

show ip interface interface-type number

Syntax Description:

type | (Optional) Specifies that information be displayed about that interface type only. The possible value depends on the type of interfaces the system has. For example, it could be Ethernet, null, serial, token ring, and so forth.
number | (Optional) Interface number.

Command Description:

To display the usability status of interfaces configured for IP, use the show ip interface EXEC command.

Example:

Router#show ip interface
FastEthernet0 is up, line protocol is up
  Internet address is 192.195.78.24, subnet mask is 255.255.255.240
  Broadcast address is 255.255.255.255
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Secondary address 131.192.115.2, subnet mask 255.255.255.0
    Directed broadcast forwarding is enabled
  Multicast groups joined: 224.0.0.1 224.0.0.2
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is disabled
  IP SSE switching is disabled
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  Probe proxy name replies are disabled
  Web Cache Redirect is enabled

Field | Description
FastEthernet0 is up | If the interface hardware is usable, the interface is marked "up." For an interface to be usable, both the interface hardware and line protocol must be up.
line protocol is up | If the interface can provide two-way communication, the line protocol is marked "up." For an interface to be usable, both the interface hardware and line protocol must be up.
Internet address and subnet mask | IP Internet address and subnet mask of the interface.
Broadcast address | Displays the broadcast address.
Address determined by... | Indicates how the IP address of the interface was determined.
MTU | Displays the MTU value set on the interface.
Helper address | Displays a helper address, if one has been set.
Secondary address | Displays a secondary address, if one has been set.
Directed broadcast forwarding | Indicates whether directed broadcast forwarding is enabled.
Multicast groups joined | Indicates the multicast groups this interface is a member of.
Outgoing access list | Indicates whether the interface has an outgoing access list set.
Inbound access list | Indicates whether the interface has an incoming access list set.
Proxy ARP | Indicates whether Proxy Address Resolution Protocol (ARP) is enabled for the interface.
Security level | Specifies the IP Security Option (IPSO) security level set for this interface.
Split horizon | Indicates that split horizon is enabled.
ICMP redirects | Specifies whether redirect messages will be sent on this interface.
ICMP unreachables | Specifies whether unreachable messages will be sent on this interface.
ICMP mask replies | Specifies whether mask replies will be sent on this interface.
IP fast switching | Specifies whether fast switching has been enabled for this interface. It is generally enabled on serial interfaces, such as this one.
IP SSE switching | Specifies whether IP silicon switching engine (SSE) is enabled.
Router Discovery | Specifies whether the discovery process has been enabled for this interface. It is generally disabled on serial interfaces.
IP output packet accounting | Specifies whether IP accounting is enabled for this interface and what the threshold (maximum number of entries) is.
TCP/IP header compression | Indicates whether compression is enabled or disabled.
Probe proxy name | Indicates whether HP Probe proxy name replies are generated.
WCCP Redirect outbound is enabled | Indicates the status of whether packets received on an interface are redirected to a cache engine. Displays "enabled" or "disabled."
WCCP Redirect exclude is disabled | Indicates the status of whether packets targeted for an interface will be excluded from being redirected to a cache engine. Displays "enabled" or "disabled."

Misconceptions:

None

Related commands:

show interfaces

show access-lists


Command:

cgmp

Mode:

Switch(config)#

Syntax:

cgmp [leave-processing | holdtime time]

no cgmp [leave-processing | holdtime]

Syntax Description:

holdtime

(Optional) Set the amount of time a router connection is retained before the switch ceases to exchange messages with it

time

Number of seconds a router connection is retained before the switch ceases to exchange messages with it. You can enter a number from 10 to 6000 (seconds).

leave-processing

(Optional) Enable Fast Leave processing on the switch

Command Description:

Use the cgmp global configuration command to enable Cisco Group Management Protocol (CGMP). You can also enable and disable the Fast Leave parameter and set the router port aging time. Use the no form of this command to disable CGMP. By default CGMP is enabled and Fast Leave is disabled. The default holdtime is 300 seconds.

Usage Guidelines:

CGMP must be enabled before the Fast Leave option can be enabled. Fast Leave processing optimizes the use of network bandwidth by reducing the delay between members of a multicast group leaving the group and the actual pruning of multicast traffic to that segment.

Example:

This example shows how to enable CGMP on a switch:

Switch(config)#cgmp
The following command enables CGMP Fast Leave processing:
Switch(config)#cgmp leave-processing

Misconceptions:

None

Related Commands:

show cgmp


 Command:

ip igmp join-group

Mode:

Router(config)#

Syntax:

ip igmp join-group group-address

no ip igmp join-group group-address

Syntax Description:

group-address

Address of the multicast group. This is a multicast IP address in four-part, dotted notation.

Command Description:

To have the router join a multicast group, use the ip igmp join-group interface configuration command. To cancel membership in a multicast group, use the no form of this command.

IP packets that are addressed to the group address are passed to the IP client process in the Cisco IOS software.

If all the multicast-capable routers and access servers that you administer are members of a multicast group, pinging that group causes all routers to respond. This can be a useful administrative and debugging tool.

Another reason to have a router join a multicast group is when other hosts on the network have a bug in IGRP that prevents them from correctly answering IGMP queries. Having the router join the multicast group causes upstream routers to maintain multicast routing table information for that group and keep the paths for that group active.
Example:

In the following example, the router joins multicast group 225.2.2.2:

Router(config)#ip igmp join-group 225.2.2.2
Misconceptions:
None

Related Commands:
ping


%command%

Command:

ip igmp version

Mode:

Router(config)#

Syntax:

ip igmp version {1 | 2 | 3}

no ip igmp version

Syntax Description:

1 | IGMP Version 1.
2 | IGMP Version 2.
3 | IGMP Version 3.

Command Description:

To configure which version of Internet Group Management Protocol (IGMP) the router uses, use the ip igmp version command in interface configuration mode. To restore the default value, use the no form of this command.

Example:

The following example configures the router to use IGMP Version 3:

Router(config)#ip igmp version 3

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


 Command:

ip mroute-cache

Mode:

Router(config-if)#

Syntax:

ip mroute source-address mask [protocol as-number] {rpf-address | type number} [distance]

no ip mroute source-address mask [protocol as-number] {rpf-address | type number} [distance]

Syntax Description:
source-address | IP address of the multicast source.
mask | Mask on the IP address of the multicast source.
protocol | (Optional) Unicast routing protocol that you are using.
as-number | (Optional) Autonomous system number of the routing protocol you are using, if applicable.
rpf-address | Incoming interface for the mroute. If the Reverse Path Forwarding (RPF) address rpf-address is a Protocol Independent Multicast (PIM) neighbor, PIM join, graft, and prune messages are sent to it. The rpf-address argument can be a host IP address of a directly connected system or a network/subnet number. When it is a route, a recursive lookup is done from the unicast routing table to find a directly connected system. If the rpf-address argument is not specified, the interface type number value is used as the incoming interface.
type-number | Interface type and number for the mroute.
distance | (Optional) Determines whether a unicast route, a Distance Vector Multicast Routing Protocol (DVMRP) route, or a static mroute should be used for the RPF lookup. The lower distances have better preference. If the static mroute has the same distance as the other two RPF sources, the static mroute will take precedence. The default is 0.

Command Description:

To configure IP multicast fast switching or multicast distributed switching (MDS), use the ip mroute-cache interface configuration command. To disable either of these features, use the no form of this command.

Usage Guidelines

On the RSP

If multicast fast switching is disabled on an incoming interface for a multicast routing table entry, the packet will be sent at process level for all interfaces in the outgoing interface list.

If multicast fast switching is disabled on an outgoing interface for a multicast routing table entry, the packet is process level switched for that interface, but may be fast-switched for other interfaces in the outgoing interface list.

When multicast fast switching is enabled (like unicast routing), debug messages are not logged. If you want to log debug messages, disable fast switching.

If MDS is not enabled on an incoming interface that is capable of MDS, incoming multicast packets will not be distributed switched; they will be fast-switched at the RP as before. Also, if the incoming interface is not capable of MDS, packets will get fast-switched or process-switched at the RP as before.

If MDS is enabled on the incoming interface, but at least one of the outgoing interfaces cannot fast-switch, packets will be process-switched. So it is a good idea not to disable fast switching on any interface when MDS is enabled.

On the GSR

On the GSR, all interfaces should be configured for MDS because that is the only switching mode.

Example:

The following example enables IP multicast fast switching on the interface:

Router(config-if)#no ip mroute-cache

The following example disables IP multicast fast switching on the interface:
Router(config-if)#no ip mroute-cache

The following example enables MDS on the interface:
Router(config-if)#ip mroute-cache distributed

The following example disables MDS and IP multicast fast switching on the interface:
Router(config-if)#no ip mroute-cache distributed

Misconceptions:
None

Related Commands:
ip multicast-routing


 Command:

ip multicast ttl-threshold

Mode:

Router(config-if)#

Syntax:

ip multicast ttl-threshold ttl-value

no ip multicast ttl-threshold [ttl-value]

Syntax Description:

ttl-value

This specifies the time-to-live value, expressed in hops. It can be a value from 0 to 255. The default value is 0, which means that all multicast packets are forwarded out the interface.

Command Description:

To configure the time-to-live (TTL) threshold of packets being forwarded out an interface, use the ip multicast ttl-threshold interface configuration command. To return to the default TTL threshold, use the no form of this command.

Only multicast packets with a TTL value greater than the threshold are forwarded out the interface.

You should configure the TTL threshold only on border routers. Conversely, routers on which you configure a TTL threshold value automatically become border routers.

This command replaces the ip multicast-threshold command, which is obsolete.

Example:

The following example sets the TTL threshold on a border router to 200, which is a very high value. This means that multicast packets must have a TTL greater than 200 in order to be forwarded out this interface. Multicast applications generally set this value well below 200. Therefore, setting a value of 200 means that no packets will be forwarded out the interface.

Router(config)#interface tunnel 0
Router(config-if)#ip multicast ttl-threshold 200

Misconceptions:
None

Related Commands:
None


 Command:

ip multicast-routing

Mode:

Router(config)#

Syntax:

ip multicast-routing [distributed]

no ip multicast-routing

Syntax Description:

distributed

(Optional) Enables MDS.

Command Description:

To enable IP multicast routing or multicast distributed switching (MDS), use the ip multicast-routing global configuration command. To disable IP multicast routing and MDS, use the no form of this command.

When IP multicast routing is disabled, the Cisco IOS software does not forward any multicast packets.
Example:

The following example enables IP multicast routing:

Router(config)#ip multicast-routing

The following example disables IP multicast routing and MDS:

Router(config)#no ip multicast-routing

Misconceptions:

None

Related Commands:
ip pim send-rp-discovery
ip pim send-rp-announce
ip pim rp-address


%command%

Command:

ip pim

Mode:

Router(config-if)#

Syntax:

ip pim {sparse-mode | sparse-dense-mode | dense-mode [proxy-register {list access-list | route-map map-name}]}
no ip pim

Syntax Description:

sparse-mode | Enables sparse mode of operation.
sparse-dense-mode | The interface is treated in either sparse mode or dense mode of operation, depending on which mode the multicast group operates in.
dense-mode | Enables dense mode of operation.
proxy-register | (Optional) Enables proxy registering on the interface of a designated router (DR) (leading toward the bordering dense mode region) for multicast traffic from sources not connected to the DR.
list access-list | (Optional) Defines the extended access list number or name.
route-map map-name | (Optional) Defines the route map.

Command Description:

To enable Protocol Independent Multicast (PIM) on an interface, use the ip pim command in interface configuration mode. To disable PIM on the interface, use the no form of this command.

Example:

The following example shows how to enable PIM-SM on tunnel interface 0 and set the address of the RP router to 226.0.0.8:

ip pim rp-address 226.0.0.8

interface tunnel 0

ip pim sparse-mode

The following example shows how to enable PIM-DM on Ethernet interface 1:

interface ethernet 1

ip pim dense-mode

The following example shows how to enable PIM sparse-dense mode on Ethernet interface 1:

interface ethernet 1

ip pim sparse-dense-mode

The following example shows how to register the multicast traffic for any source and any multicast group:

interface ethernet 0

ip address 131.108.175.110 255.255.255.0

description Ethernet interface towards the PIM sparse-mode domain

ip pim sparse-dense-mode

!

interface ethernet 1

ip address 192.44.81.5 255.255.255.0

description Ethernet interface towards the PIM dens-mode region

ip pim dense-mode proxy-register list 100

!

access-list 100 permit ip any any

Misconceptions:

None

Related commands:

ip pim rp-address
ip pim send-rp-announce
ip pim send-rp-discovery

© Cisco Systems, Inc. 2001, 2002


Command:

ip pim rp-address

Mode:

Router(config)#

Syntax:

ip pim rp-address ip-address[group-access-list-number] [override]

no ip pim rp-address ip-address [group-access-list-number]

Syntax Description:

ip-address

IP address of a router to be a PIM RP. This is a unicast IP address in four-part, dotted notation.

group-access-list-number

(Optional) Number of an access list that defines for which multicast groups the RP should be used. This is a standard IP access list. The number can be from 1 to 100.

override

(Optional) Indicates that if there is a conflict between the RP configured
with this command and one learned by Auto-RP, the RP configured with this command prevails.

Command Description:

To configure the address of a PIM rendezvous point (RP) for a particular group, use the ip pim rp-address global configuration command. To remove an RP address, use the no form of this command. You must configure the IP address of RPs on all routers (including the RP router).

First-hop routers send register packets to the RP address on behalf of source multicast hosts. Routers also use this address on behalf of multicast hosts that want to become members of a group. These routers send Join and Prune messages towards the RP. The RP must be a PIM router; however, it does not require any special configuration to recognize that it is the RP. RPs are not members of the multicast group. They serve as a "meeting place" for multicast sources and group members.

You can configure the Cisco IOS software to use a single RP for more than one group. The conditions specified by the access list determine which groups the RP can be used for. If no access list is configured, the RP is used for all groups.

A PIM router can use multiple RPs, but only one per group.

If there is no RP configured for a group, the router will treat the group as dense using the dense-mode PIM techniques.

If the RP for a group is learned through a dynamic mechanism, such as Auto-RP, then this command might not be required. If there is a conflict between the RP configured with this command and one learned by Auto-RP, the Auto-RP information is used, unless the override keyword is specified.

Example:

The following example sets the PIM RP address to 198.92.37.33 for all multicast groups:

Router(config)#ip pim rp-address 198.92.37.33

The following example sets the PIM RP address to 147.106.6.22 for the multicast group 225.2.2.2 only:

Router(config)#access list 1 225.2.2.2 0.0.0.0

Router(config)#ip pim rp-address 147.106.6.22 1

Misconceptions:

None

Related Commands:

access-list


Command:

ip pim send-rp-announce

Mode:

Router(config)#

Syntax:

ip pim send-rp-announce type number scope ttl group-list access-list-number

no ip pim send-rp-announce

Syntax Description:

type number

Interface type and number that identify the RP address.

scope ttl

Time-to-live value that limits the announcements.

group-list access-list-number

Access list that describes the group ranges for which this router is the RP.

Command Description:

To use Auto-RP to configure which groups the router is willing to act as RP for, use the ip pim send-rp-announce global configuration command. To change this router from being the RP, use the no form of this command.

Use this command in the router you want to be an RP. This command causes the router to send an Auto-RP announcement message to the well-known group CISCO-RP-ANNOUNCE (224.0.1.39). This message announces the router as a candidate RP for the groups in the range described by the access list.

Example:

The following example sends RP announcements out all PIM-enabled interfaces for a maximum of 31 hops. The IP address the router wants to be identified by as RP is the IP address associated with FastEthernet interface 0/0. Access-list 5 describes for which groups this router serves as RP.

Router(config)#ip pim send-rp-announce FastEthernet 0/0 scope 31 group-list 5

Router(config)#access-list 5 permit 224.0.0.0 15.255.255.255

Misconceptions:

None

Related Commands:

access-list

ip pim send-rp-discovery


 Command:

ip pim send-rp-discovery

Mode:

Router(config)#

Syntax:

ip pim send-rp-discovery [type number] scope ttl

no ip pim send-rp-discovery [type number] scope ttl

Syntax Description:

type number

(Optional) Interface type and number that is used to define the RP mapping agent address.

scope ttl

Time-to-live value in the IP header that keeps the discovery messages within this number of hops.

Command Description:

To configure the router to be an RP-mapping agent, use the ip pim send-rp-discovery global configuration command. To restore the default value, use the no form of this command.

Configure this command on the router designated as an RP-mapping agent. Specify a TTL large enough to cover your PIM domain.

When Auto-RP is used, the following steps occur:

    1. The RP-mapping agent listens on well-known group address CISCO-RP-ANNOUNCE
    (224.0.1.39), which candidate RPs send to.

    2. The RP-mapping agent sends RP-to-group mappings in an Auto-RP RP discovery message to the well-known group CISCO-RP-DISCOVERY (224.0.1.40). The TTL value limits how many hops the message can take.

    3. PIM designated routers listen to this group and use the RPs they learn about from the discovery message.
Example:

The following example limits Auto-RP RP Discovery messages to 20 hops:

Router(config)#ip pim send-rp-discovery scope 20
Misconceptions:
None

Related Commands:
ip pim send-rp-announce


Command:

show ip igmp groups

Mode:

Router>

Syntax:

show ip igmp groups [group-name | group-address | type number] [detail]

Syntax Description:

group-name | (Optional) Name of the multicast group, as defined in the Domain Name System (DNS) hosts table.
group-address | (Optional) Address of the multicast group. This is a multicast IP address in four-part, dotted notation.
type | (Optional) Interface type.
number | (Optional) Interface number.
detail | (Optional) Provides a detailed description of the sources known through IGMP Version 3 (IGMPv3), IGMP v3lite, or URL Rendezvous Directory (URD).

Command Description:

To display the multicast groups with receivers that are directly connected to the router and that were learned through Internet Group Management Protocol (IGMP), use the show ip igmp groups command in EXEC mode.

If you omit all optional arguments and keywords, the show ip igmp groups command displays by group address, interface type, and interface number all directly connected multicast groups.

Example:

The following is sample output from the show ip igmp groups command:

Router#show ip igmp groups
IGMP Connected Group Membership
Group Address     Interface         Uptime      Expires     Last Reporter
239.255.255.254   Ethernet3/1       1w0d        00:02:19    172.21.200.159
224.0.1.40        Ethernet3/1       1w0d        00:02:15    172.21.200.1
224.0.1.40        Ethernet3/3       1w0d        never       171.69.214.251
224.0.1.1         Ethernet3/1       1w0d        00:02:11    172.21.200.11
224.9.9.2         Ethernet3/1       1w0d        00:02:10    172.21.200.155
232.1.1.1         Ethernet3/1       5d21h       stopped     172.21.200.206

The following is sample output from the show ip igmp groups command with the group-address argument and detail keyword:

Router#show ip igmp groups 232.1.1.1 detail
Interface: Ethernet3/2
Group: 232.1.1.1
Uptime: 01:58:28
Group mode:     INCLUDE
Last reporter: 10.0.119.133
CSR Grp Exp: 00:02:38
Group source list: (C - Cisco Src Report, U - URD, R - Remote)
  Source Address Uptime v3 Exp CSR Exp Fwd Flags
171.69.214.1 01:58:28 stopped 00:02:31 Yes C

show ip igmp groups Field Descriptions

Field   |  Description

Group Address  | Address of the multicast group.

Interface  |
 Interface through which the group is reachable.

Uptime  |
 How long (in weeks, days, hours, minutes, and seconds) this multicast group has been known.

Expires
 How long (in hours, minutes, and seconds) until the entry expires. If an entry expires, then it will (for a short period) show the word "now" before it is removed.

The word "never" indicates that the entry will not time out, because a local receiver is on this router for this entry.

The word "stopped" indicates that timing out of this entry is not determined by this expire timer. If the router is in INCLUDE mode for a group, then the whole group entry will time out after the last source entry has timed out (unless the mode is changed to EXCLUDE mode before it times out).

Last Reporter  |
 Last host to report being a member of the multicast group. Both IGMP v3lite and URD require a v2-report.

Group mode:
 Can be either INCLUDE or EXCLUDE. The group mode is based on the type of membership reports received on the interface for the group. In the output for the show ip igmp groups detail command, the EXCLUDE mode also shows the "Expires:" field for the group entry (not shown in the output).

CSR Grp Exp  |
 This field is shown for multicast groups in the Source Specific Multicast (SSM) range. It indicates the time (in hours, minutes, and seconds) since the last received group membership report was received. Cisco IOS software needs to use these reports for the operation of URD and IGMP v3lite, but they do not indicate group membership by themselves.

Group source list:
 Provides details of which sources have been requested by the multicast group.

Source Address  |
 IP address of the source.

Uptime  |
 Indicates the time since the source state was created.

v3 Exp  |
 Indicates the time (in hours, minutes, and seconds) until the membership for the source will time out according to IGMP operations. The word "stopped" is shown if no member uses IGMPv3 (but only IGMP v3lite or URD).

CSR Exp  |
 Indicates the time (in hours, minutes, and seconds) until the membership for the source will time out according to IGMP v3lite or URD reports. The word "stopped" is shown if members use only IGMPv3.

Fwd  |
 Indicates whether the router is forwarding multicast traffic due to this entry.

Flags  |
 Information about the entry. The Remote flag indicates that an IGMPv3 report has been received by this source. The C flag indicates that an IGMP v3lite or URD report was received by this source. The U flag indicates that a URD report was received for this source.

Misconceptions:

None

Related Commands:

None


 Command:

show ip igmp interface

Mode:

Router>

Syntax:

show ip igmp interface [type number]

Syntax Description:

type

(Optional) Interface type

number

(Optional) Interface number

Command Description:

To display multicast-related information about an interface, use the show ip igmp interface EXEC command.

If you omit the optional arguments, the show ip igmp interface command displays information about all interfaces.

This command also displays information about dynamically learned DVMRP routers on the interface.

Example:

The following is sample output from the show ip igmp interface command:

Router#show ip igmp interface

Ethernet0 is up, line protocol is up
  Internet address is 198.92.37.6, subnet mask is 255.255.255.0
  IGMP is enabled on interface
  IGMP query interval is 60 seconds
  Inbound IGMP access group is not set
  Multicast routing is enabled on interface
  Multicast TTL threshold is 0
  Multicast designated router (DR) is 198.92.37.33
  No multicast groups joined
Ethernet1 is up, line protocol is up
  Internet address is 198.92.36.129, subnet mask is 255.255.255.0
  IGMP is enabled on interface
  IGMP query interval is 60 seconds
  Inbound IGMP access group is not set
  Multicast routing is enabled on interface
  Multicast TTL threshold is 0
  Multicast designated router (DR) is 198.92.36.131
  Multicast groups joined: 225.2.2.2 226.2.2.2
Tunnel0 is up, line protocol is up
  Internet address is 10.1.37.2, subnet mask is 255.255.0.0
  IGMP is enabled on interface
  IGMP query interval is 60 seconds
  Inbound IGMP access group is not set
  Multicast routing is enabled on interface
  Multicast TTL threshold is 0
  No multicast groups joined

The table below describes the fields shown in the display.

Table: show ip igmp interface Field Descriptions
Field Description

Ethernet0 is up, line protocol is up

Interface type, number, and status.

Internet address is...
subnet mask is...

Internet address of the interface and subnet mask being applied to the interface, as specified with the ip address command.

IGMP is enabled on interface

Indicates whether IGMP has been enabled on the interface with the ip pim command.

IGMP query interval is 60 seconds

Interval at which the Cisco IOS software sends PIM router-query messages, as specified with the ip igmp query-interval command.

Inbound IGMP access group is not set

Indicates whether an IGMP access group has been configured with the ip igmp access-group command.

Multicast routing is enabled on interface

Indicates whether multicast routing has been enabled on the interface with the ip pim command.

Multicast TTL threshold is 0

Packet time-to-threshold, as specified with the ip multicast ttl-threshold command.

Multicast designated router (DR) is...

IP address of the designated router for this LAN segment (subnet).

Multicast groups joined:
No multicast groups joined

Indicates whether this interface is a member of any multicast groups and, if so, lists the IP addresses of the groups.

Misconceptions:

None

Related commands:

ip multicast ttl-threshold
ip igmp join-group


 Command:

show ip pim interface

Mode:

Router>

Syntax:

show ip pim interface [type number] [count]

Syntax Description:

type

(Optional) Interface type

number

(Optional) Interface number

count

(Optional) Number of packets received and sent out the interface

Command Description:

To display information about interfaces configured for Protocol Independent Multicast (PIM) , use the show ip pim interface EXEC command.

This command works only on interfaces that are configured for PIM.

Examples:

The following is a sample of output from the show ip pim interface command:

Router#show ip pim interface

Address          Interface          Mode    Neighbor  Query     DR
                                            Count     Interval
198.92.37.6      FastEthernet0/0    Dense   2         30        198.92.37.33
198.92.36.129    FastEthernet0/1    Dense   2         30        198.92.36.131
10.1.37.2        Tunnel0            Dense   1         30        0.0.0.0

The following is a sample of output from the show ip pim interface command with a count:

Router#show ip pim interface count

Address          Interface          FS  Mpackets In/Out
171.69.121.35    FastEthernet0/0    *   548305239/13744856
171.69.121.35    Serial0/0.33       *   8256/67052912
198.92.12.73     Serial0/0.1719     *   219444/862191

The table describes the fields shown in the display.

Table: show ip pim interface Field Descriptions
Field Description

Address

IP address of the next-hop router.

Interface

Interface type and number that is configured to run PIM.

Mode

Multicast mode in which the Cisco IOS software is operating. This can be dense mode or sparse mode. DVMRP indicates a DVMRP tunnel is configured.

Neighbor Count

Number of PIM neighbors that have been discovered through this interface. If the Neighbor Count is 1 for a DVMRP tunnel, the neighbor is active (receiving probes and reports).

Query Interval

Frequency, in seconds, of PIM router-query messages, as set by the ip pim query-interval interface configuration command. The default is 30 seconds.

DR

IP address of the designated router on the LAN. Note that serial lines do not have designated routers, so the IP address is shown as 0.0.0.0.

FS

An asterisk (*) in this column indicates fast switching is enabled.

Mpackets In/Out

Number of packets into and out of the interface since the box has been up.

Misconceptions:

None

Related commands:
show ip pim neighbor


 Command:

show ip pim neighbor

Mode:

Router>

Syntax:

show ip pim neighbor [type number]

Syntax Description:

type

(Optional) Interface type.

number

(Optional) Interface number.

Command Description:

To list the PIM neighbors discovered by the Cisco IOS software, use the show ip pim neighbor EXEC command.

Use this command to determine which routers on the LAN are configured for PIM.

Example:

The following is a sample of output from the show ip pim neighbor command:

Router#show ip pim neighbor

PIM Neighbor Table
Neighbor Address  Interface          Uptime    Expires   Mode
198.92.37.2       FastEthernet0      17:38:16  0:01:25   Dense
198.92.37.33      FastEthernet0      17:33:20  0:01:05   Dense (DR)
198.92.36.131     FastEthernet0/1    17:33:20  0:01:08   Dense (DR)
198.92.36.130     FastEthernet0/1    18:56:06  0:01:04   Dense
10.1.22.9         Tunnel0            19:14:59  0:01:09   Dense

The table describes the fields shown in the display.

Table: show ip pim neighbor Field Descriptions
Field Description

Neighbor Address

IP address of the PIM neighbor

Interface

Interface type and number on which the neighbor is reachable

Uptime

How long in hours, minutes, and seconds the entry has been in the PIM neighbor table

Expires

How long in hours, minutes, and seconds until the entry will be removed from the IP multicast routing table

Mode

Mode in which the interface is operating

(DR)

Indicates that this neighbor is a designated router on the LAN

Misconceptions:

None

Related commands:
show ip pim interface


Command:

clear ip nat translation

Mode:

Router#

Syntax:

clear ip nat translation {* | [inside global-ip local-ip] [outside local-ip global-ip]}

clear ip nat translation protocol {[inside global-ip global-port local-ip local-port] | [outside local-ip global-ip]}

Syntax Description:

*

Clears all dynamic translations.

inside

Clears the inside translations containing the specified global-ip and local-ip addresses.

global-ip

When used without the arguments protocol, global-port, and local-port, clears a simple translation that also contains the specified local-ip address. When used with the arguments protocol, global-port, and local-port, clears an extended translation.

local-ip

(Optional) Clears an entry that contains this local IP address and the specified global-ip address.

outside

Clears the outside translations containing the specified global-ip and local-ip addresses.

protocol

(Optional) Clears an entry that contains this protocol and the specified global-ip address, local-ip address, global-port, and local-port.

global-port

(Optional) Clears an entry that contains this global-port and the specified protocol, global-ip address, local-ip address, and local-port.

local-port

(Optional) Clears an entry that contains this local-port and the specified protocol, global-ip address, local-ip address, and global-port.

Command Description:

To clear dynamic Network Address Translation (NAT) translations from the translation table, use the clear ip nat translation EXEC command.

Use this command to clear entries from the translation table before they time out.

Example:

The following example shows the NAT entries before and after the UDP entry being cleared:

Router#show ip nat translation

Pro Inside global      Inside local       Outside local      Outside global
udp 171.69.233.209:1220 192.168.1.95:1220 171.69.2.132:53    171.69.2.132:53
tcp 171.69.233.209:11012 192.168.1.89:11012 171.69.1.220:23  171.69.1.220:23
tcp 171.69.233.209:1067 192.168.1.95:1067 171.69.1.161:23    171.69.1.161:23

Router#clear ip nat translation udp inside 171.69.233.209 1220 192.168.1.95 1220 171.69.2.132 53 171.69.2.132 53

Router#show ip nat translation
Pro Inside global      Inside local       Outside local      Outside global
tcp 171.69.233.209:11012 192.168.1.89:11012 171.69.1.220:23  171.69.1.220:23
tcp 171.69.233.209:1067 192.168.1.95:1067 171.69.1.161:23    171.69.1.161:23

Misconceptions:

None

Related Commands:

ip nat

ip nat inside destination

ip nat inside source

ip nat pool

show ip nat statistics

show ip nat translations


 Command:

ip nat

Mode:

Router(config-if)#

Syntax:

ip nat {inside | outside}

no ip nat {inside | outside}

Syntax Description:

inside

Indicates the interface is connected to the inside network (the network subject to NAT translation).

outside

Indicates the interface is connected to the outside network.

Command Description:

To designate that traffic originating from or destined for the interface is subject to Network Address Translation (NAT), use the ip nat interface configuration command. To prevent the interface from being able to translate, use the no form of this command.

Only packets moving between "inside" and "outside" interfaces can be translated. You must specify at least one inside interface and one outside interface for each border router where you intend to use NAT.
Example:

The following example translates between inside hosts addressed from either the 192.168.1.0 or 192.168.2.0 networks to the globally unique 171.69.233.208/28 network:

ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28
ip nat inside source list 1 pool net-208
!
interface fastethernet 0/0
 ip address 171.69.232.182 255.255.255.240
 ip nat outside
!
interface fastethernet 0/1
 ip address 192.168.1.94 255.255.255.0
 ip nat inside
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.2.0 0.0.0.255
Misconceptions:
None

Related Commands:
clear ip nat translation
ip nat inside destination
ip nat inside source
ip nat pool
ip nat translation
show ip nat statistics
show ip nat translations


 Command:

ip nat inside destination

Mode:

Router(config)#

Syntax:

ip nat inside destination list{access-list-number | name} pool name

no ip nat inside destination list {access-list-number | name}

Syntax Description:

list access-list-number

Standard IP access list number. Packets with destination addresses that pass the access list are translated using global addresses from the named pool.

list name

Name of a standard IP access list. Packets with destination addresses that pass the access list are translated using global addresses from the named pool.

pool name

Name of the pool from which global IP addresses are allocated during dynamic translation.

Command Description:

To enable Network Address Translation (NAT) of the inside destination address, use the ip nat inside destination global configuration command. To remove the dynamic association to a pool, use the no form of this command.

This command has two forms: dynamic and static address translation. The form with an access list establishes dynamic translation. Packets from addresses that match the standard access list are translated using global addresses allocated from the pool named with the ip nat pool command.
Example:

The following portion of a show running-config translates between inside hosts addressed to either the 192.168.1.0 or 192.168.2.0 networks to the globally unique 171.69.233.208/28 network:

ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28
ip nat inside destination list 1 pool net-208
!
interface fastethernet 0/0
 ip address 171.69.232.182 255.255.255.240
 ip nat outside
!
interface fastethernet 0/1
 ip address 192.168.1.94 255.255.255.0
 ip nat inside
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.2.0 0.0.0.255
Misconceptions:
None

Related Commands:
clear ip nat translation
ip nat
ip nat inside source
ip nat pool
ip nat translation
show ip nat statistics
show ip nat translations


Command:

ip nat inside source

Mode:

Router(config)#

Syntax:

ip nat inside source {list {access-list-number |name} {pool name | interface dialer-name} [overload] | static local-ip global-ip}

no ip nat inside source {list {access-list-number | name}{pool name | interface dialer-name} [overload] | static local-ip global-ip}

Syntax Description:

list access-list-number

Standard IP access list number. Packets with source addresses that pass the access list are dynamically translated using global addresses from the named pool.

list name

Name of a standard IP access list. Packets with source addresses that pass the access list are dynamically translated using global addresses from the named pool.

pool name

Name of the pool from which global IP addresses are allocated dynamically.

interface dialer-name

Name of the dialer interface on which the PPP/IPCP address negotiation takes place.

overload

(Optional) Enables the router to use one global address for many local addresses. When overloading is configured, each inside host's TCP or UDP port number distinguishes between the multiple conversations using the same local IP address.

static local-ip

Sets up a single static translation. This argument establishes the local IP address assigned to a host on the inside network. The address could be randomly chosen, allocated from RFC 1918, or obsolete.

global-ip

Sets up a single static translation. This argument establishes the globally unique IP address of an inside host as it appears to the outside world.

Command Description:

To enable Network Address Translation (NAT) of the inside source address, use the ip nat inside source global configuration command. To remove the static translation or remove the dynamic association to a pool, use the no form of this command.

This command has two forms: dynamic and static address translation. The form with an access list establishes dynamic translation. Packets from addresses that match the standard access list are translated using global addresses allocated from the pool named with the ip nat pool command.

Alternatively, the syntax form with the keyword static establishes a single static translation.

Example:

The following portion of a show running-config translates between inside hosts addressed from either the 192.168.1.0 or 192.168.2.0 networks to the globally unique 171.69.233.208/28 network:

ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28

ip nat inside source list 1 pool net-208

!

interface ethernet 0

ip address 171.69.232.182 255.255.255.240

ip nat outside

!

interface ethernet 1

ip address 192.168.1.94 255.255.255.0

ip nat inside

!

access-list 1 permit 192.168.1.0 0.0.0.255

access-list 1 permit 192.168.2.0 0.0.0.255

Misconceptions:

None

Related Commands:

clear ip nat translation

ip nat

ip nat inside destination

ip nat pool

ip nat translation

show ip nat statistics

show ip nat translations


 Command:

ip nat pool

Mode:

Router(config)#

Syntax:

ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length}[type rotary]

no ip nat pool name

Syntax Description:

name

Name of the pool.

start-ip

Starting IP address that defines the range of addresses in the address pool.

end-ip

Ending IP address that defines the range of addresses in the address pool.

netmask netmask

Network mask that indicates which address bits belong to the network and subnetwork fields and which bits belong to the host field. Specify the netmask of the network to which the pool addresses belong.

prefix-length prefix-length

Number that indicates how many bits of the netmask are ones (how many bits of the address indicate network). Specify the netmask of the network to which the pool addresses belong.

type rotary

(Optional) Indicates that the range of address in the address pool identify real, inside hosts among which TCP load distribution will occur.

Command Description:

To define a pool of IP addresses for Network Address Translation (NAT), use the ip nat pool global configuration command. To remove one or more addresses from the pool, use the no form of this command.

This command defines a pool of addresses using start address, end address, and either netmask or prefix length. The pool could define either an inside global pool, an outside local pool, or a rotary pool.
Example:

The following portion of a show running-config translates between inside hosts addressed from either the 192.168.1.0 or 192.168.2.0 networks to the globally unique 171.69.233.208/28 network:

ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28
ip nat inside source list 1 pool net-208
!
interface ethernet 0
 ip address 171.69.232.182 255.255.255.240
 ip nat outside
!
interface ethernet 1
 ip address 192.168.1.94 255.255.255.0
 ip nat inside
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.2.0 0.0.0.255
Misconceptions:
None

Related Commands:
clear ip nat translation
ip nat
ip nat inside destination
ip nat inside source
ip nat translation
show ip nat statistics
show ip nat translations


 Command:

ip nat translation

Mode:

Router(config)#

Syntax:

ip nat translation {timeout | udp-timeout | dns-timeout | tcp-timeout | finrst-timeout} seconds

no ip nat translation {timeout | udp-timeout | dns-timeout | tcp-timeout | finrst-timeout}

Syntax Description:

timeout

Specifies that the timeout value applies to dynamic translations except for overload translations. Default is 86400 seconds (24 hours).

udp-timeout

Specifies that the timeout value applies to the UDP port. Default is 300 seconds (5 minutes).

dns-timeout

Specifies that the timeout value applies to connections to the Domain Naming System (DNS). Default is 60 seconds.

tcp-timeout

Specifies that the timeout value applies to the TCP port. Default is 86400 seconds (24 hours).

finrst-timeout

Specifies that the timeout value applies to Finish and Reset TCP packets, which terminate a connection. Default is 60 seconds.

seconds

Number of seconds after which the specified port translation times out. Default values are listed in the Default section.

Command Description:

To change the amount of time after which Network Address Translation (NAT) translations time out, use the ip nat translation global configuration command. To disable the timeout, use the no form of this command.

When port translation is configured, there is finer control over translation entry timeouts because each entry contains more context about the traffic that is using it. Non-Domain Naming System UDP translations time out after 5 minutes, while DNS times out in 1 minute. TCP translations timeout in 24 hours, unless a RST or FIN is seen on the stream, in which case they will time out in 1 minute.

Example:

The following example causes UDP port translation entries to timeout after 10 minutes:

Router(config)#ip nat translation udp-timeout 600
Misconceptions:
None

Related Commands:
clear ip nat translation
ip nat
ip nat inside destination
ip nat inside source
ip nat pool
show ip nat statistics
show ip nat translations


 Command:

show ip nat statistics

Mode:

Router>

Syntax:

show ip nat statistics

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display Network Address Translation (NAT) statistics, use the show ip nat statistics EXEC command.

Example:

The following is a sample of output from the show ip nat statistics command:

Router#show ip nat statistics

Total translations: 2 (0 static, 2 dynamic; 0 extended)
Outside interfaces: Serial0/0
Inside interfaces: FastEthernet0/1
Hits: 135  Misses: 5
Expired translations: 2
Dynamic mappings:
-- Inside Source
access-list 1 pool net-208 refcount 2
 pool net-208: netmask 255.255.255.240
        start 171.69.233.208 end 171.69.233.221
        type generic, total addresses 14, allocated 2 (14%), misses 0

The table describes the significant fields in the display.

Table: show ip nat statistics Field Descriptions
Field Description

Total translations

Number of translations active in the system. This number is incremented each time a translation is created and is decremented each time a translation is cleared or times out.

Outside interfaces

List of interfaces marked as outside with the ip nat outside command

Inside interfaces

List of interfaces marked as inside with the ip nat inside command

Hits

Number of times the software does a translations table lookup and finds an entry

Misses

Number of times the software does a translations table lookup, fails to find an entry, and must try to create one

Expired translations

Cumulative count of translations that have expired since the router was booted

Dynamic mappings

Indicates that the information that follows is about dynamic mappings

Inside Source

The information that follows is about an inside source translation

access-list

Access list number being used for the translation

pool

Name of the pool (in this case, net-208)

refcount

Number of translations that are using this pool

netmask

IP network mask being used in the pool

start

Starting IP address in the pool range

end

Ending IP address in the pool range

type

Type of pool. Possible types are generic or rotary

total addresses

Number of addresses in the pool that are available for translation

allocated

Number of addresses being used

misses

Number of failed allocations from the pool

Misconceptions:
None

Related commands:
clear ip nat translation
ip nat
ip nat inside destination
ip nat inside source


 Command:

show ip nat translations

Mode:

Router>

Syntax:

show ip nat translations [verbose]

Syntax Description:

verbose

(Optional) Displays additional information for each translation table entry, including how long ago the entry was created and used.

Command Description:

To display active Network Address Translation (NAT) translations, use the show ip nat translations EXEC command.

Examples:

The following is a sample of output from the show ip nat translations command. Without overloading, two inside hosts are exchanging packets with some number of outside hosts.

Router#show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global
--- 171.69.233.209     192.168.1.95       ---                ---
--- 171.69.233.210     192.168.1.89       ---                --

With overloading, a translation for a DNS transaction is still active, and translations for two Telnet sessions (from two different hosts) are also active. Note that two different inside hosts appear on the outside with a single IP address.

Router#show ip nat translations

Pro Inside global        Inside local       Outside local      Outside global
udp 171.69.233.209:1220  192.168.1.95:1220  171.69.2.132:53    171.69.2.132:53
tcp 171.69.233.209:11012 192.168.1.89:11012 171.69.1.220:23    171.69.1.220:23
tcp 171.69.233.209:1067  192.168.1.95:1067  171.69.1.161:23    171.69.1.161:23

The following is a sample of output that includes the verbose keyword.

Router#show ip nat translations verbose

Pro Inside global        Inside local       Outside local      Outside global
udp 171.69.233.209:1220  192.168.1.95:1220  171.69.2.132:53    171.69.2.132:53
        create 00:00:02, use 00:00:00, flags: extended
tcp 171.69.233.209:11012 192.168.1.89:11012 171.69.1.220:23    171.69.1.220:23
        create 00:01:13, use 00:00:50, flags: extended
tcp 171.69.233.209:1067  192.168.1.95:1067  171.69.1.161:23    171.69.1.161:23
        create 00:00:02, use 00:00:00, flags: extended

The table describes the significant fields in the display.

Table: show ip nat translationsField Descriptions
Field Description

Pro

Protocol of the port identifying the address

Inside global

The legitimate IP address (assigned by the NIC or service provider) that represents one or more inside local IP addresses to the outside world.

Inside local

The IP address assigned to a host on the inside network; probably not a legitimate address assigned by the NIC or service provider.

Outside local

IP address of an outside host as it appears to the inside network; probably not a legitimate address assigned by the NIC or service provider.

Outside global

The IP address assigned to a host on the outside network by its owner

create

How long ago the entry was created (in hours:minutes:seconds).

use

How long ago the entry was last used (in hours:minutes:seconds).

flags

Indication of the type of translation. Possible flags are:

  • extended—Extended translation
  • static—Static translation
  • destination—Rotary translation
  • outside—Outside translation
  • timing out—Translation will no longer be used, due to a TCP FIN or RST.

Misconceptions:
None

Related commands:
clear ip nat translation
ip nat
ip nat inside destination
ip nat inside source
ip nat pool
show ip nat statistics


%command%

Command:

show ip slb conns

Mode:

Router#

Syntax:

show ip slb conns [vserver virtserver-name] [client ip-address] [detail]

Syntax Description:

vserver | (Optional) Displays only those connections associated with a particular virtual server.
virtserver-name | (Optional) Name of the virtual server to be monitored.
client | (Optional) Displays only those connections associated with a particular client IP address.
ip-address | (Optional) IP address of the client to be monitored.
detail | (Optional) Displays detailed connection information.

Command Description:

To display the active IOS SLB connections, use the show ip slb conns privileged EXEC command.

Example:

The following example shows IOS SLB active connection data:

router#show ip slb conns

vserver prot client real state

----------------------------------------------------------------------------

TEST TCP 7.150.72.183:328 80.80.90.25:80 CLOSING

TEST TCP 7.250.167.226:423 80.80.90.26:80 CLOSING

TEST TCP 7.234.60.239:317 80.80.90.26:80 CLOSING

TEST TCP 7.110.233.96:747 80.80.90.26:80 CLOSING

TEST TCP 7.162.0.201:770 80.80.90.30:80 CLOSING

TEST TCP 7.22.225.219:995 80.80.90.26:80 CLOSING

TEST TCP 7.2.170.148:169 80.80.90.30:80 CLOSING

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show ip slb dfp

Mode:

Router#

Syntax:

show ip slb dfp [agent ip-address port-number | detail | weights]

Syntax Description:

agent | (Optional) Displays information about an agent.
ip-address | (Optional) Agent IP address.
port-number | (Optional) Agent port number.
detail | (Optional) Displays all data available.
weights | (Optional) Displays information about weights assigned to real servers for load balancing

Command Description:

To display DFP manager and agent information such as passwords, timeouts, retry counts, and weights, use the show ip slb dfp privileged EXEC command.

Example:

The following example shows IOS SLB DFP data:

router#show ip slb dfp detail

DFP Manager:

Current passwd:NONE Pending passwd:NONE

Passwd timeout:0 sec

Uned errors:0

DFP Agent 161.44.2.34:61936 Connection state:Connected

Timeout = 0 Retry Count = 0 Interval = 180 (Default)

Security errors = 0

Last message received:10:20:26 UTC 11/02/99

Last reported Real weights for Protocol TCP, Port www

Host 17.17.17.17 1 Weight 1

Host 68.68.68.68 Bind ID 4 Weight 4

Host 85.85.85.85 Bind ID 5 Weight 5

Last reported Real weights for Protocol TCP, Port 22

Host 17.17.17.17 Bind ID 111 Weight 111

router#show ip slb dfp weights

Real IP Address 17.17.17.17 Protocol TCP Port 22 Bind_ID 111 Weight 111

Set by Agent 161.44.2.3458490 at 132241 UTC 12/03/99

Real IP Address 17.17.17.17 Protocol TCP Port www Bind_ID 1 Weight 1

Set by Agent 161.44.2.3458490 at 132241 UTC 12/03/99

Real IP Address 68.68.68.68 Protocol TCP Port www Bind_ID 4 Weight 4

Set by Agent 161.44.2.3458490 at 132241 UTC 12/03/99

Real IP Address 85.85.85.85 Protocol TCP Port www Bind_ID 5 Weight 5

Set by Agent 161.44.2.3458490 at 132241 UTC 12/03/99

router#show ip slb dfp

DFP Manager:

Current passwd:NONE Pending passwd:NONE

Passwd timeout:0 sec

Agent IP Port Timeout Retry Count Interval

---------------------------------------------------------------

161.44.2.34 61936 0 0 180 (Default)

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show ip slb reals

Mode:

Router#

Syntax:

show ip slb reals [vserver virtserver-name] [detail]

Syntax Description:

vserver | (Optional) Displays information about only those real servers associated with a particular virtual server.
virtserver-name | (Optional) Name of the virtual server.
detail | (Optional) Displays detailed information.

Command Description:

To display information about the real servers, use the show ip slb reals privileged EXEC command.

Example:

The following example shows IOS SLB real server data:

router#show ip slb reals

real server farm weight state conns

--------------------------------------------------------------------

80.80.2.112 FRAG 8 OUTOFSERVICE 0

80.80.5.232 FRAG 8 OPERATIONAL 0

80.80.15.124 FRAG 8 OUTOFSERVICE 0

80.254.2.2 FRAG 8 OUTOFSERVICE 0

80.80.15.124 LINUX 8 OPERATIONAL 0

80.80.15.125 LINUX 8 OPERATIONAL 0

80.80.15.126 LINUX 8 OPERATIONAL 0

80.80.90.25 SRE 8 OPERATIONAL 220

80.80.90.26 SRE 8 OPERATIONAL 216

80.80.90.27 SRE 8 OPERATIONAL 216

80.80.90.28 SRE 8 TESTING 1

80.80.90.29 SRE 8 OPERATIONAL 221

80.80.90.30 SRE 8 OPERATIONAL 224

80.80.30.3 TEST 100 READY_TO_TEST 0

80.80.30.4 TEST 100 READY_TO_TEST 0

80.80.30.5 TEST 100 READY_TO_TEST 0

80.80.30.6 TEST 100 READY_TO_TEST 0

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show ip slb serverfarms

Mode:

Router#

Syntax:

show ip slb serverfarms [name serverfarm-name] [detail]

Syntax Description:

name | (Optional) Displays information about only a particular server farm.
serverfarm-name | (Optional) Name of the server farm.
detail | (Optional) Displays detailed server

Command Description:

To display information about the server farms, use the show ip slb serverfarms privileged EXEC command.

Example:

The following example shows IOS SLB server farm data:

router# show ip slb serverfarms

server farm predictor reals bind id

-------------------------------------------------

FRAG ROUNDROBIN 4 0

LINUX ROUNDROBIN 3 0

SRE ROUNDROBIN 6 0

TEST ROUNDROBIN 4 0

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show ip slb stats

Mode:

Router#

Syntax:

show ip slb stats

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display IOS SLB statistics, use the show ip slb stats privileged EXEC command.

Example:

The following example shows IOS SLB statistics:

router#show ip slb stats

Pkts via normal switching: 530616

Pkts via special switching:1812710

Connections Created: 783774

Connections Established: 633418

Connections Destroyed: 782752

Connections Reassigned: 0

Zombie Count: 0

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


Command:

show ip slb sticky

Mode:

Router#

Syntax:

show ip slb sticky [client ip-address]

Syntax Description:

client | (Optional) Displays only those sticky database entries associated with a particular client IP address.
ip-address | (Optional) IP address of the client.

Command Description:

To display the entries in the IOS SLB sticky database, use the show ip slb sticky privileged EXEC command.

If no options are specified, the command displays information about all virtual servers.

Example:

The following example shows the entries in the IOS SLB sticky database:

router#show ip slb sticky
client group real conns ftp-cntrl
--------------------------------------------------------------
10.10.2.12 4097 10.10.3.2 1 0

show ip slb sticky Field Descriptions
Field | Description
client | Client IP address that is bound to this sticky assignment.
group | Group ID for this sticky assignment.
real | Real server used by all clients connecting with the client IP address detailed on this line.
conns | Number of connections currently sharing this sticky assignment.
ftp-cntrl | Number of FTP control connections currently using this sticky assignment.

Misconceptions:

None

Related Commands:

None


Command:

show ip slb vservers

Mode:

Router#

Syntax:

show ip slb vservers [name virtserver-name] [detail]

Syntax Description:

name | (Optional) Displays information about only this virtual server.
virtserver-name | (Optional) Name of the virtual server.
detail | (Optional) Displays detailed virtual server information.

Command Description:

To display information about the virtual servers, use the show ip slb vservers privileged EXEC command.

If no options are specified, the command displays information about all virtual servers.

Example:

The following example shows virtual server data:

Router#show ip slb vservers
slb vserver prot virtual state conns
---------------------------------------------------------------------
TEST TCP 80.80.254.3:80 OPERATIONAL 1013
TEST21 TCP 80.80.254.3:21 OUTOFSERVICE 0
TEST23 TCP 80.80.254.3:23 OUTOFSERVICE 0

show ip slb vservers Field Descriptions
Field | Description
slb vserver | Name of the virtual server about which information is being displayed. Information about each virtual server is displayed on a separate line.
prot | Protocol being used by the virtual server detailed on a given line.
virtual | Virtual IP address of the virtual server detailed on a given line.
state | Current state of the virtual server detailed on a given line.
conns | Number of connections associated with the virtual server detailed on a given line.

Misconceptions:

None

Related Commands:

None


 Command:

clear ipx cache

Mode:

Router#

Syntax:

clear ipx cache

Syntax Description:

This command has no arguments or keywords.

Command Description:

To delete entries from the IPX fast-switching cache, use the clear ipx cache EXEC command.

Example:

Router#clear ipx cache

Misconceptions:

None

Related Commands:
show ipx cache
ipx route-cache


Command:

clear ipx route

Mode:

Router#

Syntax:

clear ipx route {network [network-mask] | default | *}

Syntax Description:

network

Number of the network whose routing table entry you want to delete. This is an eight-digit hexadecimal number that uniquely identifies a network cable segment. It can be a number in the range 1 to FFFFFFFD. You do not need to specify leading zeros in the network number. For example, for the network number 000000AA, you can enter AA.

network-mask

(Optional) Specifies the portion of the network address that is common to all addresses in an NLSP route summary. When used with the network argument, it specifies the NLSP route summary to clear.

The high-order bits of network-mask must be contiguous Fs, while the low-order bits must be contiguous zeros (0). An arbitrary mix of Fs and 0s is not permitted.

default

Deletes the default route from the routing table.

*

Deletes all routes in the routing table.

Command Description:

To delete routes from the IPX routing table, use the clear ipx route EXEC command. After you use the clear ipx route command, RIP/SAP general requests are issued on all IPX interfaces. For routers configured for NLSP route aggregation, use this command to clear an aggregated route from the routing table.

Example:

The following example clears the entry for network 3 from the IPX routing table:

Router#clear ipx route 3

The following example clears a route summary entry from the IPX routing table:

Router#clear ipx route ccc00000 fff00000

Misconceptions:

None

Related Commands:

show ipx route


 Command:

ipx access-group

Mode:

Router(config-if)#

Syntax:

ipx access-group {access-list-number | name} [in | out]

no ipx access-group [access-list-number | name] [in | out]

Syntax Description:

access-list-number

Number of the access list. For standard access lists, access-list-number is a number from 800 to 899. For extended access lists, access-list-number is a number from 900 to 999.

name

Name of the access list. Names cannot contain a space or quotation mark and must begin with an alphabetic character to prevent ambiguity with numbered access lists.

in

(Optional) Filters inbound packets. All incoming packets defined with either standard or extended access lists are filtered by the entries in this access list.

out

(Optional) Filters outbound packets. All outgoing packets defined with either standard or extended access lists and forwarded through the interface are filtered by the entries in this access list. This is the default when you do not specify an input (in) or output (out) keyword in the command line.

Command Description:

To apply generic input and output filters to an interface, use the ipx access-group interface configuration command. To remove filters, use the no form of this command.

Generic filters control which data packets an interface receives or sends out based on the packet's source and destination addresses, IPX protocol type, and source and destination socket numbers. You use the standard access-list and extended access-list commands to specify the filtering conditions.

You can apply only one input filter and one output filter per interface or subinterface.

When you do not specify an input (in) or output (out) filter in the command line, the default is an output filter.

You cannot configure an output filter on an interface where autonomous switching is already configured. Similarly, you cannot configure autonomous switching on an interface where an output filter is already present. You cannot configure an input filter on an interface if autonomous switching is already configured on any interface. Likewise, you cannot configure input filters if autonomous switching is already enabled on any interface.
Example:

The following example applies access list 801 to FastEthernet interface 0/1. Because the command line does not specify an input filter or output filter with the keywords in or out, the software assumes that it is an output filter.

Router(config)#interface fastethernet 0/1
Router(config-if)#ipx access-group 801

The following example applies access list 901 to FastEthernet interface 0/0. The access list is an input filter access list as specified by the keyword in.

Router(config)#interface fastethernet 0/0
Router(config-if)#ipx access-group 901 in

To remove the input access list filter in the previous example, you must specify the in keyword when you use the no form of the command. The following example correctly removes the access list:

Router(config)#interface fastethernet 0/0
Router(config-if)#no ipx access-group 901 in

Misconceptions:
None

Related Commands:
access-list (IPX standard)
access-list (IPX extended)
ipx access-list


 Command:

ipx access-list

Mode:

Router(config)#

Syntax:

ipx access-list {standard | extended | sap | summary} name

no ipx access-list {standard | extended | sap | summary} name

Syntax Description:

standard

Specifies a standard IPX access list.

extended

Specifies an extended IPX access list.

sap

Specifies a SAP access list.

summary

Specifies area addresses that summarize routes using NLSP route aggregation filtering.

name

Name of the access list. Names cannot contain a space or quotation mark, and they must begin with an alphabetic character to prevent ambiguity with numbered access lists.

Command Description:

To define an IPX access list by name, use the ipx access-list global configuration command. To remove a named IPX access list, use the no form of this command.

Use this command to configure a named IPX access list as opposed to a numbered IPX access list. This command will take you into access-list configuration mode, where you must define the denied or permitted access conditions with the deny and permit commands.

Specifying standard, extended, sap, or summary with the ipx access-list command determines the prompt you get when you enter access-list configuration mode.

Example:

The following example creates a standard access list named fred. It permits communication with only IPX network number 5678.

Router(config)#ipx access-list standard fred
Router(config-ipx-std-nacl)#permit 5678 any deny any

The following example creates an extended access list named sal that denies all SPX packets:

Router(config)#ipx access-list extended sal
Router(config-ipx-ext-nacl)#deny spx any all any all log
Router(config-ipx-ext-nacl)#permit any

The following example creates a SAP access list named MyServer that allows only MyServer to be sent in SAP advertisements:

Router(config)#ipx access-list sap MyServer
Router(config-ipx-sap-nacl)#permit 1234 4 MyServer
Misconceptions:
Named access lists will not be recognized by any software release prior to Cisco IOS Release 11.3.

Related Commands:
access-list (IPX extended)
access-list (IPX standard)


Command:

ipx bandwidth-percent eigrp

Mode:

Router(config-if)#

Syntax:

ipx bandwidth-percent eigrp as-number percent
no ipx bandwidth-percent eigrp as-number

Syntax Description:

as-number | Autonomous system number.
percent | Percentage of bandwidth that Enhanced IGRP may use.

Command Description:

To configure the percentage of bandwidth that may be used by Enhanced Interior Gateway Routing Protocol (EIGRP) on an interface, use the ipx bandwidth-percent eigrp command in interface configuration mode. To restore the default value, use the no form of this command.

Enhanced IGRP will use up to 50 percent of the bandwidth of a link, as defined by the bandwidth interface configuration command. This command may be used if some other fraction of the bandwidth is desired. Note that values greater than 100 percent may be configured; this may be useful if the bandwidth is set artificially low for other reasons.

Example:

The following example allows Enhanced IGRP to use up to 75 percent (42 kbps) of a 56-kbps serial link in autonomous system 209:

Router(config-if)# interface serial 0
Router(config-if)# bandwidth 56
Router(config-if)# ipx bandwidth-percent eigrp 209 75

Misconceptions:

None

Related Commands:

bandwidth
ipx router


 Command:

ipx default-route

Mode:

Router(config)#

Syntax:

ipx default-route

no ipx default-route

Syntax Description:

This command has no arguments or keywords.

Command Description:

To forward to the default network all packets for which a route to the destination network is unknown, use the ipx default-route global configuration command. To disable the use of the default network, use the no form of this command.

When you use the no ipx default-route command, Cisco IOS software no longer uses -2 as the default network. Instead, the software interprets -2 as a regular network and packets for which a route to the destination network is unknown are dropped.
Example:

The following example disables the forwarding of packets towards the default network:

Router(config)#no ipx default-route
Misconceptions:
None

Related Commands:
None


Command:

ipx eigrp-sap-split-horizon

Mode:

Router(config)#

Syntax:

ipx eigrp-sap-split-horizon

no ipx eigrp-sap-split-horizon

Syntax Description:

This command has no arguments or keywords.

Command Description:

To configure EIGRP SAP split horizon, use the ipx eigrp-sap-split-horizon global configuration command. To revert to default, use the no form of this command.

When split horizon is enabled, EIGRP SAP update and packets are not sent back to the receiving interface. This reduces the number of EIGRP packets on the network. Split horizon blocks the advertising of information from SAPs to the source router. This behavior optimizes communication among multiple routers. However, with nonbroadcast networks, such as Frame Relay and SMDS, situations can arise for which this behavior is less than ideal. For these situations, you may wish to disable split horizon.

Example:

The following example disables split horizon on the router:

Router(config)#no ipx eigrp-sap-split-horizon

Misconceptions:

When the ipx sap-incremental split-horizon interface configuration command is configured, it takes precedence over the ipx eigrp-sap-split-horizon command.

Related Commands:

ipx split-horizon eigrp

show ipx eigrp interfaces

show ipx eigrp neighbors

show ipx eigrp topology


Command:

ipx network

Mode:

Router(config-if)#

Syntax:

ipx network network [encapsulation encapsulation-type [secondary]]

no ipx network network [encapsulation encapsulation-type]

Syntax Description:

network

Network number. This is an eight-digit hexadecimal number that uniquely identifies a network cable segment. It can be a number in the range 1 to FFFFFFFD.

You do not need to specify leading zeros in the network number. For example, for the network number 000000AA you can enter AA.

encapsulation encapsulation-type

(Optional) Type of encapsulation (framing). It can be one of the following values:

  • arpa (for Ethernet interfaces only)—Use Novell's Ethernet_II encapsulation. This encapsulation is recommended for networks that handle both TCP/IP and IPX traffic.
  • hdlc (for serial interfaces only)—Use HDLC encapsulation.
  • novell-ether (for Ethernet interfaces only)—Use Novell's "Ethernet_802.3" encapsulation. This encapsulation consists of a standard 802.3 Media Access Control (MAC) header followed directly by the IPX header with a checksum of FFFF. It is the default encapsulation used by all versions of NetWare up to and including Version 3.11.
  • novell-fddi (for FDDI interfaces only)—Use Novell's "FDDI_RAW" encapsulation. This encapsulation consists of a standard FDDI MAC header followed directly by the IPX header with a checksum of 0xFFFF.
  • sap (for Ethernet interfaces)—Use Novell's Ethernet_802.2 encapsulation.This encapsulation consists of a standard 802.3 MAC header followed by an 802.2 LLC header. This is the default encapsulation used by NetWare Version 3.12 and 4.0.
    — Token Ring interfaces—This encapsulation consists of a standard 802.5 MAC header followed by an 802.2 LLC header.
    —FDDI interfaces—This encapsulation consists of a standard FDDI MAC header followed by an 802.2 LLC header.
  • snap (for Ethernet interfaces)—Use Novell Ethernet_Snap encapsulation. This encapsulation consists of a standard 802.3 MAC header followed by an 802.2 SNAP LLC header.
    — Token Ring and FDDI interfaces—This encapsulation consists of a standard 802.5 or FDDI MAC header followed by an 802.2 SNAP LLC header.

secondary

(Optional) Indicates an additional (secondary) network configured after the first (primary) network.

Command Description:

To enable IPX routing on a particular interface and to optionally select the type of encapsulation (framing), use the ipx network interface configuration command. To disable IPX routing, use the no form of this command.

The ipx network command allows you to configure a single logical network on a physical network or more than one logical network on the same physical network (network cable segment). Each network on a given interface must have a different encapsulation type.

The first network you configure on an interface is considered to be the primary network. Any additional networks are considered to be secondary networks. These must include the secondary keyword.

Note In future Cisco IOS software releases, primary and secondary networks will not be supported. When enabling NLSP and configuring multiple encapsulations on the same physical LAN interface, you must use subinterfaces. You cannot use secondary networks.

You can configure an IPX network on any supported interface as long as all the networks on the same physical interface use a distinct encapsulation type. For example, you can configure up to four IPX networks on a single Ethernet cable because Ethernet supports four encapsulation types.

The interface processes only packets with the correct encapsulation and the correct network number. IPX networks using other encapsulations can be present on the physical network. The only effect on the router is that it uses some processing time to examine packets to determine whether they have the correct encapsulation.

All logical networks on an interface share the same set of configuration parameters. For example, if you change the IPX RIP update time on an interface, you change it for all networks on that interface.

When you define multiple logical networks on the same physical network, IPX treats each encapsulation as if it were a separate physical network. This means, for example, that IPX sends RIP updates and SAP updates for each logical network.

The ipx network command is useful when migrating from one type of encapsulation to another. If you are using it for this purpose, you should define the new encapsulation on the primary network.

To delete all networks on an interface, use the following command:

no ipx network

Deleting the primary network with the following command also deletes all networks on that interface. The argument number is the number of the primary network.

no ipx network number

To delete a secondary network on an interface, use one of the following commands. The argument number is the number of a secondary network.

no ipx network number

no ipx network number encapsulation encapsulation-type

Novell's FDDI_RAW encapsulation is common in bridged or switched environments that connect Ethernet-based Novell end hosts via a FDDI backbone. Packets with FDDI_RAW encapsulation are classified as Novell packets, and are not automatically bridged when you enable both bridging and IPX routing. Additionally, you cannot configure FDDI_RAW encapsulation on an interface
configured for IPX autonomous or SSE switching. Similarly, you cannot enable IPX autonomous or SSE switching on an interface configured with FDDI_RAW encapsulation.

With FDDI_RAW encapsulation, platforms that do not use CBUS architecture support fast switching. Platforms using CBUS architecture support only process switching of novell-fddi packets received on an FDDI interface.

Example:

The following example uses subinterfaces to create four logical networks on FastEthernet interface 0/0. Each subinterface has a different encapsulation. Any interface configuration parameters that you specify on an individual subinterface are applied to that subinterface only.

Router(config)#ipx routing interface fastethernet 0/0
Router(config)interface fastethernet 0/0.1
Router(config-subif)#ipx network 1 encapsulation novell-ether
Router(config)#interface fastethernet 0/0.2
Router(config-subif)#ipx network 2 encapsulation snap
Router(config)#interface fastethernet 0/0.3
Router(config-subif)#ipx network 3 encapsulation arpa
Router(config)#interface fastethernet 0/0.4
Router(config-subif)#ipx network 4 encapsulation sap

The following example uses primary and secondary networks to create the same four logical networks as shown previously in this section. Any interface configuration parameters that you specify on this interface are applied to all the logical networks. For example, if you set the routing update timer to 120 seconds, this value is used on all four networks.

Router(config)#ipx routing
Router(config)#interface fastethernet 0/0
Router(config-if)#ipx network 1 encapsulation novell-ether
Router(config-if)#ipx network 2 encapsulation snap secondary
Router(config-if)#ipx network 3 encapsulation arpa secondary
Router(config-if)#ipx network 4 encapsulation sap secondary

The following example enables IPX routing on FDDI interfaces 0.2 and 0.3. On FDDI interface 0.2, the encapsulation type is SNAP. On FDDI interface 0.3, the encapsulation type is Novell's FDDI_RAW.

Router(config)#ipx routing
Router(config)#interface fddi 0.2
Router(config-if)#ipx network f02 encapsulation snap
Router(config)#interface fddi 0.3
Router(config-if)#ipx network f03 encapsulation novell-fddi

Misconceptions:

None

Related Commands:

ipx routing


 Command:

ipx ping-default

Mode:

Router(config)#

Syntax:

ipx ping-default {cisco | novell | diagnostic}

no ipx ping-default {cisco | novell | diagnostic}

Syntax Description:

cisco

Transmits Cisco pings.

novell

Transmits standard Novell pings.

diagnostic

Transmits diagnostic request/response for IPX pings.

Command Description:

To select the ping type that the Cisco IOS software transmits, use the ipx ping-default global configuration command. To return to the default ping type, use the no form of this command.

This command can transmit Cisco pings, standard Novell pings as defined in the NLSP specification, and IPX diagnostic pings. The IPX diagnostic ping feature addresses diagnostic related issues by accepting and processing unicast or broadcast diagnostic packets. It makes enhancements to the current IPX ping command to ping other stations using the diagnostic packets and display the configuration information in the response packet.

Example:

The following is sample output of IPX ping-default when diagnostic is enabled:

Router# ipx ping-default diagnostic

Router(config)#ipx ping-default diagnostic
Router(config)#exit
Router#ping
Protocol [ip]: ipx
Target IPX address: 20.0000.0000.0001
Verbose [n]: y
Timeout in seconds [2]: 1
Type escape sequence to abort.
Sending 1, 31-byte IPX Diagnostic Echoes to 20.0000.0000.0001, timeout is 1 seconds:

Diagnostic Response from 20.0000.0000.0001 in 4 ms
Major Version: 1
Minor Version: 0
SPX Diagnostic Socket: 4002
Number of components: 3
Component ID: 0 (IPX / SPX)
Component ID: 1 (Router Driver)
Component ID: 5 (Router)
Number of Local Networks: 2
 Local Network Type: 0 (LAN Board)
  Network Address1 20
  Node Address1 0000.0000.0001
 Local Network Type: 0 (LAN Board)
  Network Address2 30
  Node Address2 0060.70cc.bc65
Note Verbose mode must be enabled to get diagnostic information.

Misconceptions:

Note When a ping is sent from one station to another, the response is expected to come back immediately; when ipx
ping-default is set to diagnostics, the response could consist of more than one packet and each node is expected to respond within 0.5 seconds of receipt of the request. Due to the absence of an end-of-message flag, there is a delay and the requester must wait for all responses to arrive. Therefore, in verbose mode there may be a brief delay of 0.5 seconds before the response data is displayed.

The ipx ping-default command using the diagnostic keyword can be used to conduct a reachability test and should not be used to measure accurate roundtrip delay.

Related Commands:
trace
ping


Command:

ipx route

Mode:

Router(config)#

Syntax:

ipx route {network [network-mask] | default} {network.node | interface} [ticks] [hops] [floating-static]

no ipx route {network [network-mask] | default} {network.node | interface}

Syntax Description:

network

Network to which you want to establish a static route.

This is an eight-digit hexadecimal number that uniquely identifies a network cable segment. It can be a number in the range 1 to FFFFFFFD. You do not need to specify leading zeros in the network number. For example, for the network number 000000AA, you can enter AA.

network-mask

(Optional) Specifies the portion of the network address that is common to all addresses in an NLSP route summary. When used with the network argument, it specifies the static route summary.

The high-order bits of network-mask must be contiguous Fs, while the low-order bits must be contiguous zeros (0). An arbitrary mix of Fs and 0s is not permitted.

default

Creates a static entry for the "default route." The router forwards all nonlocal packets for which no explicit route is known via the specified next hop address (network.node) or interface.

network.node

The router to forward packets to that are destined for the specified network.

The argument network is an eight-digit hexadecimal number that uniquely identifies a network cable segment. It can be a number in the range 1 to FFFFFFFD. You do not need to specify leading zeros in the network number. For example, for the network number 000000AA, you can enter AA.

The argument node is the node number of the target router. This is a 48-bit value represented by a dotted triplet of four-digit hexadecimal numbers (xxxx.xxxx.xxxx).

interface

Network interface to which packets are forwarded that are destined for the specified network. Interface is serial 0 or serial 0.2. Specifying an interface instead of a network node is intended for use on IPXWAN unnumbered interfaces. The specified interface can be a null interface.

ticks

(Optional) Number of IBM clock ticks of delay to the network for which you are establishing a static route. One clock tick is 1/18 of a second (approximately 55 ms). Valid values are 1 through 65534.

hops

(Optional) Number of hops to the network for which you are establishing a static route. Valid values are 1 through 254.

floating-static

(Optional) Specifies that this route is a floating static route, which is a static route that can be overridden by a dynamically learned route.

Command Description:

To add a static route or static NLSP route summary to the routing table, use the ipx route global configuration command. To remove a route from the routing table, use the no form of this command.

The ipx route command forwards packets destined for the specified network (network) via the specified router (network.node) or an interface (interface) on that network regardless of whether that router is sending dynamic routing information.

Floating static routes are static routes that can be overridden by dynamically learned routes. Floating static routes allow you to switch to another path whenever routing information for a destination is lost. One application of floating static routes is to provide back-up routes in topologies where dial-on-demand routing is used.

If you configure a floating static route, the Cisco IOS software checks to see if an entry for the route already exists in its routing table. If a dynamic route already exists, the floating static route is placed in reserve as part of a floating static route table. When the software detects that the dynamic route is no longer available, it replaces the dynamic route with the floating static route. If the route is later relearned dynamically, the dynamic route replaces the floating static route and the floating static route is again placed in reserve.

If you specify an interface instead of a network node address, the interface must be an IPXWAN unnumbered interface. For IPXWAN interfaces, the network number need not be preassigned; instead, the nodes may negotiate the network number dynamically.

Note that by default, floating static routes are not redistributed into other dynamic protocols.

Example:

In the following example, a router at address 3abc.0000.0c00.1ac9 handles all traffic destined for network 5e:

Router(config)#ipx routing
Router(config)#ipx route 5e 3abc.0000.0c00.1ac9

The following example defines a static NLSP route summary:

Router(config)#ipx routing
Router(config)#ipx route aaaa0000 ffff0000

Misconceptions:

None

Related Commands:

ipx default-route

show ipx route


 Command:

ipx split-horizon eigrp

Mode:

Router(config-if)#

Syntax:

ipx split-horizon eigrp autonomous-system-number

no ipx split-horizon eigrp autonomous-system-number

Syntax Description:

autonomous-system-number

EIGRP autonomous system number. It can be a number from 1 to 65535.

Command Description:

To configure split horizon, use the ipx split-horizon eigrp interface configuration command. To disable split horizon, use the no form of this command.

When split horizon is enabled, EIGRP update and query packets are not sent for destinations that have next hops on this interface. This reduces the number of EIGRP packets on the network.

Split horizon blocks information about routes from being advertised by the Cisco IOS software to any interface from which that information originated. Typically, this behavior optimizes communication among multiple routers, particularly when links are broken. However, with nonbroadcast networks, such as Frame Relay and SMDS, situations can arise for which this behavior is less than ideal. For these situations, you may wish to disable split horizon.
Example:

The following example disables split horizon on serial interface 0/0:

Router#interface serial 0/0
Router(config)#no ipx split-horizon eigrp 200

Misconceptions:
None

Related Commands:
None


 Command:

ipx type-20-propagation

Mode:

Router(config-if)#

Syntax:

ipx type-20-propagation

no ipx type-20-propagation

Syntax Description:

This command has no arguments or keywords.

Command Description:

To forward IPX type 20 propagation packet broadcasts to other network segments, use the ipx type-20-propagation interface configuration command. To disable both the reception and forwarding of type 20 broadcasts on an interface, use the no form of this command.

Routers normally block all broadcast requests. To allow input and output of type 20 propagation packets on an interface, use the ipx type-20-propagation command. Note that type 20 packets are subject to loop detection and control as specified in the IPX router specification.
Example:

The following example enables both the reception and forwarding of type 20 broadcasts on FastEthernet interface 0/0:

Router(config)#interface fastethernet 0/0
Router(config-if)#ipx type-20-propagation

The following example enables the reception and forwarding of type 20 broadcasts between networks 123 and 456, but does not enable reception and forwarding of these broadcasts to and from network 789:

Router(config)#interface fastethernet 0/0
Router(config-if)#ipx network 123
Router(config-if)#ipx type-20-propagation

Router(config)#interface fastethernet 0/1
Router(config-if)#ipx network 456
Router(config-if)#ipx type-20-propagation

Router(config)#interface fastethernet 0/2
Router(config-if)#ipx network 789
Misconceptions:
None

Related Commands:
None


Command:

lsp-refresh-interval (IPX)

Mode:

Router(config-router)#

Syntax:

lsp-refresh-interval seconds
no lsp-refresh-interval seconds

Syntax Description:

seconds Refresh interval, in seconds. It can be a value in the range 1 to 50,000 seconds. The default is 7200 seconds (2 hours).

Command Description:

To set the link-state packet (LSP) refresh interval, use the lsp-refresh-interval command in router configuration mode. To restore the default refresh interval, use the no form of this command.

The default is 7200 seconds (2 hours).

The refresh interval determines the rate at which Cisco IOS software periodically transmits the route topology information that it originates. This is done in order to keep the information from becoming too old. By default, the refresh interval is 2 hours.

LSPs must be periodically refreshed before their lifetimes expire. The refresh interval must be less than the LSP lifetime specified with the max-lsp-lifetime (IPX) router configuration command. Reducing the refresh interval reduces the amount of time that undetected link state database corruption can persist at the cost of increased link utilization. (This is an extremely unlikely event, however, because there are other safeguards against corruption.) Increasing the interval reduces the link utilization caused by the flooding of refreshed packets (although this utilization is very small).

Example:

The following example changes the LSP refresh interval to 10,800 seconds (3 hours):

Router(config-router)# lsp-refresh-interval 10800

Misconceptions:

None

Related Commands:

ipx router
max-lsp-lifetime (IPX)


Command:

max-lsp-lifetime IPX

Mode:

Router(config-router)#

Syntax:

max-lsp-lifetime [hours] value
no max-lsp-lifetime

Syntax Description:

hours | (Optional) If specified, the lifetime of the LSP is set in hours. If not specified, the lifetime is set in seconds.
value | Lifetime of LSP, in hours or seconds. It can be a number in the range 1 to 32,767. The default is 7500 seconds.

Command Description:

To set the maximum time that link-state packets (LSPs) can remain in a router's database without being refreshed, use the max-lsp-lifetime command in router configuration mode. To restore the default lifetime, use the no form of this command.

The default is 7500 seconds (2 hour 5 minutes)

The hours keyword enables the router to interpret the maximum lifetime field in hours, allowing the router to keep LSPs for a much longer time. Keeping LSPs longer reduces overhead on slower-speed serial links and keeps ISDN links from becoming active unnecessarily.

You might need to adjust the maximum LSP lifetime if you change the LSP refresh interval with the lsp-refresh-interval (IPX) router configuration command. The maximum LSP lifetime must be greater than the LSP refresh interval.

Example:

The following example sets the maximum time that the LSP persists to 11,000 seconds (more than 3 hours):

Router(config-router)# max-lsp-lifetime 11000

The following example sets the maximum time that the LSP persists to 15 hours:

Router(config-router)# max-lsp-lifetime hours 15

Misconceptions:

None

Related Commands:

ipx router
lsp-refresh-interval (IPX)


 Command:

show ipx access-list

Mode:

Router#

Syntax:

show ipx access-list [access-list-number | name]

Syntax Description:

access-list-number

(Optional) Number of the IPX access list to display. This is a number from 800 to 899, 900 to 999, 1000 to 1099, or 1200 to 1299.

name

(Optional) Name of the IPX access list to display.

Command Description:

To display the contents of all current IPX access lists, use the show ipx access-list EXEC command.

The show ipx access-list command provides output identical to the show access-lists command, except that it is IPX specific and allows you to specify a particular access list.

Examples:

The following is a sample of output from the show ipx access-list command when all access lists are requested:

Router#show ipx access-list

IPX extended access list 900
 deny any 1
IPX sap access list London
 deny FFFFFFFF 107
 deny FFFFFFFF 301C
 permit FFFFFFFF 0

The following is a sample of output from the show ipx access-list command when the name of a specific access list is requested:

Router#show ipx access-list London

IPX sap access list London
 deny FFFFFFFF 107
 deny FFFFFFFF 301C
 permit FFFFFFFF 0

Misconceptions:
None

Related commands:
ipx access-list
access-list (IPX extended)
access-list (IPX standard)
ipx access-group


 Command:

show ipx cache

Mode:

Router#

Syntax:

show ipx cache

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the contents of the IPX fast-switching cache, use the show ipx cache EXEC command.

Example:
Router#show ipx cache

Novell routing cache version is 9
Destination          Interface               MAC Header
*1006A               Ethernet 0              00000C0062E600000C003EB0064
*14BB                Ethernet 1              00000C003E2A00000C003EB0064

Misconceptions:
None

Related commands:
clear ipx cache


Command:

show ipx eigrp interfaces

Mode:

Router#

Syntax:

show ipx eigrp interfaces [type number] [as-number]

Syntax Description:

type

(Optional) Interface type.

number

(Optional) Interface number.

as-number

(Optional) Autonomous system number.

Command Description:

To display information about interfaces configured for EIGRP, use the show ipx eigrp interfaces EXEC command.

Use the show ipx eigrp interfaces command to determine on which interfaces EIGRP is active and to find out information about EIGRP relating to those interfaces.

If an interface is specified, only that interface is displayed. Otherwise, all interfaces on which EIGRP is running are displayed.

If an autonomous system is specified, only the routing process for the specified autonomous system is displayed. Otherwise, all EIGRP processes are displayed.

Example:

The following is a sample of output from the show ipx eigrp interfaces command:

Router>show ipx eigrp interfaces

IPX EIGRP interfaces for process 109

                    Xmit Queue    Mean   Pacing Time   Multicast   Pending
Interface   Peers   Un/Reliable   SRTT   Un/Reliable   Flow Timer  Routes
Di0           0         0/0          0      11/434          0          0
Et0           1         0/0        337       0/10           0          0
SE0:1.16      1         0/0         10       1/63         103          0
Tu0           1         0/0        330       0/16           0          0

The table below describes the fields shown in the display.

Table: show ipx eigrp interfaces Field Descriptions

Field Description

process 109

Autonomous system number of the process.

Interface

Interface name.

Peers

Number of neighbors on the interface.

Xmit Queue

Count of unreliable and reliable packets queued for transmission.

Mean SRTT

Average round-trip time for all neighbors on the interface.

Pacing Time

Number of milliseconds to wait after transmitting unreliable and reliable packets.

Multicast Flow Timer

Number of milliseconds to wait for acknowledgment of a multicast packet by all neighbors before transmitting the next multicast packet.

Pending Routes

Number of routes still to be transmitted on this interface.

Misconceptions:

None

Related commands:

show ipx eigrp neighbors


Command:

show ipx eigrp neighbors

Mode:

Router#

Syntax:

show ipx eigrp neighbors [servers] [autonomous-system-number | interface] [regexp name]

Syntax Description:

servers

(Optional) Displays the server list advertised by each neighbor. This is displayed only if the ipx sap incremental command is enabled on the interface on which the neighbor resides.

autonomous-system-number

(Optional) Autonomous system number, an integer in the range 1 to 65535

interface

(Optional) Interface type and number

regexp name

(Optional) Displays the IPX servers whose names match the regular expression

Command Description:

To display the neighbors discovered by EIGRP, use the show ipx eigrp neighbors EXEC command.

Example:

The following is a sample of output from the show ipx eigrp neighbors command:

Router# show ipx eigrp neighbors

IPX EIGRP Neighbors for process 1

H   Address                 Interface   Hold    Uptime   SRTT   RTO  Q  Seq

                                        (sec)            (ms)       Cnt Num

0   200.0000.0c34.d83b        Et0/2      11     00:00:18   2    200  0  10

2 total IPX servers for this peer

Type      Name                    Address             Port  Hops

4         server                  2037.0000.0000.0001:0001  2

4         server2                 2037.0000.0000.0001:0001  2

1   200.0000.0c34.d83c        Et0/2      11     00:00:18   2    200  0  10

1 total IPX servers for this peer

Type      Name                    Address             Port  Hops

4         server                  2037.0000.0000.0001:0001  2

The following table describes the fields shown in the display:

Table: show ipx eigrp neighbors Field Descriptions

Field Description

process 200

Autonomous system number specified in the ipx router configuration command

H

Handle, an arbitrary and unique number inside this router that identifies the neighbor

Address

IPX address of the EIGRP peer

Interface

Interface on which the router is receiving hello packets from the peer

Hold

Length of time, in seconds, that the Cisco IOS software will wait to hear from the peer before declaring it down (If the peer is using the default hold time, this number will be less than 15. If the peer configures a nondefault hold time, it will be reflected here).

Uptime

Elapsed time (in hours, minutes, and seconds) since the local router first heard from this neighbor

Q Cnt

Number of IPX EIGRP packets (Update, Query, and Reply) that the Cisco IOS software is waiting to send

SRTT

Smooth round-trip time, this is the number of milliseconds it takes for an IPX EIGRP packet to be sent to this neighbor and for the local router to receive an acknowledgment of that packet

RTO

Retransmission timeout (in milliseconds), this is the amount of time the Cisco IOS software waits before retransmitting a packet from the retransmission queue to a neighbor

Seq Num

Sequence number of the last Update, Query, or Reply packet that was received from this neighbor

Type

Contains codes from the Codes field to indicates how service was learned

Name

Name of server

Address

Network address of server

Port

Source socket number

Misconceptions:

None

Related commands:

show ipx eigrp interfaces


 Command:

show ipx eigrp topology

Mode:

Router#

Syntax:

show ipx eigrp topology [network-number] [active] [all-links] [as as_number] [pending] [summary] [zero-successors]

Syntax Description:
network-number | (Optional) IPX network number whose topology table entry to display
active | Show only active entries
all-links | Show all links in topology table
as | Show only entries for this autonomous system
pending | Show only entries pending transmission
summary | Show a summary of the topology table
zero-successors | Show only zero successor entries

Command Description:

To display the EIGRP topology table, use the show ipx eigrp topology EXEC command.

Examples:

The following is a sample of output from the show ipx eigrp topology command:

Router#show ipx eigrp topology

IPX EIGRP Topology Table for process 109
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
r - Reply status
P 42, 1 successors, FD is 0
   via 160.0000.0c00.8ea9 (345088/319488), FastEthernet0/0
P 160, 1 successor via Connected, FastEthernet
   via 160.0000.0c00.8ea9 (307200/281600), FastEthernet0/0
P 165, 1 successors, FD is 307200
   via Redistributed (287744/0)
   via 160.0000.0c00.8ea9 (313344/287744), FastEthernet0/0
P 164, 1 successors, flags: U, FD is 200
   via 160.0000.0c00.8ea9 (307200/281600), FastEthernet0/1
   via 160.0000.0c01.2b71 (332800/307200), FastEthernet0/1
P A112, 1 successors, FD is 0
   via Connected, FastEthernet1/2
   via 160.0000.0c00.8ea9 (332800/307200), FastEthernet0/0
P AAABBB, 1 successors, FD is 10003
   via Redistributed (287744/0),
   via 160.0000.0c00.8ea9 (313344/287744), FastEthernet0/0
A A112, 0 successors, 1 replies, state: 0, FD is 0
   via 160.0000.0c01.2b71 (307200/281600), FastEthernet0/1
   via 160.0000.0c00.8ea9 (332800/307200), r, FastEthernet0/1

The table below describes the fields shown in the output.

Table: show ipx eigrp topology Field Descriptions
Field Description

Codes

State of this topology table entry. Passive and Active refer to the EIGRP state with respect to this destination; Update, Query, and Reply refer to the type of packet that is being sent.

P - Passive

No EIGRP computations are being performed for this destination

A - Active

EIGRP computations are being performed for this destination

U - Update

Indicates that an update packet was sent to this destination

Q - Query

Indicates that a query packet was sent to this destination

R - Reply

Indicates that a reply packet was sent to this destination

r - Reply status

Flag that is set after the Cisco IOS software has sent a query and is waiting for a reply

42, 160, and so on

Destination IPX network number

successors

Number of successors. This number corresponds to the number of next hops in the IPX routing table.

FD

Feasible distance. This value is used in the feasibility condition check. If the neighbor's reported distance (the metric after the slash) is less than the feasible distance, the feasibility condition is met and that path is a feasible successor. Once the router determines it has a feasible successor, it does not have to send a query for that destination.

replies

Number of replies that are still outstanding (have not been received) with respect to this destination. This information appears only when the destination is in Active state.

state

Exact EIGRP state that this destination is in. It can be the number 0, 1, 2, or 3. This information appears only when the destination is Active.

via

IPX address of the peer who told the Cisco IOS software about this destination. The first n of these entries, where n is the number of successors, are the current successors. The remaining entries on the list are feasible successors.

(345088/319488)

The first number is the EIGRP metric that represents the cost to the destination. The second number is the EIGRP metric that this peer advertised.

FastEthernet0/0

Interface from which this information was learned

The following is a sample of output from the show ipx eigrp topology command when you specify an IPX network number:

Router#show ipx eigrp topology 160

IPX-EIGRP topology entry for 160
State is Passive, Query origin flag is 1, 1 Successor(s)
Routing Descriptor Blocks:
 Next hop is Connected (FastEthernet0/0), from 0.0000.0000.0000
 Composite metric is (0/0), Send flag is 0x0, Route is Internal
 Vector metric:
  Minimum bandwidth is 10000 Kbit
  Total delay is 1000000 nanoseconds
  Reliability is 255/255
  Load is 1/255
  Minimum MTU is 1500
  Hop count is 0
Next hop is 164.0000.0c00.8ea9 (FastEthernet0/1), from 164.0000.0c00.8ea9
 Composite metric is (307200/281600), Send flag is 0x0, Route is External
 This is an ignored route
 Vector metric:
  Minimum bandwidth is 10000 Kbit
  Total delay is 2000000 nanoseconds
  Reliability is 255/255
  Load is 1/255
  Minimum MTU is 1500
  Hop count is 1
 External data:
  Originating router is 0000.0c00.8ea9
  External protocol is RIP, metric is 1, delay 2
  Administrator tag is 0 (0x00000000)
  Flag is 0x00000000

The table below describes the fields shown in the display.

Table: show ipx eigrp topology Field Descriptions—Specific Network
Field Description

160

IPX network number of the destination

State is ...

State of this entry. It can be either Passive or Active. Passive means that no EIGRP computations are being performed for this destination, and Active means that they are being performed.

Query origin flag

Exact EIGRP state that this destination is in. It can be the number 0, 1, 2, or 3. This information appears only when the destination is Active.

Successor(s)

Number of successors. This number corresponds to the number of next hops in the IPX routing table.

Next hop is ...

Indicates how this destination was learned. It can be one of the following:

  • Connected—The destination is on a network directly connected to this router.
  • Redistributed—The destination was learned via RIP or another EIGRP process.
  • IPX host address—The destination was learned from that peer via this EIGRP process.

FastEthernet0/0

Interface from which this information was learned

from

Peer from whom the information was learned. For connected and redistributed routers, this is 0.0000.0000.0000. For information learned via EIGRP, this is the peer's address. Currently, for information learned via EIGRP, the peer's IPX address always matches the address in the "Next hop is" field.

Composite metric is

EIGRP composite metric. The first number is this device's metric to the destination, and the second is the peer's metric to the destination.

Send flag

Numeric representation of the "flags" field described in Table. It is 0 when nothing is being sent, 1 when an Update is being sent, 3 when a Query is being sent, and 4 when a Reply is being sent. Currently, 2 is not used.

Route is ...

Type of router. It can be either internal or external. Internal routes are those that originated in an EIGRP autonomous system, and external are routes that did not. Routes learned via RIP are always external.

This is an ignored route

Indicates that this path is being ignored because of filtering

Vector metric:

This section describes the components of the EIGRP metric

Minimum bandwidth

Minimum bandwidth of the network used to reach the next hop

Total delay

Delay time to reach the next hop

Reliability

Reliability value used to reach the next hop

Load

Load value used to reach the next hop

Minimum MTU

Minimum MTU size of the network used to reach the next hop

Hop count

Number of hops to the next hop

External data:

This section describes the original protocol from which this route was redistributed. It appears only for external routes.

Originating router

Network address of the router that first distributed this route into EIGRP

External protocol..metric..delay

External protocol from which this route was learned. The metric will match the external hop count displayed by the show ipx route command for this destination. The delay is the external delay.

Administrator tag

Not currently used

Flag

Not currently used

Misconceptions:
None

Related commands:
show ipx route


 Command:

show ipx interface

Mode:

Router#

Syntax:

show ipx interface [type number] [brief]

Syntax Description:

type

(Optional) Interface type. It can be one of the following types: asynchronous, dialer, Ethernet (IEEE 802.3), FDDI, loopback, null, serial, Token Ring, or tunnel.

number

(Optional) Interface number
brief Brief summary of IPX interface status and configuration

Command Description:

To display the status of the IPX interfaces configured in the Cisco IOS software and the parameters configured on each interface, use the show ipx interface EXEC command.

Examples:

The following is a sample of output from the show ipx interface command:

Router#show ipx interface fastethernet 0/1

FastEthernet0/1 is up, line protocol is up
  IPX address is C03.0000.0c05.6030, NOVELL-ETHER [up] line-up, RIPPQ: 0, SAPPQ : 0
  Delay of this Novell network, in ticks is 1
  IPXWAN processing not enabled on this interface.
  IPX SAP update interval is 1 minute(s)
  IPX type 20 propagation packet forwarding is disabled
  Outgoing access list is not set
  IPX Helper access list is not set
  SAP Input filter list is not set
  SAP Output filter list is not set
  SAP Router filter list is not set
  SAP GNS output filter list is not set
  Input filter list is not set
  Output filter list is not set
  Router filter list is not set
  Netbios Input host access list is not set
  Netbios Input bytes access list is not set
  Netbios Output host access list is not set
  Netbios Output bytes access list is not set
  Update time is 60 seconds
  IPX accounting is enabled
  IPX fast switching is configured (enabled)
  IPX SSE switching is disabled

The following is a sample of output from the show ipx interface command when NLSP is enabled:

Router#show ipx interface fastethernet 1

  FastEthernet0 is up, line protocol is up
  IPX address is E001.0000.0c02.8cf9, SAP [up] line-up, RIPPQ: 0, SAPPQ : 0
  Delay of this IPX network, in ticks is 1 throughput 0 link delay 0
  IPXWAN processing not enabled on this interface.
  IPX SAP update interval is 1 minute(s)
  IPX type 20 propagation packet forwarding is disabled
  Outgoing access list is not set
  IPX Helper access list is not set
  SAP Input filter list is not set
  SAP Output filter list is not set
  SAP Router filter list is not set
  SAP GNS output filter list is not set
  Input filter list is not set
  Output filter list is not set
  Router filter list is not set
  Netbios Input host access list is not set
  Netbios Input bytes access list is not set
  Netbios Output host access list is not set
  Netbios Output bytes access list is not set
  Update time is 60 seconds
  IPX accounting is enabled
  IPX fast switching is configured (enabled)
  IPX SSE switching is disabled
  IPX NLSP is running on primary network E001
  RIP compatibility mode is AUTO (OFF)
  SAP compatibility mode is AUTO (OFF)
  Level 1 Hello interval 20 sec
  Level 1 Designated Router Hello interval 10 sec
  Level 1 CSNP interval 30 sec
  Level 1 LSP retransmit interval 5 sec, LSP (pacing) interval 1000 mSec
  Level 1 adjacency count is 1
  Level 1 circuit ID is 0000.0C02.8CF9.02

The table below describes the fields shown in the display.

Table: show ipx interface Field Descriptions
Field Description

Ethernet1 is ..., line protocol is ...

Type of interface and whether it is currently active and inserted into the network (up) or inactive and not inserted (down)

IPX address is ...

Network and node address of the local router interface, followed by the type of encapsulation configured on the interface and the interface's status. Refer to the ipx network command for a list of possible values.

NOVELL-ETHER

Type of encapsulation being used on the interface, if any

[up] line-up

Indicates whether IPX routing is enabled or disabled on the interface. The "line-up" indicates that IPX routing has been enabled with the ipx routing command. The "line-down" indicates that it is not enabled. The word in square brackets provides more detail about the status of IPX routing when it is in the process of being enabled or disabled.

RIPPQ

Number of packets in the RIP queue

SAPPQ

Number of packets in the SAP queue

Secondary address is ...

Address of a secondary network configured on this interface, if any, followed by the type of encapsulation configured on the interface and the interface's status. Refer to the ipx routing command for a list of possible values. This line is displayed only if you have configured a secondary address with the ipx routing command.

Delay of this IPX network, in ticks, ...

Value of the ticks field (configured with the ipx delay command)

throughput

Throughput of the interface (configured with the ipx spx-idle-time interface configuration command)

link delay

Link delay of the interface (configured with the ipx link-delay interface configuration command)

IPXWAN processing...

Indicates whether IPXWAN processing has been enabled on this interface with the ipx ipxwan command

IPX SAP update interval

Indicates the frequency of outgoing SAP updates (configured with the ipx update interval command)

IPX type 20 propagation packet forwarding...

Indicates whether forwarding of IPX type 20 propagation packets (used by NetBIOS) is enabled or disabled on this interface, as configured with the ipx type-20-propagation command.

Outgoing access list

Indicates whether an access list has been enabled with the
ipx access-group command

IPX Helper access list

Number of the broadcast helper list applied to the interface with the ipx helper-list command

SAP Input filter list

Number of the input SAP filter applied to the interface with the ipx input-sap-filter command

SAP Output filter list

Number of the output SAP filter applied to the interface with the ipx output-sap-filter command.

SAP Router filter list

Number of the router SAP filter applied to the interface with the ipx router-sap-filter command

SAP GNS output filter list

Number of the Get Nearest Server (GNS) response filter applied to the interface with the ipx output-gns-filter command

Input filter list

Number of the input filter applied to the interface with the
ipx input-network-filter command

Output filter list

Number of the output filter applied to the interface with the
ipx output-network-filter command

Router filter list

Number of the router entry filter applied to the interface with the ipx router-filter command

Netbios Input host access list

Name of the IPX NetBIOS input host filter applied to the interface with the ipx netbios input-access-filter host command

Netbios Input bytes access list

Name of the IPX NetBIOS input bytes filter applied to the interface with the ipx netbios input-access-filter bytes command

Netbios Output host access list

Name of the IPX NetBIOS output host filter applied to the interface with the ipx netbios input-access-filter host command

Netbios Output bytes access list

Name of the IPX NetBIOS output bytes filter applied to the interface with the ipx netbios input-access-filter bytes command

Update time

How often the Cisco IOS software sends RIP updates, as configured with the ipx update sap-after-rip command

Watchdog spoofing ...

Indicates whether watchdog spoofing is enabled of disabled for this interface, as configured with the ipx watchdog-spoof command. This information is displayed only on serial interfaces.

IPX accounting

Indicates whether IPX accounting has been enabled with the ipx accounting command

IPX fast switching
IPX autonomous switching

Indicates whether IPX fast switching is enabled (default) or disabled for this interface, as configured with ipx route-cache command. (If IPX autonomous switching is enabled, it is configured with the ipx route-cache cbus command.)

IPX SSE switching

Indicates whether IPX SSE switching is enabled for this interface, as configured with the ipx route-cache sse command

IPX NLSP is running on primary network E001

Indicates that NLSP is running and the number of the primary IPX network on which it is running

RIP compatibility mode

State of RIP compatibility (configured by the ipx nlsp rip interface configuration command)

SAP compatibility mode

State of SAP compatibility (configured by the ipx nlsp sap interface configuration command)

Level 1 Hello interval

Interval between transmission of hello packets for nondesignated routers (configured by the ipx nlsp hello-interval interface configuration command)

Level 1 Designated Router Hello interval

Interval between transmission of hello packets for designated routers (configured by the ipx nlsp hello-interval interface configuration command)

Level 1 CSNP interval

CSNP interval (as configured by the ipx nlsp csnp-interval interface configuration command)

Level 1 LSP retransmit interval

LSP retransmission interval (as configured by the ipx nlsp retransmit-interval interface configuration command)

LSP (pacing) interval

LSP transmission interval (as configured by the ipx nlsp lsp-interval interface configuration command)

Level 1 adjacency count

Number of Level 1 adjacencies in the adjacency database

Level 1 circuit ID

System ID and pseudonode number of the designated router. In this example, 0000.0C02.8CF9 is the system ID, and 02 is the pseudonode number.

Misconceptions:
None

Related commands:
access-list (IPX standard)
access-list (IPX extended)
ipx access-list
ipx network
ipx routing


 Command:

show ipx route

Mode:

Router#

Syntax:

show ipx route [network] [default] [detailed]

Syntax Description:

network

(Optional) Number of the network whose routing table entry you want to display. This is an eight-digit hexadecimal number that uniquely identifies a network cable segment. It can be a number in the range 1 to FFFFFFFD. You do not need to specify leading zeros in the network number. For example, for the network number 000000AA, you can enter AA.

default

(Optional) Displays the default route. This is equivalent to specifying a value of FFFFFFFE for the argument network.

detailed

(Optional) Displays detailed route information.

Command Description:

To display the contents of the IPX routing table, use the show ipx route user EXEC command.

Examples:

The following is a sample of output from the show ipx route command:

Router#show ipx route

Codes: C - Connected primary network,    c - Connected secondary network
       S - Static, F - Floating static, L - Local (internal), W - IPXWAN
       R - RIP, E - EIGRP, N - NLSP, X - External, A - Aggregate
       s - seconds, u - uses

8 Total IPX routes. Up to 1 parallel paths and 16 hops allowed.

No default route known.

L        D40 is the internal network
C        100 (NOVELL-ETHER), Et1
C       7000 (TUNNEL),        Tu1
S        200 via     7000.0000.0c05.6023,        Tu1
R        300 [02/01] via      100.0260.8c8d.e748,   19s, Et1
S       2008 via     7000.0000.0c05.6023,        Tu1
R     CC0001 [02/01] via      100.0260.8c8d.e748,   19s, Et1

The table below describes the fields shown in the display.

Table: show ipx route Field Descriptions
Field Description

Codes

Codes defining how the route was learned.

L - Local

Internal network number.

C - Connected primary network

Directly connected primary network.

c - connected secondary network

Directly connected secondary network.

S - Static

Statically defined route via the ipx route command.

R - RIP

Route learned from a RIP update.

E - EIGRP

Route learned from an Enhanced IGRP (EIGRP) update.

W - IPXWAN

Directly connected route determined via IPXWAN.

8 Total IPX routes

Number of routes in the IPX routing table.

No parallel paths allowed

Maximum number of parallel paths for which the Cisco IOS software has been configured with the ipx maximum-paths command.

Novell routing algorithm variant in use

Indicates whether the Cisco IOS software is using the IPX-compliant routing algorithms (default).

Net 1

Network to which the route goes.

[3/2]

Delay/Metric. Delay is the number of IBM clock ticks (each tick is 1/18 seconds) reported to the destination network. Metric is the number of hops reported to the same network. Delay is used as the primary routing metric, and the metric (hop count) is used as a tie breaker.

via network.node

Address of a router that is the next hop to the remote network.

age

Amount of time (in hours, minutes, and seconds) that has elapsed since information about this network was last received.

uses

Number of times this network has been looked up in the route table. This field is incremented when a packet is process-switched, even if the packet is eventually filtered and not sent. As such, this field represents a fair estimate of the number of times a route gets used.

Ethernet0

Interface through which packets to the remote network will be sent.

(NOVELL-ETHER)

Encapsulation (frame) type. This is shown only for directly connected networks.

is directly connected

Indicates that the network is directly connected to the router.

When the Cisco IOS software generates an aggregated route, the show ipx route command displays a line item similar to the following:

NA      1000 FFFFF000 [**][**/06] via        0.0000.0000.0000,  163s, Nu0

In the following example, the router that sends the aggregated route also generates the aggregated route line item in its table. But the entry in the table points to the null interface (Nu0), indicating that if this aggregated route is the most-specific route when a packet is being forwarded, the router drops the packet instead.

Router#show ipx route

Codes: C - Connected primary network,    c - Connected secondary network
       S - Static, F - Floating static, L - Local (internal), W - IPXWAN
       R - RIP, E - EIGRP, N - NLSP, X - External, A - Aggregate
       s - seconds, u - uses

13 Total IPX routes. Up to 4 parallel paths and 16 hops allowed.

No default route known.

NA      1000 FFFFF000 [**][**/06] via        0.0000.0000.0000,  163s, Nu0
L       2008 is the internal network
C          1 (NOVELL-ETHER),  Et0
C         89 (SAP),           To0
C         91 (SAP),           To1
C        100 (NOVELL-ETHER),  Et1
N          2 [19][01/01]          via       91.0000.30a0.51cd,  317s, To1
N          3 [19][01/01]          via       91.0000.30a0.51cd,  327s, To1
N         20 [20][01/01]          via        1.0000.0c05.8b24, 2024s, Et0
N        101 [19][01/01]          via       91.0000.30a0.51cd,  327s, To1
NX      1000 [20][02/02][01/01]   via        1.0000.0c05.8b24, 2024s, Et0
N       2010 [20][02/01]          via        1.0000.0c05.8b24, 2025s, Et0
N       2011 [19][02/01]          via       91.0000.30a0.51cd,  328s, To1

The following is a sample of output from the show ipx route detailed command:

Router#show ipx route detailed

Codes: C - Connected primary network,    c - Connected secondary network
       S - Static, F - Floating static, L - Local (internal), W - IPXWAN
       R - RIP, E - EIGRP, N - NLSP, X - External, s - seconds, u - uses

9 Total IPX routes. Up to 1 parallel paths and 16 hops allowed.

No default route known.

L        D35 is the internal network
C       E001 (SAP),           Et0
C      D35E2 (NOVELL-ETHER),  Et2
R        D34 [02/01]
          -- via     E001.0000.0c02.8cf9,  43s,     1u, Et0
N        D36 [20][02/01]
          -- via    D35E2.0000.0c02.8cfc, 704s,     1u, Et2
                  10000000:1000:1500:0000.0c02.8cfb:6:0000.0c02.8cfc
NX       D40 [20][03/02][02/01]
          -- via    D35E2.0000.0c02.8cfc, 704s,     1u, Et2
                  10000000:2000:1500:0000.0c02.8cfb:6:0000.0c02.8cfc
R      D34E1 [01/01]
          -- via     E001.0000.0c02.8cf9,  43s,     1u, Et0
NX     D40E1 [20][02/02][01/01]
          -- via    D35E2.0000.0c02.8cfc, 704s,     3u, Et2
                  10000000:2000:1500:0000.0c02.8cfb:6:0000.0c02.8cfc
N     D36E02 [20][01/01]
          -- via    D35E2.0000.0c02.8cfc, 705s,     2u, Et2
                  10000000:2000:1500:0000.0c02.8cfb:6:0000.0c02.8cfc

The table below explains the additional fields shown in the display.

Table: show ipx route detailed Field Descriptions
Field Description

1u

Number of times this network has been looked up in the route table. This field is incremented when a packet is process-switched, even if the packet is eventually filtered and not sent. As such, this field represents a fair estimate of the number of times a route gets used.

10000000

(NLSP only) Throughput (end to end).

3000

(NLSP only) Link delay (end to end).

1500

(NLSP only) MTU (end to end).

0000.0c02.8cfb

(NLSP only) System ID of the next-hop router.

6

(NLSP only) Local circuit ID.

0000.0c02.8cfc

(NLSP only) MAC address of the next-hop router.

Misconceptions:
None

Related commands:
clear ipx route
ipx route


Command:

show ipx servers

Mode:

Router#

Syntax:

show ipx servers [detailed] [network network_number] [unsorted | [sorted [name | net | type]]] [regexp name]

Syntax Description:

unsorted

(Optional) Does not sort entries when displaying IPX servers.

sorted

(Optional) Sorts the display of IPX servers according to the keyword that follows.

name

(Optional) Displays the IPX servers alphabetically by server name.

net

(Optional) Displays the IPX servers numerically by network number.

type

(Optional) Displays the IPX servers numerically by SAP service type. This is the default.

regexp name

(Optional) Displays the IPX servers whose names match the regular expression.

detailed

Comprehensive display including path detail

network

Display Services on a particular network

Command Description:

To list the IPX servers discovered through Service Advertising Protocol (SAP) advertisements, use the show ipx servers EXEC command.

Examples:

The following is a sample of output from the show ipx servers command when NLSP is enabled:

Router#show ipx servers

Codes: S - Static, P - Periodic, E - EIGRP, N - NLSP, H - Holddown, + = detail

9 Total IPX Servers

Table ordering is based on routing and server info

Type Name                      Net  Address          Port Route Hops Itf

N+   4 MERLIN1-VIA-E03         E03E03.0002.0004.0006:0451 4/03  4    Et0

N+   4 merlin                  E03E03.0002.0004.0006:0451 4/03  3    Et0

N+   4 merlin 123456789012345  E03E03.0002.0004.0006:0451 4/03  3    Et0

S    4 WIZARD1--VIA-E0         E0.0002.0004.0006:0451     none  2

N+   4 dtp-15-AB               E002.0002.0004.0006:0451   none  4    Et0

N+   4 dtp-15-ABC              E002.0002.0004.0006:0451   none  4    Et0

N+   4 dtp-15-ABCD             E002.0002.0004.0006:0451   none  4    Et0

N+   4 merlin                  E03E03.0002.0004.0006:0451 4/03  3    Et0

N+   4 dtp-15-ABC              E002.0002.0004.0006:0451   none  4    Et0

The table describes the fields shown in the display.

Table: show ipx servers Field Descriptions

Field Description

Codes:

Codes defining how the service was learned.

S - Static

Statically defined service via the ipx sap command.

P - Periodic

Service learned via a SAP update.

E - EIGRP

Service learned via EIGRP.

N - NLSP

Service learned via NLSP.

H- Holddown

Indicates that the entry is in holddown mode and is not reachable.

+ - detail

Indicates that multiple paths to the server exist. Use the show ipx servers detailed EXEC command to display more detailed information about the paths.

Type

Contains codes from Codes field to indicates how service was learned.

Name

Name of server.

Net

Network on which server is located.

Address

Network address of server.

Port

Source socket number.

Route

Ticks/hops (from the routing table).

Hops

Hops (from the SAP protocol).

Itf

Interface through which to reach server.

The following example uses a regular expression to display SAP table entries corresponding to a particular group of servers in the accounting department of a company:

Router#show ipx servers regexp ACCT\_SERV.+

Codes: S - Static, P - Periodic, E - EIGRP, N - NLSP, H - Holddown, + = detail

9 Total IPX Servers

Table ordering is based on routing and server info

 Type  Name            Net  Address        Port  Route  Hops Itf

S 108  ACCT_SERV_1     7001.0000.0000.0001:0001   1/01   2   Et0

S 108  ACCT_SERV_2     7001.0000.0000.0001:0001   1/01   2   Et0

S 108  ACCT_SERV_3     7001.0000.0000.0001:0001   1/01   2   Et0

See the table above for show IPX servers field descriptions.

Misconceptions:

None

Related commands:

None


 Command:

show ipx traffic

Mode:

Router#

Syntax:

show ipx traffic [since boot | since show ]

Syntax Description:
since boot | IPX protocol statistics since system booted
since show | IPX protocol statistics since last show command was issued

Command Description:

To display information about the number and type of IPX packets transmitted and received, use the show ipx traffic user EXEC command.

Example:

The following is a sample of output from the show ipx traffic command:

Router>show ipx traffic

System Traffic for 0.0000.0000.0001 System-Name: router
Time since last clear: never
Rcvd:	   0 total, 0 format errors, 0 checksum errors, 0 bad hop count
        0 packets pitched, 0 local destination, 0 multicast
Bcast:  0 received, 0 sent
Sent:	   0 generated, 0 forwarded
        0 encapsulation failed, 0 no route
SAP:    0 Total SAP requests, 0 Total SAP replies, 1 servers
        0 SAP General Requests, 2 sent, 0 ignored, 0 replies
        0 SAP Get Nearest Server requests, 0 replies
        0 SAP Nearest Name requests, 0 replies
        0 SAP General Name requests, 0 replies
        0 SAP advertisements received, 324 sent, 0 Throttled
        0 SAP flash updates sent, 0 SAP format errors
RIP:    0 RIP requests, 0 ignored, 0 RIP replies, 3 routes
        0 RIP advertisements received, 684 sent, 0 Throttled
        0 RIP flash updates sent, 0 atlr sent
        2 RIP general requests sent
        0 RIP format errors
Echo:   Rcvd 0 requests, 0 replies
        Sent 0 requests, 0 replies
        0 unknown: 0 no socket, 0 filtered, 0 no helper
           0 SAPs throttled, freed NDB len 0
Watchdog:
        0 packets received, 0 replies spoofed
Queue lengths:
        IPX input: 0, SAP 0, RIP 0, GNS 0
        SAP throttling length: 0/(no limit), 0 nets pending lost route reply
        Delayed process creation: 0
EIGRP:  Total received 0, sent 0
        Updates received 0, sent 0
        Queries received 0, sent 0
        Replies received 0, sent 0
        SAPs received 0, sent 0
NLSP:   Time since last clear: never
NLSP:   Level-1 Hellos (sent/rcvd): 0/0
        PTP Hellos     (sent/rcvd): 0/0
        Level-1 LSPs sourced (new/refresh): 1/0
        Level-1 LSPs flooded (sent/rcvd): 0/0
        LSP Retransmissions: 0
        Level-1 CSNPs (sent/rcvd): 0/0
        Level-1 PSNPs (sent/rcvd): 0/0
        Level-1 DR Elections: 0
        Level-1 SPF Calculations: 1
        Level-1 Partial Route Calculations: 0
        LSP checksum errors received: 0
Trace:  Rcvd 0 requests, 0 replies
           Sent 0 requests, 0 replies

The table below describes the fields shown in the display.

Table: show ipx traffic Field Descriptions

Field Description

Time since last clear

Elapsed time since last clear command issued

Rcvd:

Description of the packets received

total

Total number of packets received

format errors

Number of bad packets discarded (for example, packets with a corrupted header). Includes IPX packets received in an encapsulation that this interface is not configured for.

checksum errors

Number of packets containing a checksum error. This number should always be 0, because IPX rarely uses a checksum.

bad hop count

Number of packets discarded because their hop count exceeded 16

packets pitched

Number of times the device received its own broadcast packet

local destination

Number of packets sent to the local broadcast address or specifically to the router

multicast

Number of packets received that were addressed to an IPX multicast address

Bcast:

Description of broadcast packets the router received and sent

received

Number of broadcast packets received

sent

Number of broadcast packets sent, including those the router is either forwarding or has generated

Sent:

Description of packets the software generated and sent and those the software received and routed to other destinations

generated

Number of packets sent that the router generated itself

forwarded

Number of packets sent that the router forwarded from other sources

encapsulation failed

Number of packets the software was unable to encapsulate

no route

Number of times the software could not locate a route to the destination in the routing table

SAP:

Description of the Service Advertising Protocol (SAP) packets sent and received

Total SAP requests

Cumulative sum of SAP requests received:

  • SAP general requests
  • SAP Get Nearest Server (GNS) requests

Total SAP replies

Cumulative sum of all SAP reply types: General, Get Nearest Server, Nearest Name, and General Name

servers

Number of servers in the SAP table

SAP General Requests, received, sent, ignored, replies

Number of general SAP requests, sent requests, ignored requests, and replies. This field applies to Cisco IOS Release 11.2 and later.

SAP Get Nearest Server, requests, replies

Number of GNS requests and replies. This field applies to Cisco IOS Release 11.2 and later.

SAP Nearest Name requests, replies

Number of SAP Nearest Name requests and replies. This field applies to Cisco IOS Release 11.2 and later.

SAP advertisements received and sent

Number of SAP advertisements generated and then sent as a result of a change to the routing or service tables

Throttled

Number of SAP advertisements discarded because they exceeded buffer capacity

SAP flash updates sent

Number of SAP flash updates generated and sent because of changes to routing or service tables

SAP format errors

Number of incorrectly formatted SAP advertisements received

RIP:

Description of the Routing Information Protocol (RIP) packets received and sent

RIP requests

Number of RIP requests received

ignored

Number of RIP requests ignored

RIP replies

Number of RIP replies sent in response to RIP requests

routes

Number of RIP routes in the current routing table

RIP advertisements received

Number of RIP advertisements received from another router

sent

Number of RIP advertisements generated and then sent

Throttled

Number of RIP advertisements discarded because they exceeded buffer capacity

RIP flash updates sent

atlr sent

Number of RIP flash updates generated and sent and number of advertisements to lost routes sent because of changes to the routing table.

RIP general requests sent

Number of RIP general requests generated and then sent

RIP format errors

Number of incorrectly formatted RIP packets received

Echo:

Description of the ping replies and requests received and sent

Rcvd requests, replies

Number of ping requests and replies received

Sent requests, replies

Number of ping requests and replies sent

unknown

Number of unsupported packets received on socket

no socket, filtered, no helper

Number of packets that could not be forwarded because helper addresses were improperly configured

SAPs throttled

Number of SAP packets discarded because they exceeded buffer capacity

freed NDB len

Number of Network Descriptor Blocks removed from the network but still needing to be removed from the routing table of the router

Watchdog:

Description of the watchdog packets the software handled

packets received

Number of watchdog packets received from IPX servers on the local network

replies spoofed

Number of times the software responded to a watchdog packet on behalf of the remote client

Queue lengths

Description of outgoing packets currently in buffers waiting to be processed

IPX input

Number of incoming packets waiting to be processed

SAP

Number of outgoing SAP packets waiting to be processed

RIP

Number of outgoing RIP packets waiting to be processed

GNS

Number of outgoing GNS packets waiting to be processed

SAP throttling length

Maximum number of outgoing SAP packets allowed in the buffer. Additional packets received are discarded.

nets pending lost reply route

Number of "downed" routes being processed by the Lost Route Algorithm

EIGRP: Total received, sent

Description of the Enhanced Interior Gateway Protocol (EIGRP) packets the router received and sent

Updates received, sent

Number of EIGRP updates received and sent

Queries received, sent

Number of EIGRP queries received and sent

Replies received, sent

Number of EIGRP replies received and sent

SAPs received, sent

Number of SAP packets received from and sent to EIGRP neighbors

NLSP:

Description of the NetWare Link Services Protocol (NLSP) packets the router sent and received

Time since last clear

Elapsed time since last clear command issued

Level-1 Hellos (sent/rcvd)

Number of LAN hello packets sent and received

PTP Hellos (sent/rcvd)

Number of point-to-point Hello packets sent and received

Misconceptions:
None

Related commands:
None


Command:

clear interface

Mode:

Router#

Syntax:

clear interface name-tag type slot/port

Syntax Description:

type

Interface type and port number to use as the backup interface

slot/port

Backplane slot number and port number on the interface. See your hardware installation manual for the specific slot and port numbers

Command Description:

This command will clear the hardware logic for the specified slot/port. This is often used with ISDN BRI interfaces to force the interface to resend the SPIDs.

Example:

The following command will clear the hardware logic BRI 0/0:

Router#clear interface bri 0/0

Misconceptions:

None

Related Commands:

None


Command:

clock source

Mode:

Router(config-controller)#

Syntax:

clock source {line | internal}

no clock source

Syntax Description:

line

The controller recovers external clock from the line and provides the recovered clock to the internal (system) clock generator.

internal

The controller synchronizes itself to the internal (system) clock.

Command Description:

Use the clock source controller configuration command to set the E1 line clock source for the Cisco AS5200.

This command first appeared in Cisco IOS Release 11.1.

Configure the clock source line primary command on the controller that takes the most reliable clocking from an E1 line. Configure the clock source line secondary command on the controller that has the next best known clocking. With this configuration, the primary line clocking is backed up to the secondary line if the primary clocking shuts down.

Example:

The following example shows how to configure the clock source for internal and then reconfigure the clock source for line:
Router(config)#controller t1 1/0

Router(config-controller)#clock source internal

Router(config)#controller t1 1/0

Router(config-controller)#clock source line

Misconceptions:

None

Related Commands:

framing

linecode


 Command:

framing

Mode:

Router(config-controller)#

Syntax:

framing {sf | esf} (for T1 lines)

framing {crc4 | no-crc4} [australia] (for E1 lines)

no framing (restores the default framing type)

Syntax Description:

sf

Specifies Super Frame as the T1 frame type.

esf

Specifies Extended Super Frame as the T1 frame type.

crc4

Specifies CRC4 frame as the E1 frame type.

no-crc4

Specifies no CRC4 frame as the E1 frame type.

australia

(Optional) Specifies the E1 frame type used in Australia.

Command Description:

Use the framing controller configuration command to select the frame type for the T1 or E1 data line.Use this command in configurations where the router or access server is intended to communicate with T1 or E1 fractional data line. The service provider determines which framing type, either sf, esf, or crc4, is required for your T1/E1 circuit.

Example:

The following example shows how to configure a T1 controller for extended super framing:

Router(config)#controller t1 1/0
Router(config-controller)#framing esf

Misconceptions:
None

Related Commands:
linecode


Command:

isdn answer1

Mode:

Router(config-if)#

Syntax:

isdn answer1 [called-party-number][:subaddress]

no isdn answer1 [called-party-number][:subaddress]

Syntax Description:

called-party-number | (Optional) Telephone number of the called party. At least one value—called-party-number or subaddress—must be specified. The maximum number of digits for called-party-number is 50.
: (Optional) Identifies the number that follows as a subaddress. Use the colon (:) when you configure both the called party number and the subaddress, or when you configure only the subaddress.
subaddress | (Optional) Subaddress number used for ISDN multipoint connections. At least one value—called-party-number or subaddress—must be specified. The maximum number of digits for subaddress is 50.

Command Description:

To have the router verify a called-party number or subaddress number in the incoming setup message for ISDN BRI calls, if the number is delivered by the switch, use the isdn answer1 command in interface configuration mode. To remove the verification request, use the no form of this command.

If you do not specify the isdn answer1 or isdn answer2 command, all calls are processed or accepted. If you specify the isdn answer1 or isdn answer2 command, the router must verify the incoming called-party number and the subaddress before processing and/or accepting the call. The verification proceeds from right to left for the called-party number; it also proceeds from right to left for the subaddress number.

You can configure just the called-party number or just the subaddress. In such a case, only that part is verified. To configure a subaddress only, include the colon (:) before the subaddress number.

You can declare a digit a "don't care" digit by configuring it as an x or X. In such a case, any incoming digit is allowed.

Example:

In the following example, 5552222 is the called-party number and 1234 is the subaddress:

interface bri 0
 isdn answer1 5552222:1234

In the following example, only the subaddress is configured:

interface bri 0
 isdn answer1 :1234

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

isdn answer2

Mode:

Router(config-if)#

Syntax:

isdn answer2 [called-party-number][:subaddress]

no isdn answer2 [called-party-number][:subaddress]

Syntax Description:

called-party-number | (Optional) Telephone number of the called party. At least one value—called-party-number or subaddress—must be specified. The maximum number of digits for called-party-number is 50.
: (Optional) Identifies the number that follows as a subaddress. Use the colon (:) when you configure both the called party number and the subaddress, or when you configure only the subaddress.
subaddress | (Optional) Subaddress number used for ISDN multipoint connections. At least one value—called-party-number or subaddress—must be specified. The maximum number of digits for subaddress is 50.

Command Description:

To have the router verify a called-party number or subaddress number in the incoming setup message for ISDN BRI calls, if the number is delivered by the switch, use the isdn answer2 command in interface configuration mode. To remove the verification request, use the no form of this command.

If you do not specify the isdn answer1 or isdn answer2 command, all calls are processed or accepted. If you specify the isdn answer1 or isdn answer2 command, the router must verify the incoming called-party number and the subaddress before processing and/or accepting the call. The verification proceeds from right to left for the called-party number; it also proceeds from right to left for the subaddress number.

You can configure just the called-party number or just the subaddress. In such a case, only that part is verified. To configure a subaddress only, include the colon (:) before the subaddress number.

You can declare a digit a "don't care" digit by configuring it as an x or X. In such a case, any incoming digit is allowed.

Example:

In the following example, 5552222 is the called-party number and 1234 is the subaddress:

interface bri 0
 isdn answer1 5552222:1234

In the following example, only the subaddress is configured:

interface bri 0
 isdn answer1 :1234

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

isdn call interface

Mode:

Router#

Syntax:

isdn call interface interface-number dialing-string [speed 56 | 64]

Syntax Description:

interface-number

Interface number.

dialing-string

Telephone number used for making ISDN data call.

speed 56

speed 64

(Optional) Line speed (56 or 64 kbps) used for making ISDN data call.

Defaults

The default B-channel speed is 64 kbps.

Command Description:

To make an ISDN data call, use the isdn call interface command in privileged EXEC mode.

You can use the isdn call interface command to test your DDR configuration. You can also use this command to verify the dialing string and speed without having to know the IP address of the remote router or without configuring a dialer map or string.

The isdn call interface command is being replaced by the isdn test call interface command in Cisco IOS Release 12.2.

Example:

The following example makes an ISDN data call through interface bri 0 to 555-1111 and at a line speed of 56 kbps:

Router# isdn call interface bri 0 5551111 speed 56

Misconceptions:

None.

Related Commands:

None


Command:

isdn caller

Mode:

Router(config-if)#

Syntax:

isdn caller phone-number [callback] [exact]

no isdn caller phone-number [callback] [exact]

Syntax Description:

phone-number | Remote telephone number for which to screen. Use the letter X to represent a single "don't care" digit. The maximum length of each number is 25 digits.
callback | (Optional) Enables callback.
exact | (Optional) Performs matching on incoming telephone number exactly as entered.

Command Description:

To configure ISDN caller ID screening and optionally to enable ISDN caller ID callback for legacy dial-on-demand routing (DDR), use the isdn caller command in interface configuration mode. To disable this feature, use the no form of this command.

This command configures the router to accept calls from the specified number.

When the optional callback keyword is used and a call is received from one of the callback numbers, the initial call is rejected (hence, not subject to tolls) and a callback is initiated to that calling number.

When Xs are used in the callback number, dialer caller screening is based on a best match system that uses the number of Xs as a criterion. To make callback calls only to specified numbers or ranges of numbers but to accept any other incoming calls, make sure that the number of Xs in any configuration line that uses the callback keyword is less than the number of Xs in any configuration line that does not use the keyword.

For example, if you use at most four Xs in the configuration lines with the callback keyword, then to accept calls from other numbers use at least five Xs in a configuration line that does not use the keyword.

When a telephone number is entered without the exact keyword, the software compares each number going from right to left until matching numbers are detected. For example, if the phone-number argument is 4085551234, calls from telephone numbers 1234, 51234, 5551234, and 4085551234 would be accepted, but calls from telephone numbers 44 and 4155551234 would be rejected.

If you want to accept a telephone number exactly as it is configured, enter it with the exact keyword. For example, if the phone-number argument is 5551212 and the exact keyword is applied, only the telephone number 5551212 is accepted; calls from telephone numbers 408551212 and 51212 would be rejected.

The maximum length of each telephone number is 25 characters. There is no limit on the numbers you can specify per interface.

Example:

The following example configures the router to accept a call containing the numbers 415 555-1234:

Router(config-if)#isdn caller 4155551234

The following example configures the router to accept a call only from telephone number 555-1234:

Router(config-if)#isdn caller 5551234 exact

In the above example, a call from telephone number 415 555-1234 would be rejected.

The following example configures the router to accept a call with telephone number containing 415 555-12 and any numbers in the last two positions:

Router(config-if)#isdn caller 41555512xx

In the following example, callback calls will be made only to numbers in the 555 and 556 exchanges, but any other telephone number can call in:

Router(config-if)#isdn caller 408555xxxx callback
Router(config-if)#isdn caller 408556xxxx callback
Router(config-if)#isdn caller xxxxx

Misconceptions:

None.

Related Commands:

show dialer

© Cisco Systems, Inc. 2001, 2002


 Command:

isdn spid1

Mode:

Router(config-if)#

Syntax:

isdn spid1 spid-number [ldn] [ldn2] [ldn3] ... [ldn]

no isdn spid1

Syntax Description:
spid-number | Number identifying the service to which you have subscribed. This value is assigned by the ISDN service provider and is usually a 10-digit telephone number with additional digits such as 40855522220101.
ldn | (Optional) Local directory number (LDN), which is a 7-digit number assigned by the service provider. This information is delivered by the switch in the incoming setup message. If you include the local directory number in the no form of this command, access to the switch is permitted, but the other B channel may not be able to receive incoming calls.

Command Description:

Use the isdn spid1 interface configuration command on the router to define the service profile identifier (SPID) number that has been assigned by the ISDN service provider for the B1 channel. This value is assigned by the ISDN service provider and is usually a 10-digit telephone number with additional digits. Use the no form of this command to disable the specified SPID, thereby preventing access to the switch. LDN is an optional Local directory number, which is a 7-digit number assigned by the service provider. This information is delivered by the switch in the incoming setup message.

Example:

Router(config)#interface bri 0/0
Router(config-if)#isdn spid1 28392037598234 3837439

Misconceptions:
None

Related Commands:
isdn spid2
isdn switch-type


 Command:

isdn spid2

Mode:

Router(config-if)#

Syntax:

isdn spid2 spid-number [ldn] [ldn2] [ldn3] ... [ldn]

no isdn spid2

Syntax Description:
spid-number | Number identifying the service to which you have subscribed. This value is assigned by the ISDN service provider and is usually a 10-digit telephone number with additional digits such as 40855522220101.
ldn | (Optional) Local directory number (LDN), which is a 7-digit number assigned by the service provider. This information is delivered by the switch in the incoming setup message. If you include the local directory number in the no form of this command, access to the switch is permitted, but the other B channel may not be able to receive incoming calls.

Command Description:

Use the isdn spid2 interface configuration command on the router to define the service profile identifier (SPID) number that has been assigned by the ISDN service provider for the B2 channel. This value is assigned by the ISDN service provider and is usually a 10-digit telephone number with additional digits. Use the no form of this command to disable the specified SPID, thereby preventing access to the switch. LDN is an optional Local directory number, which is a 7-digit number assigned by the service provider. This information is delivered by the switch in the incoming setup message.

Example:
Router(config)#interface bri 0/0
Router(config-if)#isdn spid2 28393027598234 3937439

Misconceptions:
None

Related Commands:
isdn spid1
isdn switch-type


 Command:

isdn switch-type

Mode:

Router(config)#
Router(config-if)#

Syntax:

isdn switch-type switch-type

Syntax Description:
switch-type Service provider switch type; see Table for a list of supported switches

Command Description:

To specify the central office switch type on the ISDN interface, use the isdn switch-type command in global or interface configuration mode. To remove an ISDN switch type, use the no form of this command.

Table: ISDN Service Provider BRI Switch Types
Keywords by Area Switch Type

none

No switch defined

Australia and Europe

basic-1tr6

German 1TR6 ISDN switches

basic-net3

NET3 ISDN, Norway NET3, Australia NET3, and New Zealand NET3 switches (covers the Euro-ISDN E-DSS1 signaling system and is ETSI-compliant)

vn3

French VN3 and VN4 ISDN BRI switches

Japan

ntt

Japanese NTT ISDN switches

North America

basic-5ess

AT&T basic rate switches

basic-dms100

Northern Telecom DMS-100 basic rate switches

basic-ni

National ISDN switches

Example:
Router(config)#isdn switch-type basic-5ess

Misconceptions:
None

Related Commands:
None


Command:

isdn twait-disable

Mode:

Router(config-if)#

Syntax:

isdn twait-disable
no isdn twait-disable

Syntax Description:

This command has no arguments or keywords.

Command Description:

To delay a National ISDN BRI switch a random time before activating the Layer 2 interface when the switch starts up, use the isdn twait-disable command in interface configuration mode. To remove the delay, use the no form of this command.

The random-length delay set by this command prevents mass power failures from causing the network ISDN switches to be overwhelmed when power returns and all the devices startup at the same time.

The random delay is in the range 1 to 300 seconds.

Example:

The following example configures a random wait period after a power failure:

Router(config-if)# isdn twait-disable

Misconceptions:

None

Related Commands:

None


 Command:

linecode

Mode:

Router(config-controller)#

Syntax:

linecode {ami | b8zs | hdb3}

no linecode

Syntax Description:

ami

Specifies alternate mark inversion (AMI) as the line-code type. Valid for T1 or E1 controllers; the default for T1 lines.

b8zs

Specifies B8ZS as the line-code type. Valid for T1 controller only.

hdb3

Specifies high-density bipolar 3 (hdb3) as the line-code type. Valid for E1 controller only; the default for E1 lines.

Command Description:

Use the linecode controller configuration command to select the line-code type for the T1 or E1 line. Use the no form of the command to restore the default.

Example:

The following example specifies B8ZS as the line-code type for a T1 line:

Router(config)#controller t1 1/0
Router(config-controller)#linecode b8zs

Misconceptions:
None

Related Commands:
None


 Command:

pri-group

Mode:

Router(config-controller)#

Syntax:

pri-group [timeslots range]

no pri-group

Syntax Description:

timeslots range

(Optional) Specifies a single range of values from 1 to 23 for channelized T1 and from 1 to 31 for channelized E1.

Command Description:

To specify ISDN Primary Rate Interface (PRI) on a channelized T1 or channelized E1 controller, use the pri-group controller configuration command. Use the no form of this command to remove the ISDN PRI configuration.

Example:

The following example configures ISDN PRI on all timeslots of the T1 controller in slot 1 port 0 on a Cisco 7200 series router:

Router(config)#isdn switch-type primary-4ess
Router(config)#controllers t1 1/0
 Router(config-controller)#framing esf
 Router(config-controller)#linecode b8zs
 Router(config-controller)#pri-group timeslots 1-24

The following example configures E1 controller 0 on a Cisco 4000 series router for ISDN PRI on all timeslots:

Router(config)#isdn switch-type primary-net5
Router(config)#controllers e1 0/0
 Router(config-controller)#framing esf
 Router(config-controller)#linecode b8zs
 Router(config-controller)#pri-group timeslots 1-31

Misconceptions:

None

Related Commands:
framing
isdn switch-type
linecode


 Command:

show isdn active

Mode:

Router>

Syntax:

show isdn active

Syntax Description:

This command has no arguments or keywords.

Command Description:

Displays current call information, including called number, the time until the call is disconnected, AOC (Advice of Charge) charging units used during the call, and whether the AOC information is provided during calls or at end of calls.

Example:
Router#show isdn active

-------------------------------------------------------------------------------
                              ISDN ACTIVE CALLS
-------------------------------------------------------------------------------
History Table MaxLength = 320 entries
History Retain Timer = 15 Minutes
-------------------------------------------------------------------------------
Call Calling     Called        Duration  Remote   Time until   Recorded Charges
Type Number      Number        Seconds   Name     Disconnect   Units/Currency
-------------------------------------------------------------------------------
Out             9876543222      Active(10)  idacom              11
  u(E)
Out             9876543210      Active(34)  idacom 115          5 u(D)
-------------------------------------------------------------------------------

Misconceptions:

    None

Related commands:

    show isdn status


 Command:

show isdn status

Mode:

Router>

Syntax:

show isdn status [dsl | interface-type number]

Syntax Description:
dsl | interface-type number Displays the status of a specific digital signal link (DSL) or a specific ISDN interface. The dsl range can vary, depending on the hardware platform. Interface-type can be bri or serial.

Command Description:

Displays the status of all ISDN interfaces or, optionally, a specific digital signal link (DSL) or a specific ISDN interface. The dsl range can vary , depending on the hardware platform. Interface-type can be bri or serial.

Example:

Router#show isdn status

Global ISDN Switchtype = basic-5ess
ISDN BRI0 interface
        dsl 0, interface ISDN Switchtype = basic-5ess
    Layer 1 Status:
        ACTIVE
    Layer 2 Status:
        TEI = 64, Ces = 1, SAPI = 0, State = MULTIPLE_FRAME_ESTABLISHED
    Layer 3 Status:
        0 Active Layer 3 Call(s)
    Activated dsl 0 CCBs = 0
ISDN BRI1 interface
        dsl 1, interface ISDN Switchtype = basic-5ess
    Layer 1 Status:
        DEACTIVATED
    Layer 2 Status:
        Layer 2 NOT Activated
    Layer 3 Status:
        0 Active Layer 3 Call(s)
    Activated dsl 1 CCBs = 0
ISDN BRI2 interface
        dsl 2, interface ISDN Switchtype = basic-5ess
    Layer 1 Status:
        DEACTIVATED
    Layer 2 Status:
        Layer 2 NOT Activated
    Layer 3 Status:
        0 Active Layer 3 Call(s)
    Activated dsl 2 CCBs = 0
ISDN BRI3 interface
        dsl 3, interface ISDN Switchtype = basic-5ess
    Layer 1 Status:        ACTIVE
    Layer 2 Status:
        TEI = 75, Ces = 1, SAPI = 0, State = MULTIPLE_FRAME_ESTABLISHED
    Layer 3 Status:
        0 Active Layer 3 Call(s)
    Activated dsl 3 CCBs = 0
ISDN BRI4 interface
        dsl 4, interface ISDN Switchtype = basic-5ess
    Layer 1 Status:
        DEACTIVATED
    Layer 2 Status:
        Layer 2 NOT Activated
    Layer 3 Status:
        0 Active Layer 3 Call(s)
    Activated dsl 4 CCBs = 0
ISDN BRI5 interface
        dsl 5, interface ISDN Switchtype = basic-5ess
    Layer 1 Status:
        DEACTIVATED
    Layer 2 Status:
        Layer 2 NOT Activated
    Layer 3 Status:
        0 Active Layer 3 Call(s)
    Activated dsl 5 CCBs = 0
ISDN BRI6 interface
        dsl 6, interface ISDN Switchtype = basic-5ess
    Layer 1 Status:
        DEACTIVATED
    Layer 2 Status:
        Layer 2 NOT Activated
    Layer 3 Status:
        0 Active Layer 3 Call(s)
    Activated dsl 6 CCBs = 0
ISDN BRI7 interface
        dsl 7, interface ISDN Switchtype = basic-5ess
    Layer 1 Status:
        DEACTIVATED
    Layer 2 Status:
        Layer 2 NOT Activated
    Layer 3 Status:
        0 Active Layer 3 Call(s)
    Activated dsl 7 CCBs = 0
ISDN Serial0:15 interface
        dsl 8, interface ISDN Switchtype = primary-ni
    Layer 1 Status:
        ACTIVE
    Layer 2 Status:
        TEI = 0, Ces = 1, SAPI = 0, State = MULTIPLE_FRAME_ESTABLISHED
    Layer 3 Status:
        0 Active Layer 3 Call(s)
    Activated dsl 8 CCBs = 0
    Total Allocated ISDN CCBs = 0
Misconceptions:
None

Related commands:
show isdn active


Command:

domain-password

Mode:

Router(config-router)#

Syntax:

domain-password password
no domain-password [password]

Syntax Description:

password Password you assign.

Command Description:

To configure the IS-IS routing domain authentication password, use the domain-password command in router configuration mode. To disable a password, use the no form of this command.

Default: No password is specified and no authentication is enabled for exchange of Level 2 routing information.

This password is exchanged as plain text and thus this feature provides only limited security.

This password is inserted in Level 2 (area router level) protocol data unit (PDU) link-state packets (LSPs), complete sequence number PDUs (CSNPs), and partial sequence number PDUs (PSNPs).

Example:

The following example assigns an authentication password to the routing domain:

Router(config)#router isis
Router(config-router)# domain-password flower

Misconceptions:

None

Related Commands:

area-password
isis password


Command:

ip router isis

Mode:

Router(config-if)#

Syntax:

ip router isis area-tag
no ip router isis area-tag

Syntax Description:

area-tag Meaningful name for a routing process. If it is not specified, a null tag is assumed and the process is referenced with a null tag. This name must be unique among all IP or Connectionless Network Service (CLNS) router processes for a given router.

Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.

Note Each area in a multiarea configuration should have a nonnull area tag to facilitate identification of the area.

Command Description:

To configure an IS-IS routing process for IP on an interface and to attach an area designator to the routing process, use the ip router isis command in interface configuration mode. To disable IS-IS for IP, use the no form of the command.

Before the IS-IS routing process is useful, a network entity title (NET) must be assigned with the net command and some interfaces must have IS-IS enabled.

If you have IS-IS running and at least one International Organization for Standardization Interior Gateway Routing Protocol (ISO-IGRP) process, the IS-IS process and the ISO-IGRP process cannot both be configured without an area tag. The null tag can be used by only one process. If you run ISO-IGRP and IS-IS, a null tag can be used for IS-IS, but not for ISO-IGRP at the same time. However, each area in an IS-IS multiarea configuration should have a nonnull area tag to facilitate identification of the area.

You can configure only one process to perform Level 2 (interarea) routing. If Level 2 routing is configured on any process, all additional processes are automatically configured as Level 1. You can configure this process to perform intra-area (Level 1) routing at the same time. You can configure up to 29 additional processes as Level 1-only processes. Use the is-type command to remove Level 2 routing from a router instance. You can then use the is-type command to enable Level 2 routing on some other IS-IS router instance.

An interface cannot be part of more than one area, except in the case where the associated routing process is performing both Level 1 and Level 2 routing. On media such as WAN media where subinterfaces are supported, different subinterfaces could be configured for different areas.

Example:

The following example specifies IS-IS as an IP routing protocol for a process named Finance, and specifies that the Finance process will be routed on Ethernet interface 0 and serial interface 0:

Router(config)# router isis Finance
Router(config-router)# net 49.0001.aaaa.aaaa.aaaa.00

Router(config)# interface Ethernet 0
Router(config-if)# ip router isis Finance

Router(config)# interface serial 0
Router(config-if)# ip router isis Finance
The following example shows an IS-IS configuration with two Level 1 areas and one Level 1-2 area:

Router(config)# interface Tunnel529
Router(config-if)# ip address 10.0.0.5 255.255.255.0
Router(config-if)# ip router isis  BB

Router(config)# interface Ethernet1
Router(config-if)# ip address 10.1.1.5 255.255.255.0
Router(config-if)# ip router isis  A3253-01

Router(config)# interface Ethernet2
Router(config-if)# ip address 10.2.2.5 255.255.255.0
Router(config-if)# ip router isis  A3253-02

Router(config)# router isis BB
Router(config-router)# net 49.2222.0000.0000.0005.00

Router(config)# router isis A3253-01
Router(config-router)# net 49.0553.0001.0000.0000.0005.00
Router(config-router)# is-type level-1

Router(config)# router isis A3253-02
Router(config-router)# net 49.0553.0002.0000.0000.0005.00
Router(config-router)# is-type level-1

Misconceptions:

None

Related Commands:

is-type
net
router isis


%command%

Command:

ip  rtp header-compression

Mode:

Router(config-if)#

Syntax:

ip rtp header-compression [passive]

no ip rtp header-compression [passive]

Syntax Description:

area-tag

Meaningful name for a routing process. If it is not specified, a null tag is assumed and the process is referenced with a null tag. This name must be unique among all IP or Connectionless Network Service (CLNS) router processes for a given router.

Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.

Note: Each area in a multiarea configuration should have a nonnull area tag to facilitate identification of the area. Passive If you include the passive keyword, the software compresses outgoing RTP packets only if incoming RTP packets on the same interface are compressed. If you use the command without the passive keyword, the software compresses all RTP traffic.

Command Description:

To enable Real-Time Transport Protocol (RTP) header compression, use the ip rtp header-compression command in interface configuration mode. To disable RTP header compression, use the no form of this command. RTP header compression is supported on serial lines using Frame Relay, HDLC, or PPP encapsulation. It is also supported over ISDN interfaces.

Example:

The following example enables RTP header compression on serial interface 0 and limits the number of RTP header compression connections to 10:

Router(config)#interface serial 0

Router(config-if)#encapsulation ppp

Router(config-if)#ip rtp header-compression

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


Command:

isis circuit-type

Mode:

Router(config-if)#

Syntax:

isis circuit-type [level-1 | level-1-2 | level-2-only]
no isis circuit-type

Syntax Description:

level-1 | (Optional) Configures a router for Level 1 adjacency only.
level-1-2 | (Optional) Configures a router for Level 1 and Level 2 adjacency.
level-2-only | (Optional) Configures a router for Level 2 adjacency only.

Command Description:

To configure the type of adjacency, use the isis circuit-type command in interface configuration mode. To reset the circuit type to Level l and Level 2, use the no form of this command.

By default, a Level 1 and Level 2 adjacency is established.

Normally, this command need not be configured. The proper way is to configure a router as a Level 1-only, Level 1-2, or Level 2-only system. Only on routers that are between areas (Level 1-2 routers) should you configure some interfaces to be Level 2-only to prevent wasting bandwidth by sending out unused Level 1 hello packets. Note that on point-to-point interfaces, the Level 1 and Level 2 hellos are in the same packet.

A Level 1 adjacency may be established if there is at least one area address in common between this system and its neighbors. Level 2 adjacencies will never be established over this interface.

A Level 1 and Level 2 adjacency is established if the neighbor is also configured as level-1-2 and there is at least one area in common. If there is no area in common, a Level 2 adjacency is established. This is the default.

Level 2 adjacencies are established if the other routers are Level 2 or Level 1-2 routers and their interfaces are configured for Level 1-2 or Level 2. Level 1 adjacencies will never be established over this interface.

Example:

In the following example, other routers on Ethernet interface 0 are in the same area. Other routers on Ethernet interface 1 are in other areas, so the router will stop sending Level 1 hellos.

Router(config-if)# interface ethernet 0
Router(config-if)# ip router isis
Router(config-if)# interface ethernet 1
Router(config-if)# isis circuit-type level-2-only

Misconceptions:

None

Related Commands:

None


Command:

isis csnp-interval

Mode:

Router(config-if)#

Syntax:

isis csnp-interval seconds [level-1 | level-2]
no isis csnp-interval [level-1 | level-2]

Syntax Description:

seconds | Interval of time between transmission of CSNPs on multiaccess networks. This interval only applies for the designated router. The default is 10 seconds.
level-1 | (Optional) Configures the interval of time between transmission of CSNPs for Level 1 independently.
level-2 | (Optional) Configures the interval of time between transmission of CSNPs for Level 2 independently.

Command Description:

To configure the IS-IS complete sequence number PDUs (CSNPs) interval, use the isis csnp-interval command in interface configuration mode. To restore the default value, use the no form of this command.

Defaults:

10 seconds

Level 1 and Level 2

It is very unlikely you will need to change the default value of this command.

This command applies only for the designated router (DR) for a specified interface. Only DRs send CSNP packets in order to maintain database synchronization. The CSNP interval can be configured independently for Level 1 and Level 2. Configuring the CSNP interval does not apply to serial point-to-point interfaces. It does apply to WAN connections if the WAN is viewed as a multiaccess meshed network.

For multiaccess WAN interfaces such as ATM, Frame Relay, and X.25, we highly recommend that you configure the nonbroadcast multiaccess (NBMA) cloud as multiple point-to-point subinterfaces. Doing so will make routing much more robust if one or more permanent virtual circuits (PVCs) fails.

The isis csnp-interval command on point-to-point subinterfaces should be used only in combination with the IS-IS mesh-group feature.

Example:

The following example configures Ethernet interface 0 for sending CSNPs every 30 seconds:

Router(config)# interface ethernet 0
Router(config-if)# isis csnp-interval 30 level-1

Misconceptions:

None

Related Commands:

None


Command:

isis display delimiter

Mode:

Router(config)#

Syntax:

isis display delimiter [return count | character count]
no isis display delimiter [return count | character count]

Syntax Description:

return | (Optional) Delimit with carriage returns.
count | (Optional) Number of carriage returns or length of string to use for the delimiter.
character | (Optional) Character to use for the delimiter string.

Command Description:

To make output from multiarea displays easier to read by specifying the delimiter to use to separate displays of information, use the isis display delimiter command in global configuration mode. To disable this output format, use the no form of the command.

The isis display delimiter command is disabled by default.

Use this command to customize display output when the IS-IS multiarea feature is used. The isis display delimiter command displays the output from different areas as a string or additional white space.

Example:

The following command causes different areas in multiarea displays (such as show command output) to be delimited by a string of dashes (-):

Router(config)# isis display delimiter - 14

With three IS-IS neighbors configured, this command displays the following output from the show clns neighbors command:

Router# show clns neighbors
--------------
Area L2BB:
System Id Interface SNPA State Holdtime Type Protocol
0000.0000.0009 Tu529 172.21.39.9 Up 25 L1L2 IS-IS
--------------
Area A3253-01:
System Id Interface SNPA State Holdtime Type Protocol
0000.0000.0053 Et1 0060.3e58.ccdb Up 22 L1 IS-IS
0000.0000.0003 Et1 0000.0c03.6944 Up 20 L1 IS-IS
--------------
Area A3253-02:
System Id Interface SNPA State Holdtime Type Protocol
0000.0000.0002 Et2 0000.0c03.6bc5 Up 27 L1 IS-IS
0000.0000.0053 Et2 0060.3e58.ccde Up 24 L1 IS-IS

Misconceptions:

None

Related Commands:

show clns is-neighbors
show clns neighbors
show clns traffic
show isis database
show isis spf-log
show isis topology


Command:

isis hello-interval

Mode:

Router(config-if)#

Syntax:

isis hello-interval {seconds | minimal} [level-1 | level-2]
no isis hello-interval [level-1 | level-2]

Syntax Description:

seconds | An integer value. By default, a value three times the hello interval seconds is advertised as the hold time in the hello packets sent. (Change the multiplier of 3 by specifying the isis hello-multiplier command.) With smaller hello intervals, topological changes are detected faster, but there is more routing traffic. The default is 10 seconds.
minimal | Causes the system to compute the hello interval based on the hello multiplier (specified by the isis hello-multiplier command) so that the resulting hold time is 1 second.
level-1 | (Optional) Configures the hello interval for Level 1 independently. Use this on X.25, Switched Multimegabit Data Service (SMDS), and Frame Relay multiaccess networks.
level-2 | (Optional) Configures the hello interval for Level 2 independently. Use this on X.25, SMDS, and Frame Relay multiaccess networks.

Command Description:

To specify the length of time between hello packets that the Cisco IOS software sends, use the isis hello-interval command in interface configuration mode. To restore the default value, use the no form of this command.

Defaults:
10 seconds
Level 1 and Level 2

The hello interval multiplied by the hello multiplier equals the hold time. If the minimal keyword is specified, the hold time is 1 second and the system computes the hello interval based on the hello multiplier.

The hello interval can be configured independently for Level 1 and Level 2, except on serial point-to-point interfaces. (Because only a single type of hello packet is sent on serial links, it is independent of Level 1 or Level 2.) The level-1 and level-2 keywords are used on X.25, SMDS, and Frame Relay multiaccess networks or LAN interfaces.

A faster hello interval gives faster convergence, but increases bandwidth and CPU usage. It might also add to instability in the network. A slower hello interval saves bandwidth and CPU. Especially when used in combination with a higher hello multiplier, this configuration may increase overall network stability.

It makes more sense to tune the hello interval and hello multiplier on point-to-point interfaces than on LAN interfaces.

Example:

The following example configures serial interface 0 to advertise hello packets every 5 seconds. The router is configured to act as a station router. This configuration will cause more traffic than configuring a longer interval, but topological changes will be detected earlier.

Router(config)# interface serial 0
Router(config-if)# isis hello-interval 5 level-1

Misconceptions:

None

Related Commands:

isis hello-multiplier


Command:

isis hello-multiplier

Mode:

Router(config-if)#

Syntax:

isis hello-multiplier multiplier [level-1 | level-2]
no isis hello-multiplier [level-1 | level-2]

Syntax Description:

multiplier Integer value from 3 to 1000. The advertised hold time in IS-IS hello packets will be set to the hello multiplier times the hello interval. Neighbors will declare an adjacency to this router down after not having received any IS-IS hello packets during the advertised hold time. The hold time (and thus the hello multiplier and the hello interval) can be set on a per-interface basis, and can be different between different routers in one area.

Using a smaller hello multiplier will give fast convergence, but can result in more routing instability. Increment the hello multiplier to a larger value to help network stability when needed. Never configure a hello multiplier lower than the default value of 3.

level-1 | (Optional) Configures the hello multiplier independently for Level 1 adjacencies.
level-2 | (Optional) Configures the hello multiplier independently for Level 2 adjacencies.

Command Description:

To specify the number of IS-IS hello packets a neighbor must miss before the router should declare the adjacency as down, use the isis hello-multiplier command in interface configuration mode. To restore the default value, use the no form of this command.

Defaults:
multiplier: 3
Level 1 and Level 2

The "holding time" carried in an IS-IS hello packet determines how long a neighbor waits for another hello packet before declaring the neighbor to be down. This time determines how quickly a failed link or neighbor is detected so that routes can be recalculated.

Use the isis hello-multiplier command in circumstances where hello packets are lost frequently and IS-IS adjacencies are failing unnecessarily. You can raise the hello multiplier and lower the hello interval (isis hello-interval command) correspondingly to make the hello protocol more reliable without increasing the time required to detect a link failure.

On point-to-point links, there is only one hello for both Level 1 and Level 2, so different hello multipliers should be configured only for multiaccess networks such as Ethernet and FDDI. Separate Level 1 and Level 2 hello packets are also sent over nonbroadcast multiaccess (NBMA) networks in multipoint mode, such as X.25, Frame Relay, and ATM. However, we recommend that you run IS-IS over point-to-point subinterfaces over WAN NBMA media.

Example:

In the following example, the network administrator wants to increase network stability by making sure an adjacency will go down only when many (ten) hello packets are missed. The total time to detect link failure is 60 seconds. This configuration will ensure that the network remains stable, even when the link is fully congested.

Router(config)# interface serial 1
Router(config-if)# ip router isis
Router(config-if)# isis hello-interval 6 level-1
Router(config-if)# isis hello-multiplier 10 level-1

Misconceptions:

None

Related Commands:

isis hello-interval


Command:

isis lsp-interval

Mode:

Router(config-if)#

Syntax:

isis lsp-interval milliseconds
no isis lsp-interval

Syntax Description:

milliseconds Time delay between successive LSPs (in milliseconds).

Command Description:

To configure the time delay between successive IS-IS link-state packet (LSP) transmissions, use the isis lsp-interval command in interface configuration mode. To restore the default value, use the no form of this command.

The default time delay is 33 milliseconds.

In topologies with a large number of IS-IS neighbors and interfaces, a router may have difficulty with the CPU load imposed by LSP transmission and reception. This command allows the LSP transmission rate (and by implication the reception rate of other systems) to be reduced.

Example:

The following example causes the system to send LSPs every 100 milliseconds (10 packets per second) on serial interface 0:

Router(config)# interface serial 0
Router(config-if)# isis lsp-interval 100

Misconceptions:

None

Related Commands:

isis retransmit-interval


Command:

isis mesh-group

Mode:

Router(config-if)#

Syntax:

isis mesh-group [number | blocked]
no isis mesh-group

Syntax Description:

number | (Optional) A number identifying the mesh group of which this interface is a member.
blocked | (Optional) Specifies that no LSP flooding will take place on this subinterface.

Command Description:

To optimize link-state packet (LSP) flooding in nonbroadcast multiaccess (NBMA) networks with highly meshed, point-to-point topologies, use the isis mesh-group command in interface configuration mode. To remove a subinterface from a mesh group, use the no form of this command.

The interface performs normal flooding by default.

LSPs that are first received on subinterfaces that are not part of a mesh group are flooded to all other subinterfaces in the usual way.

LSPs that are first received on subinterfaces that are part of a mesh group are flooded to all interfaces except those in the same mesh group. If the blocked keyword is configured on a subinterface, then a newly received LSP is not flooded out over that interface.

To minimize the possibility of incomplete flooding, you should allow unrestricted flooding over at least a minimal set of links in the mesh. Selecting the smallest set of logical links that covers all physical paths results in very low flooding, but less robustness. Ideally, you should select only enough links to ensure that LSP flooding is not detrimental to scaling performance, but enough links to ensure that under most failure scenarios no router will be logically disconnected from the rest of the network. In other words, blocking flooding on all links permits the best scaling performance, but there is no flooding. Permitting flooding on all links results in very poor scaling performance.

Example:

In the following example six interfaces are configured in three mesh groups. LSPs received are handled as follows:

LSPs received first via ATM 1/0.1 are flooded to all interfaces except ATM 1/0.2 (which is part of the same mesh group) and ATM 1/2.1, which is blocked.

LSPs received first via ATM 1/1.2 are flooded to all interfaces except ATM 1/1.1 (which is part of the same mesh group) and ATM 1/2.1, which is blocked.

LSPs received first via ATM 1/2.1 are not ignored, but flooded as usual to all interfaces. LSPs received first via ATM 1/2.2 are flooded to all interfaces, except ATM 1/2.1, which is blocked.

Router(config)# interface atm 1/0.1
Router(config-subif)# ip router isis
Router(config-subif)# isis mesh-group 10

Router(config)# interface atm 1/0.2
Router(config-subif)# ip router isis
Router(config-subif)# isis mesh-group 10

Router(config)# interface atm 1/1.1
Router(config-subif)# ip router isis
Router(config-subif)# isis mesh-group 11

Router(config)# interface atm 1/1.2
Router(config-subif)# ip router isis
Router(config-subif)# isis mesh-group 11

Router(config)# interface atm 1/2.1
Router(config-subif)# ip router isis
Router(config-subif)# isis mesh-group blocked

Router(config)# interface atm 1/2.2
Router(config-subif)# ip router isis

Misconceptions:

None

Related Commands:

router isis


Command:

isis metric

Mode:

Router(config-if)#

Syntax:

isis metric default-metric [delay-metric] [expense-metric] [error-metric] [level-1 | level-2]
no isis metric [default-metric] [delay-metric] [expense-metric] [error-metric] [level-1 | level-2]

Syntax Description:

default-metric | Metric assigned to the link and used to calculate the cost from each other router via the links in the network to other destinations. You can configure this metric for Level 1 or Level 2 routing. The range is from 0 to 63. The default value is 10.
delay-metric | (optional) Metric assigned to represent the transmit delay of a link.
expense-metric | (optional) Metric assigned to represent the monetary cost of a link.
error-metric | (optional) Metric assigned to represent the residual error probability of a link.
level-1 | (Optional) This metric should be used only in the shortest path first (SPF) calculation for Level 1 (intra-area) routing.
level-2 | (Optional) This metric should be used only in the SPF calculation for Level 2 (interarea) routing.

Command Description:

To configure the metric for an interface, use the isis metric command in interface configuration mode. To restore the default metric value, use the no form of this command.

The default is level-1 and level-2

Specifying the level-1 or level-2 keyword resets the metric only for Level 1 or Level 2 routing, respectively.

We highly recommend that you configure metrics on all interfaces. If you do not do so, the IS-IS metrics are similar to hop count metrics.

Example:

The following example configures serial interface 0 for a default link-state metric cost of 15 for Level 1:

Router(config)# interface serial 0
Router(config-if)# isis metric 15 level-1

Misconceptions:

None

Related Commands:

None


Command:

isis password

Mode:

Router(config-if)#

Syntax:

isis password password [level-1 | level-2]
no isis [password] [level-1 | level-2]

Syntax Description:

password | Authentication password you assign for an interface.
level-1 | (Optional) Configures the authentication password for Level 1 independently. For Level 1 routing, the router acts as a station router only.
level-2 | (Optional) Configures the authentication password for Level 2 independently. For Level 2 routing, the router acts as an area router only.

Command Description:

To configure the authentication password for an interface, use the isis password command in interface configuration mode. To disable authentication for IS-IS, use the no form of this command.

This command is disabled by default.

If no keyword is specified, the default is Level 1 and Level 2.

This command enables you to prevent unauthorized routers from forming adjacencies with this router, and thus protects the network from intruders.

The password is exchanged as plain text and thus provides only limited security.

Different passwords can be assigned for different routing levels using the level-1 and level-2 kewords.

Specifying the level-1 or level-2 keyword disables the password only for Level 1 or Level 2 routing, respectively.

Example:

The following example configures a password for Ethernet interface 0 at Level 1:

Router(config)# interface ethernet 0
Router(config-if)# isis password frank level-1

Misconceptions:

None

Related Commands:

None


Command:

isis priority

Mode:

Router(config-if)#

Syntax:

isis priority number-value [level-1 | level-2]
no isis priority [number-value] [level-1 | level-2]

Syntax Description:

number-value | Sets the priority of a router and is a number from 0 to 127. The default value is 64.
level-1 | (Optional) Sets the priority for Level 1 independently.
level-2 | (Optional) Sets the priority for Level 2 independently.

Command Description:

To configure the priority of designated routers, use the isis priority command in interface configuration mode. To reset the default priority, use the no form of this command.

Defaults:
Priority of 64
Level 1 and Level 2

Priorities can be configured for Level 1 and Level 2 independently. Specifying the level-1 or level-2 keyword resets priority only for Level 1 or Level 2 routing, respectively.

The priority is used to determine which router on a LAN will be the designated router or Designated Intermediate System (DIS). The priorities are advertised in the hello packets. The router with the highest priority will become the DIS.

In IS-IS, there is no backup designated router. Setting the priority to 0 lowers the chance of this system becoming the DIS, but does not prevent it. If a router with a higher priority comes on line, it will take over the role from the current DIS. In the case of equal priorities, the highest MAC address breaks the tie.

Example:

The following example shows Level 1 routing given priority by setting the priority level to 80. This router is now more likely to become the DIS.

Router(config)# interface ethernet 0
Router(config-if)# isis priority 80 level-1

Misconceptions:

None

Related Commands:

None


Command:

isis retransmit-interval

Mode:

Router(config-if)#

Syntax:

isis retransmit-interval seconds
no isis retransmit-interval

Syntax Description:

seconds Time (in seconds) between retransmission of each LSP. It is an integer that should be greater than the expected round-trip delay between any two routers on the attached network. The default is 5 seconds.

Command Description:

To configure the amount of time between retransmission of each IS-IS link-state packet (LSP) on a point-to-point link, use the isis retransmit-interval command in interface configuration mode. To restore the default value, use the no form of this command.

Defaults:
5 seconds

The setting of the seconds argument should be conservative, or needless retransmission will result.

This command has no effect on LAN (multipoint) interfaces. On point-to-point links, the value can be increased to enhance network stability.

Retransmissions occur only when LSPs are dropped. So setting the seconds argument to a higher value has little effect on reconvergence. The more neighbors routers have, and the more paths over which LSPs can be flooded, the higher this value can be made.

The value should be higher for serial lines.

Example:

The following example configures serial interface 0 for retransmission of IS-IS LSP, every 60 seconds for a large serial line:

Router(config)# interface serial 0
Router(config-if)# isis retransmit-interval 60

Misconceptions:

None

Related Commands:

isis lsp-interval
isis retransmit-throttle-interval


Command:

isis retransmit-throttle-interval

Mode:

Router(config-if)#

Syntax:

isis retransmit-throttle-interval milliseconds
no isis retransmit-throttle-interval

Syntax Description:

milliseconds Minimum delay (in milliseconds) between LSP retransmissions on the interface.

Command Description:

To configure the amount of time between retransmissions on each IS-IS link-state packet (LSP) on a point-to-point interface, use the isis retransmit-throttle-interval command in interface configuration mode. To restore the default value, use the no form of this command.

Defaults:
The delay is determined by the isis lsp-interval command.

This command may be useful in very large networks with many LSPs and many interfaces as a way of controlling LSP retransmission traffic. This command controls the rate at which LSPs can be re-sent on the interface.

The isis retransmit-throttle-interval command is distinct from the rate at which LSPs are sent on the interface (controlled by the isis lsp-interval command) and the period between retransmissions of a single LSP (controlled by the isis retransmit-interval command). These commands may all be used in combination to control the offered load of routing traffic from one router to its neighbors.

Example:

The following example configures serial interface 0 to limit the rate of LSP retransmissions to one every 300 milliseconds:

Router(config)#interface serial 0
Router(config-if)# isis retransmit-throttle-interval 300

Misconceptions:

None

Related Commands:

isis lsp-interval
isis retransmit-interval


Command:

is-type

Mode:

Router(config-router)#

Syntax:

is-type [level-1 | level-1-2 | level-2-only]
no is-type

Syntax Description:

level-1 | (Optional) Router performs only Level 1 (intra-area) routing. This router learns only about destinations inside its area. Level 2 (interarea) routing is performed by the closest Level 1-2 router.
level-1-2 | (Optional) Router performs both Level 1 and Level 2 routing. This router runs two instances of the routing process. It has one link-state packet database (LSDB) for destinations inside the area (Level 1 routing) and runs a shortest path first (SPF) calculation to discover the area topology. It also has another LSDB with link-state packets (LSPs) of all other backbone (Level 2) routers, and runs another SPF calculation to discover the topology of the backbone, and the existence of all other areas.
level-2-only | (Optional) Routing process acts as a Level 2 (interarea) router only. This router is part of the backbone, and does not communicate with Level 1-only routers in its own area.

Command Description:

To configure the routing level for an instance of the IS-IS routing process, use the is-type command in router configuration mode. To reset the default value, use the no form of this command.

Defaults:
In conventional IS-IS configurations, the router acts as both a Level 1 (intra-area) and a Level 2 (interarea) router.
In multiarea IS-IS configurations, the first instance of the IS-IS routing process configured is by default a Level 1-2 (intra-area and interarea) router. The remaining instances of the IS-IS process configured by default are Level 1 routers.

We highly recommend that you configure the type of IS-IS routing process. If you are configuring multiarea IS-IS, you must configure the type of the router, or allow it to be configured by default. By default, the first instance of the IS-IS routing process that you configure using the router isis command is a Level 1-2 router.

If only one area is in the network, there is no need to run both Level 1 and Level 2 routing algorithms. If IS-IS is used for Connectionless Network Service (CLNS) routing (and there is only one area), Level 1 only must be used everywhere. If IS-IS is used for IP routing only (and there is only one area), you can run Level 2 only everywhere. Areas you add after the Level 1-2 area exists are by default Level 1 areas.

If the router instance has been configured for Level 1-2 (the default for the first instance of the IS-IS routing process in a Cisco device), you can remove Level 2 (interarea) routing for the area using the is-type command. You can also use the is-type command to configure Level 2 routing for an area, but it must be the only instance of the IS-IS routing process configured for Level 2 on the Cisco device.

Example:

The following example specifies an area router:

Router(config)#router isis
Router(config-router)# is-type level-2-only

Misconceptions:

None

Related Commands:

router isis


Command:

max-lsp-lifetime (ISIS)

Mode:

Router(config-router)#

Syntax:

max-lsp-lifetime seconds
no max-lsp-lifetime

Syntax Description:

seconds Lifetime of the LSP in seconds. The range is 1 to 65535 seconds; the default is 1200 seconds (20 minutes).

Command Description:

To set the maximum time that link-state packets (LSPs) can remain in a router's database without being refreshed, use the max-lsp-lifetime command in router configuration mode. To restore the default lifetime, use the no form of this command.

The default is 1200 seconds (20 minutes)

If the lifetime is exceeded before a refresh LSP arrives, the LSP is dropped from the database.

You might need to adjust the maximum LSP lifetime if you change the LSP refresh interval with the lsp-refresh-interval (IP) command. LSPs must be periodically refreshed before their lifetimes expire. The value set for the lsp-refresh-interval command should be less than the value set for the max-lsp-lifetime command; otherwise, LSPs will time out before they are refreshed. If you misconfigure the LSP lifetime to be too low compared to the LSP refresh interval, the software will reduce the LSP refresh interval to prevent the LSPs from timing out.

You might prefer higher values for each command in order to reduce control traffic, at the expense of holding stale LSPs from a crashed or unreachable router in the database longer (thus wasting memory) or increasing the risk of undetected bad LSPs staying active (very rare).

Example:

The following example configures an LSP lifetime of 40 minutes:

Router(config)#router isis

Router(config-router)# max-lsp-lifetime 2400

Misconceptions:

None

Related Commands:

lsp-refresh-interval (ISIS)


Command:

net

Mode:

Router(config-router)#

Syntax:

net network-entity-title
no net network-entity-title

Syntax Description:

network-entity-title NET that specifies the area address and the system ID for a CLNS routing process. This argument can be either an address or a name.

Command Description:

To configure an IS-IS network entity title (NET) for a Connectionless Network Service (CLNS) routing process, use the net command in router configuration mode. To remove a NET, use the no form of this command.

By default, no NET is configured and the CLNS process will not start. A NET is mandatory.

Under most circumstances, one and only one NET must be configured.

A NET is a network service access point (NSAP) where the last byte is always zero. On a Cisco router running IS-IS, a NET can be 8 to 20 bytes. The last byte is always the n-selector and must be zero.

The six bytes directly in front of the n-selector are the system ID. The system ID length is a fixed size and cannot be changed. The system ID must be unique throughout each area (Level 1) and throughout the backbone (Level 2).

All bytes in front of the system ID are the area ID.

Even when IS-IS is used to perform IP routing only (no CLNS routing enabled), a NET must still be configured to define the router system ID and area ID.

A maximum of three NETs per router are allowed. In rare circumstances, it is possible to configure two or three NETs. In such a case, the area this router is in will have three area addresses. There will still be only one area, but it will have an additional maximum of three area addresses.

Configuring multiple NETs can be temporarily useful in the case of network reconfiguration where multiple areas are merged, or where one area is split into additional areas. Multiple area addresses enable you to renumber an area individually as needed.

If you are configuring multiarea IS-IS, the area ID must be unique, but the system ID portion of the NET must be the same for all IS-IS routing process instances.

Example:

The following example configures a router with system ID 0000.0c11.1111.00 and area ID 47.0004.004d.0001:

Router(config)# router isis CHESNUT
Router(config-router)# net 47.0004.004d.0001.0001.0c11.1111.00

The following example shows three IS-IS routing processes with three areas configured. Each area has a unique identifier, but the system ID is the same for all areas.

Router(config)#interface Tunnel 529
Router(config-if)#ip address 10.0.0.5 255.255.255.0
Router(config-if)#ip router isis BB
Router(config-if)#clns router isis BB
Router(config)#interface Ethernet 1
Router(config-if)#ip address 10.1.1.5 255.255.255.0
Router(config-if)#ip router isis A3253-01
Router(config-if)#clns router isis A3253-01

Router(config)#interface Ethernet 2
Router(config-if)#ip address 10.2.2.5 255.255.255.0
Router(config-if)#ip router isis A3253-02
Router(config-if)#clns router isis A3253-02

Router(config)#router isis BB ! Defaults to "is-type level-1-2"
Router(config-router)#net 49.2222.0000.0000.0005.00

Router(config)#router isis A3253-01
Router(config-router)#net 49.0553.0001.0000.0000.0005.00
Router(config-router)#is-type level-1

Router(config)#router isis A3253-02
Router(config-router)#net 49.0553.0002.0000.0000.0005.00
Router(config-router)#is-type level-1

Misconceptions:

None

Related Commands:

is-type
router isis


Command:

partition avoidance

Mode:

Router(config-router)#

Syntax:

partition avoidance area-tag
no partition avoidance area-tag

Syntax Description:

area-tag Meaningful name for a routing process. If it is not specified, a null tag is assumed and the process is referenced with a null tag. This name must be unique among all IP or Connectionless Network Service Protocol (CLNS) router processes for a given router.

Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.

Command Description:

To cause an IS-IS Level 1-2 border router to stop advertising the Level 1 area prefix into the Level 2 backbone when full connectivity is lost between the border router, all adjacent Level 1 routers, and end hosts, use the partition avoidance command in router configuration mode. To disable this output format, use the no form of the command.

This command is disabled by default.

When the partition avoidance command is enabled, a multiarea router withdraws a Level 1 area prefix from the Level 2 backbone when it no longer has any active adjacencies to that Level 1 area. This withdrawal prevents the Level 1 area from appearing to be partitioned within the Level 2 backbone.

In International Standards Organization (ISO) CLNS networks using a redundant topology, it is possible for an area to become "partitioned" when full connectivity is lost between a Level 1-2 border router, all adjacent Level 1 routers, and end hosts. In such a case, multiple Level 1-2 border routers advertise the Level 1 area prefix into the backbone area, even though any one router can reach only a subset of the end hosts in the Level 1 area.

When enabled, the partition avoidance command prevents this partitioning by causing the border router to stop advertising the Level 1 area prefix into the Level 2 backbone. This command displays the output from different areas as a string or additional white space.

Other cases of connectivity loss within the Level 1 area itself are not detected or corrected by the border router, and this command will have no effect.

Example:

The following example causes the routing process named Finance to stop advertising the prefix for the area named area1 when the router no longer has any active adjacencies to area1:

Router(config)#router isis  Finance
Router(config-router)# partition avoidance area1

Misconceptions:

None

Related Commands:

is-type
router isis


Command:

router isis

Mode:

Router(config)#

Syntax:

router isis area-tag
no router isis area-tag

Syntax Description:

area-tag Meaningful name for a routing process. If it is not specified, a null tag is assumed and the process is referenced with a null tag. This name must be unique among all IP or Connectionless Network Service (CLNS) router processes for a given router.

Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.

Command Description:

To enable the IS-IS routing protocol and to specify an IS-IS process, use the router isis command in global configuration mode. To disable IS-IS routing, use the no form of this command.

This command is used to enable routing for an area. An appropriate network entity title (NET) must be configured to specify the area address of the area and system ID of the router. Routing must be enabled on one or more interfaces before adjacencies may be established and dynamic routing is possible.

If you have IS-IS running and at least one International Standards Organization Interior Gateway Routing Protocol (ISO-IGRP) process, the IS-IS process and the ISO-IGRP process cannot both be configured without an area tag. The null tag can be used by only one process. If you run ISO-IGRP and IS-IS, a null tag can be used for IS-IS, but not for ISO-IGRP at the same time. However, each area in an IS-IS multiarea configuration should have a nonnull area tag to facilitate identification of the area.

You can configure only one IS-IS routing process to perform Level 2 (interarea) routing. You can configure this process to perform Level 1 (intra-area) routing at the same time. You can configure up to 29 additional processes as Level 1-only processes. If Level 2 routing is configured on any process, all additional processes are automatically configured as Level 1.

An interface cannot be part of more than one area, except in the case where the associated routing process is performing both Level 1 and Level 2 routing. On media such as WAN media where subinterfaces are supported, different subinterfaces could be configured for different areas.

If Level 2 routing is not desired for a given area, use the is-type command to remove Level 2. Level 2 routing can then be enabled on some other router instance.

Explicit redistribution between IS-IS instances is prohibited (prevented by the parser). In other words, you cannot issue a redistribute isis area-tag command in the context of another IS-IS router instance (router isis area-tag). Redistribution from any other routing protocol into a particular area is possible, and is configured per router instance, as in Cisco IOS software Release 12.0, using the redistribute and route map commands. By default, redistribution is into Level 2.

If multiple Level 1 areas are defined, the Target Address Resolution Protocol (TARP) behaves in the following way:

The locally assigned target identifier gets the network service access point (NSAP) of the Level 2 area, if present.
If only Level 1 areas are configured, the router uses the NSAP of the first active Level 1 area as shown in the configuration at the time of TARP configuration ("tarp run"). (Level 1 areas are sorted alphanumerically by tag name, with capital letters coming before lowercase letters. For example, AREA-1 precedes AREA-2, which precedes area-1.) Note that the target identifier NSAP could change following a reload if a new Level 1 area is added to the configuration after TARP is running.
The router continues to process all Type 1 and 2 protocol data units (PDUs) that are for this router. Type 1 PDUs are processed locally if the specified target identifier is in the local target identifier cache. If not, they are "propagated" (routed) to all interfaces in the same Level 1 area. (The same area is defined as the area configured on the input interface.)
Type 2 PDUs are processed locally if the specified target identifier is in the local target identifier cache. If not, they are propagated via all interfaces (all Level 1 or Level 2 areas) with TARP enabled. If the source of the PDU is from a different area, the information is also added to the local target identifier cache. Type 2 PDUs are propagated via all static adjacencies.
Type 4 PDUs (for changes originated locally) are propagated to all Level 1 and Level 2 areas (because internally they are treated as "Level 1-2").
Type 3 and 5 PDUs continue to be routed.
Type 1 PDUs are propagated only via Level 1 static adjacencies if the static NSAP is in one of the Level 1 areas in this router.

Example:

The following example configures IS-IS for IP routing, with system ID 0000.0000.0002 and area ID 01.0001, and enables IS-IS to form adjacencies on Ethernet interface 0 and serial interface 0. The IP prefix assigned to Ethernet interface 0 will be advertised to other IS-IS routers.

Router(config)# router isis
Router(config-router)# net 01.0001.0000.0000.0002
Router(config-router)# is-type level-1

Router(config)# interface ethernet 0
Router(config-if)# ip address 10.1.1.1 255.255.255.0
Router(config-if)# ip router isis

Router(config)# interface serial 0
Router(config-if)# ip unnumbered ethernet0
Router(config-if)# ip router isis

The following example starts IS-IS routing with the optional area-tag argument, where CHESNUT is the value for the area-tag argument:

Router(config)# router isis CHESNUT

The following example specifies IS-IS as an IP routing protocol for a process named Finance, and specifies that the Finance process will be routed on Ethernet interface 0 and serial interface 0:

Router(config)# router isis Finance
Router(config-router)# net 49.0001.aaaa.aaaa.aaaa.00

Router(config)# interface Ethernet 0
Router(config-if)# ip router isis Finance
Router(config-if)# interface serial 0
Router(config-if)# ip router isis Finance

Misconceptions:

None

Related Commands:

ip router isis
net
ppp chap hostname
route-map


%command%

Command:

summary-address (IS-IS)

Mode:

Router(config-router)#

Syntax:

summary-address address mask {level-1 | level-1-2 | level-2}

no summary-address address mask {level-1 | level-1-2 | level-2}

Syntax Description:

address | Summary address designated for a range of addresses.
mask | IP subnet mask used for the summary route.
level-1 | Only routes redistributed into Level 1 are summarized with the configured address and mask value.
level-1-2 | Summary routes are applied when redistributing routes into Level 1 and Level 2 IS-IS, and when Level 2 IS-IS advertises Level 1 routes as reachable in its area.
level-2 | Routes learned by Level 1 routing are summarized into the Level 2 backbone with the configured address and mask value. Redistributed routes into Level 2 IS-IS will be summarized also.

Command Description:

Multiple groups of addresses can be summarized for a given level. Routes learned from other routing protocols can also be summarized. The metric used to advertise the summary is the smallest metric of all the more specific routes. This command helps reduce the size of the routing table.

This command also reduces the size of the link-state packets (LSPs) and thus the link-state database (LSDB). It also helps stability because a summary advertisement is depending on many more specific routes. A single route flap does not cause the summary advertisement to flap in most cases.

The drawback of summary addresses is that other routes might have less information to calculate the most optimal routing table for all individual destinations.

Example:

The following example redistributes Routing Information Protocol (RIP) routes into IS-IS. In a RIP network, there are IP routes for 10.1.1, 10.1.2, 10.1.3, 10.1.4, and so on. This example advertises only 10.1.0.0 into the IS-IS Level 1 link-state PDU.

Router(config)#router isis

Router(config-router)#net 01.0000.0000.0001.00

Router(config-router)#redistribute rip level-1 metric 40

Router(config-router)#summary-address 10.1.0.0 255.255.0.0 level-1

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

which-route

Mode:

Router#

Syntax:

     which-route {nsap-address | clns-name}

Syntax Description:

nsap-address | CLNS destination network address.
clns-name | Destination host name.

Command Description:

To determine which next-hop router will be used or to troubleshoot your configuration if you have multiple processes running, use the which-route command in EXEC mode. This command displays the routing table in which the specified CLNS destination is found.

To display the IS-IS Level 1 forwarding table for IS-IS learned routes, use the show isis routes EXEC command.

Examples:

The following example shows that destination information for router gray is found in the IS-IS Level 1 routing table. The destination is on the local system.

Router#which-route gray

Route look-up for destination 39.0001.0000.0c00.bda8.00, GRAY

Found route in IS-IS level-1 routing table - destination is local

The following example shows that destination information for NSAP address 49.0001.0000.0c00.bda8.00 is found in the ISO IGRP Level 1 routing table. The destination is on the local system.

Router#which-route 49.0001.0000.0c00.bda8.00

Route look-up for destination 49.0001.0000.0c00.bda8.00

Found route in ISO IGRP routing table - destination is local

The following example shows that destination information for router green is found in the IS-IS Level 1 routing table. The destination is not on the local system.

Router#which-route green

Route look-up for destination 39.0001.0000.0c00.7f06.00, GREEN

Found route in IS-IS level-1 routing table

Adjacency entry used:

System Id SNPA Interface State Holdtime Type Protocol

GREEN 0000.0c00.2d55 Ethernet0 Up 91 L1L2  IS-IS

  Area Address(es): 39.0001

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


Command:

show clns

Mode:

Router>

Syntax:

show clns

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information about the CLNS network, use the show clns command in EXEC mode.

Example:

The following is sample output from the show clns command:

Router# show clns
Global CLNS Information:
  2 Interfaces Enabled for CLNS
  NET: 39.0004.0030.0000.0C00.224D.00
  NET: 39.0003.0020.0000.0C00.224D.00
  Configuration Timer: 60, Default Holding Timer: 300, Packet Lifetime 64
  ERPDU's requested on locally generated packets
  Intermediate system operation enabled (forwarding allowed)
  ISO IGRP level-1 Router: remote
     Routing for Domain: 39.0003, Area: 0020
  ISO IGRP level-2 Router: DOMAIN_remote
     Routing for Domain: 39.0003
  IS-IS level-1-2 Router:
     Routing for Area: 39.0004.0030

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show clns interface

Mode:

Router>

Syntax:

show clns interface [type number]

Syntax Description:

type | (Optional) Interface type.
number | (Optional) Interface number.

Command Description:

To list the CLNS-specific information about each interface, use the show clns interface command in EXEC mode.

Example:

The following is sample output from the show clns interface command that includes information for Token Ring and serial interfaces:

Router# show clns interface
TokenRing 0 is administratively down, line protocol is down
  CLNS protocol processing disabled
TokenRing 1 is up, line protocol is up
  Checksums enabled, MTU 4461, Encapsulation SNAP
  ERPDUs enabled, min. interval 10 msec.
  RDPDUs enabled, min. interval 100 msec., Addr Mask enabled
  Congestion Experienced bit set at 4 packets
  CLNS fast switching disabled
  DEC compatibility mode OFF for this interface
  Next ESH/ISH in 18 seconds
  Routing Protocol: ISO IGRP
      Routing Domain/Area: <39.0003> <0020>
Serial 2 is up, line protocol is up
  Checksums enabled, MTU 1497, Encapsulation HDLC
ERPDUs enabled, min. interval 10 msec.
     RDPDUs enabled, min. interval 100 msec., Addr Mask enabled
     Congestion Experienced bit set at 4 packets
     CLNS fast switching enabled
     DEC compatibility mode OFF for this interface
     CLNS cluster alias enabled on this interface
     Next ESH/ISH in 48 seconds
  Routing Protocol: IS-IS
       Circuit Type: level-1-2
       Level-1 Metric: 10, Priority: 64, Circuit ID: 0000.0C00.2D55.0A
       Number of active level-1 adjacencies: 0
       Level-2 Metric: 10, Priority: 64, Circuit ID: 0000.0000.0000.00
       Number of active level-2 adjacencies: 0
       Next IS-IS LAN Level-1 hello in 3 seconds
       Next IS-IS LAN Level-2 hello in 3 seconds

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


%command name%

Command:

show clns es-neighbors

Mode:

Router>

Syntax:

show clns area-tag es-neighbors [type number] [detail]

Syntax Description:

area-tag

Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.

Meaningful name for a routing process. This name must be unique among all IP or Connectionless Network Service (CLNS) router processes for a given router. If an area tag is not specified, a null tag is assumed and the process is referenced with a null tag. If an area tag is specified, output is limited to the specified area.

type

(Optional) Interface type.

number

(Optional) Interface number.

detail

(Optional) When specified, the areas associated with the end systems are displayed. Otherwise, a summary display is provided.

Command Description:

To list the ES neighbors that this router knows about, use the show clns es-neighbors command in EXEC mode.

Example:

The following is sample output from the show clns es-neighbors command when Ethernet interface 0 is specified:

Router#show clns es-neighbors
System Id       Interface   State  Type  Format
0800.2B14.060E  Ethernet0   Up     ES    Phase V
0800.2B14.0528  Ethernet0   Up     ES    Phase V

Table 36 describes the significant fields shown in the display.

Table 36   show clns es-neighbors Field Descriptions

Field | Descriptions
System Id | Identification value of the system.
Interface | Interface on which the router was discovered.
State | Adjacency state. Up and Init are the states. See the show clns neighbors description.
Type | Type of neighbor. Only valid value for the show clns es-neighbors EXEC command is ES.
Format | Indicates if the neighbor is either a Phase V (OSI) adjacency or Phase IV (DECnet) adjacency.

The following is sample output from the show clns es-neighbors detail command:

router# show clns es-neighbors detail
System Id       Interface  State  Type  Format
0800.2B14.060E  Ethernet0  Up      ES   Phase V
Area Address(es): 49.0040
0800.2B14.0528 Ethernet0  Up      ES    Phase V
Area Address(es): 49.0040

Notice that the information displayed in show clns es-neighbors detail output includes everything shown in show clns es-neighbors output, but it also includes the area addresses associated with the ES neighbors.

Misconceptions:
      None

Related commands:

show isis topology


Command:

show clns is-neighbors

Mode:

Router>

Syntax:

show clns area-tag is-neighbors [type number] [detail]

Syntax Description:

area-tag | Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration. It is the meaningful name for a routing process. This name must be unique among all IP or CLNS router processes for a given router. If an area tag is not specified, a null tag is assumed and the process is referenced with a null tag. If an area tag is specified, output is limited to the specified area.
type | (Optional) Interface type.
number | (Optional) Interface number.
detail | (Optional) When specified, the areas associated with the intermediate systems are displayed. Otherwise, a summary display is provided.

Command Description:

To display Intermediate System-to-Intermediate System (IS-IS) related information for IS-IS router adjacencies, use the show clns is-neighbors command in EXEC mode. Neighbor entries are sorted according to the area in which they are located.

Example:

The following is sample output from the show clns is-neighbors command:

Router# show clns is-neighbors
System Id       Interface   State  Type  Priority  Circuit Id         Format
0000.0C00.0C35  Ethernet1   Up     L1    64        0000.0C00.62E6.03  Phase V
0800.2B16.24EA  Ethernet0   Up     L1L2  64/64     0800.2B16.24EA.01  Phase V
0000.0C00.3E51  Serial1     Up     L2    0         04                 Phase V
0000.0C00.62E6  Ethernet1   Up     L1    64        0000.0C00.62E6.03  Phase V

Misconceptions:

None.

Related Commands:

clear clns is-neighbors
clns is-neighbor

© Cisco Systems, Inc. 2001, 2002


Command:

show clns neighbors

Mode:

Router>

Syntax:

show clns area-tag neighbors [type number] [area] [detail]

Syntax Description:

area-tag | Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration. It is the meaningful name for a routing process. This name must be unique among all IP or CLNS router processes for a given router. If an area tag is not specified, a null tag is assumed and the process is referenced with a null tag. If an area tag is specified, output is limited to the specified area.
type | (Optional) Interface type.
number | (Optional) Interface number.
area | (Optional) When specified, the CLNS multiarea adjacencies are displayed.
detail | (Optional) When specified, the area addresses advertised by the neighbor in the hello messages is displayed. Otherwise, a summary display is provided.

Command Description:

To display both ES and IS neighbors, use the show clns neighbors command in EXEC mode.

Example:

The following is sample output from the show clns neighbors command. This display is a composite of the show clns es-neighbor and show clns is-neighbor commands.

Router# show clns neighbors
System Id          SNPA            Interface    State  Holdtime  Type Protocol
0000.0000.0007     aa00.0400.6408  Ethernet0    Init   277       IS   ES-IS
0000.0C00.0C35     0000.0c00.0c36  Ethernet1    Up     91        L1   IS-IS
0800.2B16.24EA     aa00.0400.2d05  Ethernet0    Up     29        L1L2 IS-IS
0800.2B14.060E     aa00.0400.9205  Ethernet0    Up     1698      ES   ES-IS
0000.0C00.3E51     *HDLC*          Serial1      Up     28        L2   IS-IS
0000.0C00.62E6     0000.0c00.62e7  Ethernet1    Up     22        L1   IS-IS
0A00.0400.2D05     aa00.0400.2d05  Ethernet0    Init   24        IS   ES-IS

Misconceptions:

None.

Related Commands:

clear clns neighbors

© Cisco Systems, Inc. 2001, 2002


%command name%

Command:

show clns neighbors area

Mode:

Router>

Syntax:

show clns area-tag neighbor areas

Syntax Description:

area-tag

Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.

Meaningful name for a routing process. This name must be unique among all IP or Connectionless Network Service (CLNS) router processes for a given router. If an area tag is not specified, a null tag is assumed and the process is referenced with a null tag. If an area tag is specified, output is limited to the specified area.

Command Description:

To display information about Intermediate System-to-Intermediate System (IS-IS) neighbors and the areas to which they belong, use the show clns neighbor areas command in EXEC mode.

Example:

The following example shows output when two Level 1 and one Level 2 IS-IS areas are configured.
Router#show clns neighbor areas
System Id Interface Area Name State Holdtime Type Protocol
0000.0000.0009 Tu529 L2BB Up 26 L1L2 IS-IS
0000.0000.0053 Et1 A3253-01 Up 21 L1 IS-IS
0000.0000.0003 Et1 A3253-01 Up 28 L1 IS-IS
0000.0000.0002 Et2 A3253-02 Up 22 L1 IS-IS
0000.0000.0053 Et2 A3253-02 Up 23 L1 IS-IS

Table 39 describes the significant fields shown in the display.

Table 39   show clns neighbor areas Field Descriptions

Field Descriptions

System Id

Identification value of the system.

Interface

Interface on which the router was discovered.

Area Name

Name of the area in which the system is configured.

State

Adjacency state. Up and Init are the states. See the show clns neighbors description.

  Init

System is waiting for an IS-IS hello message.

  Up

Believes the system is reachable.

Holdtime

Number of seconds before this adjacency entry times out.

Type

L1, L2, and L1L2 type adjacencies.

  ES

End-system adjacency either discovered by the ES-IS protocol or statically configured.

  IS

Router adjacency either discovered by the ES-IS protocol or statically configured.

  L1

Router adjacency for Level 1 routing only.

  L1L2

Router adjacency for Level 1 and Level 2 routing.

  L2

Router adjacency for Level 2 only.

Protocol

Protocol through which the adjacency was learned. Valid protocol sources are ES-IS, IS-IS, International Standards Organization Interior Gateway Routing Protocol (ISO IGRP), static, and DECnet.

Misconceptions:

 None

Related commands:

show clns
es-neighbors


%command%

Command:

show clns route

Mode:

Router#
Router>

Syntax:

  show clns route nsap

Syntax Description:

nsap

CLNS network service access point (NSAP) address.

Command Description:

The show clns route command shows the Intermediate System-to-Intermediate System (IS-IS) Level 2 routing table and static and Intermediate System-to-Intermediate System Interior Gateway Routing Protocol (ISO-IGRP) learned prefix routes. This table stores IS-IS area addresses and prefix routes.

Example:

The following is sample output from the show clns route command when the nsap argument is not used:

Router# show clns route

ISO-IGRP Routing Table for Domain 49.0002, Area 0007

System Id Next-Hop SNPA Interface Metric State

milles milles *HDLC* Se1 8476 Up

0000.0000.0007 milles *HDLC* Se1 10476 Up

rips 0000.0000.0000 -- -- 0 Up

ISO-IGRP Routing Table for Domain 49.0002

Area Id Next-Hop SNPA Interface Metric State

0002 0000.0000.0000 -- -- 0 Up

Codes: C - connected, S - static, d - DecnetIV

I - ISO-IGRP, i - IS-IS, e - ES-IS

C 49.0002 [2/0], Local ISO-IGRP Domain

C 49.0001.0000.0000.0005.00 [1/0], Local IS-IS NET

C 49.0002.0007.0000.0000.0005.00 [1/0], Local ISO-IGRP NET

C 49.0001 [2/0], Local IS-IS Area

i 33.3333.3333 [110/10]

via bakel, Ethernet0

S 50.1234 [10/0], Discard Entry

I 55.5555.5555 [100/8476]

via milles, Serial1

S 77.7777.7777.7777 [10/0]

via Serial0

d 88.8888.8888.0007 [120/0], DecnetIV Entry

i 33.4567.8901 [110/10]

via bakel, Ethernet0

Misconceptions:

None

Related commands:

     None

© Cisco Systems, Inc. 2001, 2002


Command:

show clns traffic

Mode:

Router#
Router>

Syntax:

show clns area-tag traffic

Syntax Description:

area-tag Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration. It is the meaningful name for a routing process. This name must be unique among all IP or CLNS router processes for a given router. If an area tag is not specified, a null tag is assumed and the process is referenced with a null tag. If an area tag is specified, output is limited to the specified area.

Command Description:

To list the CLNS packets that this router has seen, use the show clns traffic command in EXEC mode.

Example:

TThe following is sample output from the show clns traffic command:

Router# show clns traffic
CLNS & ESIS Output: 139885, Input: 90406
CLNS Local: 0, Forward: 0
CLNS Discards:
   Hdr Syntax: 150, Checksum: 0, Lifetime: 0, Output cngstn: 0
  No Route: 0, Dst Unreachable 0, Encaps. Failed: 0
  NLP Unknown: 0, Not an IS: 0
CLNS Options: Packets 19, total 19, bad 0, GQOS 0, cngstn exprncd 0
CLNS Segments: Segmented: 0, Failed: 0
CLNS Broadcasts: sent: 0, rcvd: 0
Echos: Rcvd 0 requests, 69679 replies
  Sent 69701 requests, 0 replies
ESIS(sent/rcvd): ESHs: 0/34, ISHs: 483/1839, RDs: 0/0, QCF: 0/0
ISO IGRP: Querys (sent/rcvd): 0/0 Updates (sent/rcvd): 1279/1402
ISO IGRP: Router Hellos: (sent/rcvd): 1673/1848
ISO IGRP Syntax Errors: 0
IS-IS: Level-1 Hellos (sent/rcvd): 0/0
IS-IS: Level-2 Hellos (sent/rcvd): 0/0
IS-IS: PTP Hellos (sent/rcvd): 0/0
IS-IS: Level-1 LSPs (sent/rcvd): 0/0
IS-IS: Level-2 LSPs (sent/rcvd): 0/0
IS-IS: Level-1 CSNPs (sent/rcvd): 0/0
IS-IS: Level-2 CSNPs (sent/rcvd): 0/0
IS-IS: Level-1 PSNPs (sent/rcvd): 0/0
IS-IS: Level-2 PSNPs (sent/rcvd): 0/0
IS-IS: Level-1 DR Elections: 0
IS-IS: Level-2 DR Elections: 0
IS-IS: Level-1 SPF Calculations: 0
IS-IS: Level-2 SPF Calculations: 0

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show isis database

Mode:

Router>

Syntax:

show isis area-tag database [level-1] [level-2] [l1] [l2] [detail] [lspid]

Syntax Description:

area-tag | Meaningful name for a routing process. This name must be unique among all IP or Connectionless Network Service (CLNS) router processes for a given router. If an area tag is not specified, a null tag is assumed and the process is referenced with a null tag. If an area tag is specified, output is limited to the specified area. Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.
level-1 | (Optional) Displays the IS-IS link-state database for Level 1.
level-2 | (Optional) Displays the IS-IS link-state database for Level 2.
l1 | (Optional) Abbreviation for the level-1 option.
l2 | (Optional) Abbreviation for the level-2 option.
detail | (Optional) When specified, the contents of each link-state packet (LSP) are displayed. Otherwise, a summary display is provided.
lspid | (Optional) Link-state protocol data unit (PDU) identifier. When specified, the contents of a single LSP are displayed by its ID number.

Command Description:

To display the IS-IS link-state database, use the show isis database command in EXEC mode.

Each of the options for this command can be entered in an arbitrary string within the same command entry. For example, the following are both valid command specifications and provide the same output: show isis database detail l2 and show isis database l2 detail.

Example:

The following is sample output from the show isis database command when it is specified with no options:

Router# show isis database
IS-IS Level-1 Link State Database
LSPID                  LSP Seq Num     LSP Checksum   LSP Holdtime   ATT/P/OL
0000.0C00.0C35.00-00   0x0000000C      0x5696         792            0/0/0
0000.0C00.40AF.00-00*  0x00000009      0x8452         1077           1/0/0
0000.0C00.62E6.00-00   0x0000000A      0x38E7         383            0/0/0
0000.0C00.62E6.03-00   0x00000006      0x82BC         384            0/0/0
0800.2B16.24EA.00-00   0x00001D9F      0x8864         1188           1/0/0
0800.2B16.24EA.01-00   0x00001E36      0x0935         1198           1/0/0
IS-IS Level-2 Link State Database
LSPID                  LSP Seq Num     LSP Checksum   LSP Holdtime   ATT/P/OL
0000.0C00.0C35.03-00   0x00000005      0x04C8         792            0/0/0
0000.0C00.3E51.00-00   0x00000007      0xAF96         758            0/0/0
0000.0C00.40AF.00-00*  0x0000000A      0x3AA9         1077           0/0/0

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show isis routes

Mode:

Router#

Syntax:

show isis area-tag routes

Syntax Description:

area-tag

Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.

Meaningful name for a routing process. This name must be unique among all IP or Connectionless Network Service (CLNS) router processes for a given router. If an area tag is not specified, a null tag is assumed and the process is referenced with a null tag. If an area tag is specified, output is limited to the specified area.

Command Description:

To display the Intermediate System-to-Intermediate System (IS-IS) Level 1 forwarding table for IS-IS learned routes, use the show isis routes command in EXEC mode.

Example:

The following is sample output from the show isis routes command:

Router#show isis routes

IS-IS Level-1 Routing Table - Version 34

System Id       Next-Hop        SNPA            Interface    Metric    State

0000.0C00.0C35  0000.0C00.0C35  0000.0c00.0c36  Ethernet1    20        Up

0800.2B16.24EA  0800.2B16.24EA  aa00.0400.2d05  Ethernet0    10        Up

0800.2B14.060E  0800.2B14.060E  aa00.0400.9205  Ethernet0    10        Up

0800.2B14.0528  0800.2B14.0528  aa00.0400.9105  Ethernet0    10        Up

0000.0C00.40AF  0000.0000.0000  --              --           0         Up

0000.0C00.62E6  0000.0C00.62E6  0000.0c00.62e7  Ethernet1    10        Up

AA00.0400.2D05  0800.2B16.24EA  aa00.0400.2d05  Ethernet0    10        Up

Misconceptions:

None

Related commands:

redistribute

route-map

© Cisco Systems, Inc. 2001, 2002


Command:

show isis spf-log

Mode:

Router>

Syntax:

show isis area-tag spf-log

Syntax Description:

area-tag Meaningful name for a routing process. This name must be unique among all IP or Connectionless Network Service (CLNS) router processes for a given router. If an area tag is not specified, a null tag is assumed and the process is referenced with a null tag. If an area tag is specified, output is limited to the specified area. Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.

Command Description:

To display how often and why the router has run a full shortest path first (SPF) calculation, use the show isis spf-log user command in EXEC mode.

Example:

The following is sample output from the show isis spf-log command:

Router#show isis spf-log
Level 1 SPF log
When Duration Nodes Count Last trigger LSP Triggers
00:15:46 3124 40 1 milles.00-00 TLVCODE
00:15:24 3216 41 5 milles.00-00 TLVCODE NEWLSP
00:15:19 3096 41 1 deurze.00-00 TLVCODE
00:14:54 3004 41 2 milles.00-00 ATTACHFLAG LSPHEADER
00:14:49 3384 41 1 milles.00-01 TLVCODE
00:14:23 2932 41 3 milles.00-00 TLVCODE
00:05:18 3140 41 1 PERIODIC
00:03:54 3144 41 1 milles.01-00 TLVCODE
00:03:49 2908 41 1 milles.01-00 TLVCODE
00:03:28 3148 41 3 bakel.00-00 TLVCODE TLVCONTENT
00:03:15 3054 41 1 milles.00-00 TLVCODE
00:02:53 2958 41 1 mortel.00-00 TLVCODE
00:02:48 3632 41 2 milles.00-00 NEWADJ TLVCODE
00:02:23 2988 41 1 milles.00-01 TLVCODE
00:02:18 3016 41 1 gemert.00-00 TLVCODE
00:02:14 2932 41 1 bakel.00-00 TLVCONTENT
00:02:09 2988 41 2 bakel.00-00 TLVCONTENT
00:01:54 3228 41 1 milles.00-00 TLVCODE
00:01:38 3120 41 3 rips.03-00 TLVCONTENT

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show isis topology

Mode:

Router>

Syntax:

show isis area-tag topology [level-1] [level-2] [host-nsap]

Syntax Description:

area-tag | Meaningful name for a routing process. This name must be unique among all IP or Connectionless Network Service (CLNS) router processes for a given router. If an area tag is not specified, a null tag is assumed and the process is referenced with a null tag. If an area tag is specified, output is limited to the specified area. Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.
level-1 | (Optional) Paths to all Level 1 routers in the area or areas in which this router resides. The abbreviated keyword l1 may be used in place of level-1.
level-2 | (Optional) Paths to all Level 2 routers in the domain. The abbreviated keyword l2 may be used in place of level-2.
host-nsap | (Optional) Host name or network service access point (NSAP) of a router for which you would like to check reachability.

Command Description:

To display a list of all connected routers in all areas, use the show isis topology command in EXEC mode.

Use the show isis topology EXEC command to verify the presence and connectivity between all routers in all areas.

Example:

The following is sample output from the show isis topology command:

Router#show isis topology
IS-IS paths to level-1 routers
System Id Metric Next-Hop Interface SNPA
Router_A --
Router_B 10 Router_B Et0 00e0.b064.46ec
IS-IS paths to level-2 routers
System Id Metric Next-Hop Interface SNPA
Router_A --
Router_B 10 Router_B Et0 00e0.b064.46ec
Router_C 20 Router_B Et0 00e0.b064.46ec
Router_D Se0 DLCI 100
Router_D Se1 *HDLC*
Router_D 10 Router_D Se0 DLCI 100
Router_D Se1 *HDLC*

Misconceptions:

None.

Related Commands:

show clns es-neighbors
show clns is-neighbors
show clns neighbors
show clns neighbor areas
show clns route

© Cisco Systems, Inc. 2001, 2002


Command:

match as-path

Mode:

Router(config-route-map)#

Syntax:

match as-path path-list-number
no match as-path [path-list-number] ...[path-list-number]

Syntax Description:

path-list-number Autonomous system path access list. An integer from 1 to 199.

Command Description:

To match a BGP autonomous system path access list, use the match as-path command in route-map configuration mode. To remove a path list entry, use the no form of this command.

The values set by the match as-path and set weight commands override global values. For example, the weights assigned with the match as-path and set weight route-map configuration commands override the weight assigned using the neighbor weight command.

A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure a second route-map section with an explicit match specified.

Example:

The following example sets the autonomous system path to match BGP autonomous system path access list 20:

Router(config-route-map)# match as-path 20

Misconceptions:

None

Related Commands:

match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
neighbor weight
route-map
set as-path
set automatic-tag
set community
set level
set local-preference
set metric BGP OSPF RIP
set metric-type
set origin BGP
set tag
set weight


Command:

match community

Mode:

Router(config-route-map)#

Syntax:

match community standard-list-number | expanded-list-number | community-list-name [exact-match] ...[standard-list-number | expanded-list-number | community-list-name [exact-match]]
no match community standard-list-number | expanded-list-number | community-list-name [exact-match] ...[standard-list-number | expanded-list-number | community-list-name [exact-match]]

Syntax Description:

standard-list-number | Specifies a standard community list number from 1 to 99 that identifies one or more permit or deny groups of communities.
expanded-list-number | Specifies an expanded community list number from 100 to 199 that identifies one or more permit or deny groups of communities.
community-list-name | The community list name.
exact-match | (Optional) Indicates that an exact match is required. All of the communities and only those communities specified must be present.

Command Description:

To match a Border Gateway Protocol (BGP) community, use the match community command in route-map configuration mode. To remove the match community command from the configuration file and restore the system to its default condition where the software removes the BGP community list entry, use the no form of this command.

A route map can have several parts. Any route that does not match at least one match command relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure a second route-map section with an explicit match specified.

Matching based on community list number or name is one of the types of match commands applicable to BGP.

Example:

The following example shows that the routes matching community list 1 will have the weight set to 100. Any route that has community 109 will have the weight set to 100.

Router(config)# ip community-list 1 permit 109
Router(config)# route-map set_weight
Router(config-route-map)# match community 1
Router(config-route-map)# set weight 100

The following example shows that the routes matching community list 1 will have the weight set to 200. Any route that has community 109 alone will have the weight set to 200.

Router(config)# ip community-list 1 permit 109
Router(config)# route-map set_weight
Router(config-route-map)# match community  1 exact
Router(config-route-map)# set weight 200

In the following example, the routes that match community list LIST_NAME will have the weight set to 100. Any route that has community 101 alone will have the weight set to 100.

Router(config)# ip community-list 1 permit 101
Router(config)# route-map set_weight
Router(config-route-map)# match community  LIST_NAME
Router(config-route-map)# set weight 100

Misconceptions:

None

Related Commands:

ip community-list
route-map
set weight


Command:

match extcommunity

Mode:

Router(config-route-map)#

Syntax:

match extcommunity [standard-list-number | expanded-list-number]
no match extcommunity [standard-list-number | extended-list-number]

Syntax Description:

standard-list-number | A standard extended community list number from 1 to 99 that identifies one or more permit or deny groups of extended community attributes.
expanded-list-number | An expanded extended community list number from 100 to 500 that identifies one or more permit or deny groups of extended community attributes.

Command Description:

To match Border Gateway Protocol (BGP) extended community list attributes, use the match extcommunity command in route-map configuration mode. To remove the match extcommunity command from the configuration file and remove the BGP extended community list attribute entry, use the no form of this command.

Extended community attributes are used to configure, filter, and identify routes for virtual routing and forwarding instances (VRFs) and Multiprotocol Label Switching (MPLS) Virtual Private Networks (VPNs).

The match extcommunity command is used to configure match clauses that use extended community attributes in route maps. The range of numbers that can be configured with the match extcommunity command is from 1 to 99. All of the standard rules of match and set clauses apply to the configuration of extended community attributes.

Example:

The following example shows that the routes that match extended community list 1 will have the weight set to 100. Any route that has extended community 1 will have the weight set to 100.

Router(config)# ip extcommunity-list 1 rt 100:2
Router(config)# route-map MAP_NAME permit 10
Router(config-route-map)# match extcommunity 1
Router(config-route-map)# set weight 100

Misconceptions:

None

Related Commands:

route-map
set extcommunity
set weight
show ip bgp filter-list


Command:

match interface

Mode:

Router(config-route-map)#

Syntax:

match interface interface-type interface-number [... interface-type interface-number]
no match interface interface-type interface-number [... interface-type interface-number]

Syntax Description:

interface-type | Interface type.
interface-number | Interface number.

Command Description:

To distribute any routes that have their next hop out one of the interfaces specified, use the match interface command in route-map configuration mode. To remove the match interface entry, use the no form of this command.

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the interface-type interface-number arguments.

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. The match commands may be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure a second route map section with an explicit match specified.

Example:

In the following example, routes that have their next hop out Ethernet interface 0 will be distributed:

Router(config)# route-map name
Router(config-route-map)# match interface ethernet 0

Misconceptions:

None

Related Commands:

match as-path
match community
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set as-path
set automatic-tag
set community
set level
set local-preference
set metric BGP OSPF RIP
set metric-type
set next-hop
set tag
set weight


Command:

match ip address

Mode:

Router(config-route-map)#

Syntax:

match ip address [access-list-number | access-list-name] [... access-list-number | ... access-list-name]
no match ip address [access-list-number | access-list-name] [... access-list-number | ... access-list-name]

Syntax Description:

access-list-number | Number of a standard or extended access list. It can be an integer from 1 to 199.
access-list-name | Name of a standard or extended access list. It can be an integer from 1 to 199.

Command Description:

To distribute any routes that have a destination network number address that is permitted by a standard or extended access list, or to perform policy routing on packets, use the match ip address command in route-map configuration mode. To remove the match ip address entry, use the no form of this command.

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the access-list-number or access-list-name argument.

Like matches in the same route map subblock are filtered with "or" semantics. If any one match clause is matched in the entire route map subblock, this match is treated as a successful match. Dissimilar match clauses are filtered with "and" semantics. So dissimilar matches are filtered logically. If the first set of conditions is not met, the second match clause is filtered. This process continues until a match occurs or there are no more match clauses.

Use route maps to redistribute routes or to subject packets to policy routing. Both purposes are described in this section.

Redistribution

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

When you are passing routes through a route map, a route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure a second route map section with an explicit match specified.

Policy Routing

Another purpose of route maps is to enable policy routing. The match ip address command allows you to policy route packets based on criteria that can be matched with an extended access list. For example, a protocol, protocol service, and source or destination IP address. To define the conditions for policy routing packets, use the ip policy route-map interface configuration command, in addition to the route-map global configuration command, and the match and set route-map configuration commands. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which policy routing occurs. The set commands specify the set actions--the particular routing actions to perform if the criteria enforced by the match commands are met. You might want to policy route packets based on their source, for example, using an access list.

Example:

In the following example, routes that have addresses specified by access list numbers 5 or 80 will be matched:

Router(config)# route-map name
Router(config-route-map)# match ip address 5 80

In the following policy routing example, packets that have addresses specified by access list numbers 6 or 25 will be routed to Ethernet interface 0:

Router(config)# interface serial 0
Router(config-route-map)#  ip policy route-map chicago

Router(config)# route-map chicago
Router(config-route-map)#  match ip address 6 25
Router(config-route-map)#  set interface ethernet 0

Misconceptions:

None

Related Commands:

ip local policy route-map
match as-path
match community
match interface
match ip next-hop
match ip route-source
match length
match metric
match route-type
match tag
route-map
set as-path
set automatic-tag
set community
set default interface
set interface
set ip default next-hop verify-availability
set ip next-hop
set level
set local-preference
set metric BGP OSPF RIP
set metric-type
set next-hop
set tag
set weight


Command:

match ip next-hop

Mode:

Router(config-route-map)#

Syntax:

match ip next-hop [access-list-number | access-list-name] [...access-list-number | ...access-list-name]
no match ip next-hop [access-list-number | access-list-name] [...access-list-number | ...access-list-name] [... access-list-number | ... access-list-name]

Syntax Description:

access-list-number | access-list-name Number or name of a standard or extended access list. It can be an integer from 1 to 199.

Command Description:

To redistribute any routes that have a next hop router address passed by one of the access lists specified, use the match ip next-hop command in route-map configuration mode. To remove the next hop entry, use the no form of this command.

By default, routes are distributed freely, without being required to match a next hop address.

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the access-list-number or access-list-name argument.

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

When you are passing routes through a route map, a route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure a second route map section with an explicit match specified.

Example:

The following example distributes routes that have a next hop router address passed by access list 5 or 80 will be distributed:

Router(config)# route-map name
Router(config)# match ip next-hop 5 80

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip route-source
match metric
match route-type
match tag
route-map
set as-path
set automatic-tag
set community
set level
set local-preference
set metric BGP OSPF RIP
set metric-type
set next-hop
set tag
set weight


Command:

match ip route-source

Mode:

Router(config-route-map)#

Syntax:

match ip route-source [access-list-number | access-list-name] [...access-list-number | ...access-list-name]
no match ip route-source [access-list-number | access-list-name] [...access-list-number | ...access-list-name]

Syntax Description:

access-list-number | access-list-name Number or name of a standard or extended access list. It can be an integer from 1 to 199.

Command Description:

To redistribute routes that have been advertised by routers and access servers at the address specified by the access lists, use the match ip route-source command in route-map configuration mode. To remove the route-source entry, use the no form of this command.

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the access-list-number or access-list-name argument.

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure second route map section with an explicit match specified.

There are situations in which the next hop and source router address of the route are not the same.

Example:

The following example distributes routes that have been advertised by routers and access servers at the addresses specified by access lists 5 and 80:

Router(config)# route-map name
Router(config)# match ip route-source 5 80

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match metric
match route-type
match tag
route-map
set as-path
set automatic-tag
set community
set level
set local-preference
set metric BGP OSPF RIP
set metric-type
set next-hop
set tag
set weight


Command:

match length

Mode:

Router(config-route-map)#

Syntax:

match length minimum-length maximum-length
no match length minimum-length maximum-length

Syntax Description:

minimum-length | Minimum Level 3 length of the packet, inclusive, allowed for a match. Range is from 0 to 0x7FFFFFFF.
maximum-length | Maximum Level 3 length of the packet, inclusive, allowed for a match. Range is from 0 to 0x7FFFFFFF.

Command Description:

To base policy routing on the Level 3 length of a packet, use the match length command in route-map configuration mode. To remove the entry, use the no form of this command.

Use the ip policy route-map interface configuration command, the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for policy routing packets. The ip policy route-map command identifies a route map by name. Each route-map has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which policy routing occurs. The set commands specify the set actions--the particular routing actions to perform if the criteria enforced by the match commands are met.

The match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the packet to be routed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

You might want to base your policy routing on the length of packets so that your interactive traffic and bulk traffic are directed to different routers.

Example:

In the following example, packets 3 to 200 bytes long, inclusive, will be routed to FDDI interface 0:

Router(config)# interface serial 0
Router(config-if)# ip policy route-map interactive

Router(config)# route-map interactive
Router(config-route-map)# match length 3 200
Router(config-route-map)# set interface fddi 0

Misconceptions:

None

Related Commands:

ip policy route-map
match ip address
route-map
set default interface
set interface
set ip default next-hop verify-availability
set ip next-hop


Command:

match metric

Mode:

Router(config-route-map)#

Syntax:

match metric [metric-value] ...[metric-value]
no match metric [metric-value] ...[metric-value]

Syntax Description:

metric-value Route metric, which can be an IGRP five-part metric. It is a metric value from 0 to 4294967295.

Command Description:

To redistribute routes with the metric specified, use the match metric command in route-map configuration mode. To remove the entry, use the no form of this command.

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure second route map section with an explicit match specified.

Example:

In the following example, routes with the metric 5 will be redistributed:

Router(config)# route-map name
Router(config-route-map)# match metric 5

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match route-type
match tag
route-map
set as-path
set automatic-tag
set community
set level
set local-preference
set metric BGP OSPF RIP
set metric-type
set next-hop
set tag
set weight


Command:

match route-type

Mode:

Router(config-route-map)#

Syntax:

match route-type {local | internal | external [type-1 | type-2] | level-1 | level-2}

no match route-type {local | internal | external [type-1 | type-2] | level-1 | level-2}

Syntax Description:

local | Locally generated Border Gateway Protocol (BGP) routes.
internal | Open Shortest Path First (OSPF) intra-area and interarea routes or Enhanced Interior Gateway Routing Protocol (EIGRP) internal routes.
external [type-1 | type-2] | OSPF external routes, or EIGRP external routes. For OSPF, the external type-1 keyword matches only Type 1 external routes and the external type-2 keyword matches only Type 2 external routes.
level-1 | Intermediate System-to-Intermediate System (IS-IS) Level 1 routes.
level-2 | IS-IS Level 2 routes.

Command Description:

To redistribute routes of the specified type, use the match route-type command in route-map configuration mode. To remove the route type entry, use the no form of this command.

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure second route map section with an explicit match specified.

Example:

The following example distributes routes that have been advertised by routers and access servers at the addresses specified by previously defined access lists:

Router(config)#route-map name
Router(config)#match route-type internal

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match metric
match tag
route-map
set as-path
set automatic-tag
set community
set level
set local-preference
set metric BGP OSPF RIP
set metric-type
set next-hop
set tag
set weight


Command:

match tag

Mode:

Router(config-route-map)#

Syntax:

match tag tag-value [...tag-value]
no match tag tag-value [...tag-value]

Syntax Description:

tag-value List of one or more route tag values. Each can be an integer from 0 to 4294967295.

Command Description:

To redistribute routes in the routing table that match the specified tags, use the match tag command in route-map configuration mode. To remove the tag entry, use the no form of this command.

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure second route map section with an explicit match specified.

Example:

The following example distributes routes that have been advertised by routers and access servers at the addresses specified by previously defined access lists:

Router(config)#route-map name
Router(config)#match tag 5

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match metric
route-map
set as-path
set automatic-tag
set community
set level
set local-preference
set metric BGP OSPF RIP
set metric-type
set next-hop
set tag
set weight


Command:

set as-path

Mode:

Router(config-route-map)#

Syntax:

set as-path {tag | prepend as-path-string}
no set as-path {tag | prepend as-path-string}

Syntax Description:

tag | Converts the tag of a route into an autonomous system path. Applies only when redistributing routes into BGP.
prepend as-path-string | Appends the string following the keyword prepend to the autonomous system path of the route that is matched by the route map. Applies to inbound and outbound BGP route maps.

Command Description:

To modify an autonomous system path for BGP routes, use the set as-path command in route-map configuration mode. To not modify the autonomous system path, use the no form of this command.

The only global BGP metric available to influence the best path selection is the autonomous system path length. By varying the length of the autonomous system path, a BGP speaker can influence the best path selection by a peer further away.

By allowing you to convert the tag into an autonomous system path, the set as-path tag variation of this command modifies the autonomous system length. The set as-path prepend variation allows you to "prepend" an arbitrary autonomous system path string to BGP routes. Usually the local autonomous system number is prepended multiple times, increasing the autonomous system path length.

Example:

The following example converts the tag of a redistributed route into an autonomous system path:

Router(config)#route-map set-as-path-from-tag
Router(config-route-map)#set as-path tag

Router(config)#router bgp 100
Router(config-router)#redistribute ospf 109 route-map set-as-path-from-tag

The following example prepends 100 100 100 to all the routes advertised to 10.108.1.1:

Router(config)#route-map set-as-path
Router(config-route-map)#match as-path 1
Router(config-route-map)#set as-path prepend 100 100 100

Router(config)#router bgp 100
Router(config-router)#neighbor 10.108.1.1 route-map set-as-path out

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set automatic-tag
set community
set level
set local-preference
set metric
set metric-type
set next-hop
set origin
set tag
set weight


Command:

set automatic-tag

Mode:

Router(config-route-map)#

Syntax:

set automatic-tag
no set automatic-tag

Syntax Description:

This command has no arguments or keywords.

Command Description:

To automatically compute the tag value, use the set automatic-tag command in route-map configuration mode. To disable this function, use the no form of this command.

You must have a match clause (even if it points to a "permit everything" list) if you want to set tags.

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all the match criteria of a route map are met. When all match criteria are met, all set actions are performed.

Example:

The following example configures the Cisco IOS software to automatically compute the tag value for the Border Gateway Protocol (BGP) learned routes:

Router(config)#route-map tag
Router(config-route-map)#match as path 10
Router(config-route-map)#set automatic-tag

Router(config)#router bgp 100
Router(config-router)#table-map tag

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set automatic-tag
set community
set level
set local-preference
set metric
set metric-type
set next-hop
set origin
set tag
set weight


Command:

set community

Mode:

Router(config-route-map)#

Syntax:

set community {community-number [additive]} | none
no set community {community-number [additive]} | none

Syntax Description:

community-number | Specifies that community number. Valid values are from 1 to 4294967200, no-export, or no-advertise.
additive | (Optional) Adds the community to the already existing communities.
none | (Optional) Removes the community attribute from the prefixes that pass the route map.

Command Description:

To set the BGP communities attribute, use the set community route map configuration command. To delete the entry, use the no form of this command.

You must have a match clause (even if it points to a "permit everything" list) if you want to set tags.

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all the match criteria of a route map are met. When all match criteria are met, all set actions are performed.

Example:

In the following example, routes that pass the autonomous system path access list 1 have the community set to 109. Routes that pass the autonomous system path access list 2 have the community set to no-export (these routes will not be advertised to any external BGP [eBGP] peers).

Router(config)#route-map set_community 10 permit
Router(config-route-map)#match as-path 1
Router(config-route-map)#set community 109
Router(config)#route-map set_community 20 permit
Router(config-route-map)#match as-path 2
Router(config-route-map)#set community no-export

In the following similar example, routes that pass the autonomous system path access list 1 have the community set to 109. Routes that pass the autonomous system path access list 2 have the community set to local-as (the router will not advertise this route to peers outside the local autonomous system.

Router(config)#route-map set_community 10 permit
Router(config-route-map)#match as-path 1
Router(config-route-map)#set community 109
Router(config)#route-map set_community 20 permit
Router(config-route-map)#match as-path 2
Router(config-route-map)#set community local-as

Misconceptions:

None

Related Commands:

ip community-list
match community
route-map


Command:

set dampening

Mode:

Router(config-route-map)#

Syntax:

set dampening half-life reuse suppress max-suppress-time
no set dampening

Syntax Description:

half-life | Time (in minutes) after which a penalty is decreased. Once the route has been assigned a penalty, the penalty is decreased by half after the half life period (which is 15 minutes by default). The process of reducing the penalty happens every 5 seconds. The range of the half life period is from 1 to 45 minutes. The default is 15 minutes.
reuse | Unsuppresses the route if the penalty for a flapping route decreases enough to fall below this value. The process of unsuppressing routes occurs at 10-second increments. The range of the reuse value is from 1 to 20000; the default is 750.
suppress | Suppresses a route when its penalty exceeds this limit. The range is from 1 to 20000; the default is 2000.
max-suppress-time | Maximum time (in minutes) a route can be suppressed. The range is from 1 to 20000; the default is four times the half-life value. If the half-life value is allowed to default, the maximum suppress time defaults to 60 minutes.

Command Description:

To set the BGP route dampening factors, use the set dampening route map configuration command. To disable this function, use the no form of this command.

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

When a BGP peer is reset, the route is withdrawn and the flap statistics cleared. In this instance, the withdrawal does not incur a penalty even though route flap dampening is enabled.

Example:

The following example sets the half life to 30 minutes, the reuse value to 1500, the suppress value to 10000; and the maximum suppress time to 120 minutes:

Router(config)#route-map tag
Router(config-route-map)#match as path 10
Router(config-route-map)# set dampening 30 1500 10000 120

Router(config)#router bgp 100
Router(config-route-map)#neighbor 171.69.233.52 route-map tag in

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set automatic-tag
set community
set level
set local-preference
set metric
set metric-type
set next-hop
set origin
set tag
set weight


Command:

set default interface

Mode:

Router(config-route-map)#

Syntax:

set default interface interface-type interface-number [...interface-type interface-number]
no set default interface interface-type interface-number [...interface-type interface-number]

Syntax Description:

interface-type | Interface type, used with the interface number, to which packets are output.
interface-number | Interface number, used with the interface type, to which packets are output.

Command Description:

To indicate where to output packets that pass a match clause of a route map for policy routing and have no explicit route to the destination, use the set default interface command in route-map configuration mode. To delete an entry, use the no form of this command.

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the interface-type interface-number arguments.

Use this command to provide certain users a different default route. If the Cisco IOS software has no explicit route for the destination, then it routes the packet to this interface. The first interface specified with the set default interface command that is up is used. The optionally specified interfaces are tried in turn.

Use the ip policy route-map interface configuration command, the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for policy routing packets. The ip policy route-map command identifies a route map by name. Each route-map has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which policy routing occurs. The set commands specify the set actions--the particular routing actions to perform if the criteria enforced by the match commands are met.

The set clauses can be used in conjunction with one another. They are evaluated in the following order:

1. set ip next-hop

2. set interface

3. set ip default next-hop

4. set default interface

Example:

In the following example, packets that have a Level 3 length of 3 to 50 bytes and for which the software has no explicit route to the destination are output to Ethernet interface 0:

Router(config)# interface serial 0
Router(config-route-map)# ip policy route-map brighton

Router(config)# route-map brighton
Router(config-route-map)# match length 3 50
Router(config-route-map)# set default interface ethernet 0

Misconceptions:

None

Related Commands:

ip policy route-map
match ip address
match length
route-map
set interface
set ip default next-hop verify-availability
set ip next-hop


Command:

set extcommunity

Mode:

Router(config-route-map)#

Syntax:

set extcommunity {rt extended-community-value [additive] | soo extended-community-value}
no set extcommunity {rt extended-community-value [additive] | soo extended-community-value}

Syntax Description:

rt | Specifies the route target (RT) extended community attribute.
soo | Specifies the site of origin (SOO) extended community attribute.
extended-community-valueSpecifies the value to be set. The value can be one of the following combinations:

autonomous-system-number:network-number
ip-address:network-number

The colon is used to separate the autonomous system number and network number or IP address and network number.

additive | (Optional) Adds a route target to the existing route target list without replacing any existing route targets.

Command Description:

To set Border Gateway Protocol (BGP) extended community attributes, use the set extcommunity command in route-map configuration mode. To delete the entry, use the no form of this command.

Defaults:

Specifying new route targets with the rt keyword replaces existing route targets by default, unless the additive keyword is used. The use of the additive keyword adds the new route target to the existing route target list but does not replace any existing route targets.

Extended community attributes are used to configure, filter, and identify routes for virtual routing and forwarding instances (VRFs) and Multiprotocol Label Switching (MPLS) Virtual Private Networks (VPNs).

The set extcommunity command is used to configure set clauses that use extended community attributes in route maps. All of the standard rules of match and set clauses apply to the configuration of extended community attributes.

The route target (RT) extended community attribute is configured with the rt keyword. This attribute is used to identify a set of sites and VRFs that may receive routes that are tagged with the configured route target. Configuring the route target extended attribute with a route allows that route to be placed in the per-site forwarding tables that are used for routing traffic that is received from corresponding sites.

The site of origin (SOO) extended community attribute is configured with the soo keyword. This attribute uniquely identifies the site from which the Provider Edge (PE) router learned the route. All routes learned from a particular site must be assigned the same SOO extended community attribute, whether a site is connected to a single PE router or multiple PE routers. Configuring this attribute prevents routing loops from occurring when a site is multihomed. The SOO extended community attribute is configured on the interface and is propagated into BGP through redistribution. The SOO can be applied to routes that are learned from VRFs. The SOO should not be configured for stub sites or sites that are not multihomed.

Example:

The following example sets the route target to extended community attribute 100:2 for routes that are permitted by the route map:

Router(config)# access-list 2 permit 192.168.78.0 255.255.255.0
Router(config)# route-map MAP_NAME permit 10
Router(config-route-map)# match ip-address 2
Router(config-route-map)# set extcommunity rt 100:2

The following example sets the route target to extended community attribute 100:3 for routes that are permitted by the route map. The use of the additive keyword adds route target 100:3 to the existing route target list but does not replace any existing route targets.

Router(config)# access-list 3 permit 192.168.79.0 255.255.255.0
Router(config)# route-map MAP_NAME permit 10
Router(config-route-map)# match ip-address 3
Router(config-route-map)# set extcommunity rt 100:3 additive

The following example sets the site of origin to extended community attribute 100:4 for routes that are permitted by the route map:

Router(config)# access-list 4 permit 192.168.80.0 255.255.255.0
Router(config)# route-map MAP_NAME permit 10
Router(config-route-map)# match ip-address 4
Router(config-route-map)# set extcommunity soo 100:4

Misconceptions:

Configuring route targets with the set extcommunity command will replace existing route targets, unless the additive keyword is used.

Related Commands:

match extcommunity
route-map
show ip extcommunity-list
show route-map


Command:

set ip default next-hop verify-availability

Mode:

Router(config-route-map)#

Syntax:

set ip default next-hop verify-availability
no set ip default next-hop verify-availability

Syntax Description:

This command has no arguments or keywords.

Command Description:

To configure a router, for policy routing, to check the CDP database for the availability of an entry for the default next hop that is specified by the set ip default next-hop command, use the set ip default next-hop verify-availability route map configuration command. To disable this function, use the no form of this command.

Use this command to force the configured policy routing to check the CDP database to determine if an entry is available for the next hop that is specified by the set ip default next-hop command. This command is used to prevent traffic from being "black holed" if the configured next hop becomes unavailable.

Example:

The following example :

Router(config-route-map)# set ip default next-hop verify-availability

Misconceptions:

None

Related Commands:

ip policy route-map
match ip address
match length
route-map
set default interface
set ip default next-hop verify-availability
set ip next-hop


Command:

set ip default next-hop

Mode:

Router(config-route-map)#

Syntax:

set ip default next-hop ip-address [...ip-address]
no set ip default next-hop ip-address [...ip-address]

Syntax Description:

ip-address IP address of the next hop to which packets are output.The next hop must be an adjacent router.

Command Description:

To indicate where to output packets that pass a match clause of a route map for policy routing and for which the Cisco IOS software has no explicit route to a destination, use the set ip default next-hop command in route-map configuration mode. To delete an entry, use the no form of this command.

Use the ip policy route-map interface configuration command, the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for policy routing packets. The ip policy route-map command identifies a route map by name. Each route-map has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which policy routing occurs. The set commands specify the set actions--the particular routing actions to perform if the criteria enforced by the match commands are met.

If the first interface specified with the set interface command is down, the optionally specified interfaces are tried in turn.

The set clauses can be used in conjunction with one another. They are evaluated in the following order:

1. set ip next-hop

2. set interface

3. set ip default next-hop

4. set default interface

Example:

The following example provides two sources with equal access to two different service providers. Packets arriving on asynchronous interface 1 from the source 10.1.1.1 are sent to the router at 172.16.6.6 if the software has no explicit route for the destination of the packet. Packets arriving from the source 10.2.2.2 are sent to the router at 172.17.7.7 if the software has no explicit route for the destination of the packet. All other packets for which the software has no explicit route to the destination are discarded.

Router(config)# access-list 1 permit ip 10.1.1.1 0.0.0.0
Router(config)# access-list 2 permit ip 10.2.2.2 0.0.0.0

Router(config)# interface async 1
Router(config-if)# ip policy route-map equal-access

Router(config)# route-map equal-access permit 10
Router(config-route-map)# match ip address 1
Router(config-route-map)# set ip default next-hop 172.16.6.6
Router(config)# route-map equal-access permit 20
Router(config-route-map)# match ip address 2
Router(config-route-map)# set ip default next-hop 172.17.7.7
Router(config-route-map)# route-map equal-access permit 30
Router(config-route-map)# set default interface null0

Misconceptions:

The set ip next-hop and set ip default next-hop are similar commands but have a different order of operations. Configuring the set ip next-hop command causes the system to use policy routing first and then use the routing table. Configuring the set ip default next-hop command causes the system to use the routing table first and then policy route the specified next hop.

Related Commands:

ip policy route-map
match ip address
match length
route-map
set default interface
set ip default next-hop verify-availability
set ip next-hop


Command:

set ip next-hop (BGP)

Mode:

Router(config-route-map)#

Syntax:

set ip next-hop ip-address [...ip-address] [peer-address]
no set ip next-hop ip-address [...ip-address] [peer-address]

Syntax Description:

ip-address | IP address of the next hop to which packets are output. The next hop must be an adjacent router.
peer-address | (Optional) Sets the next hop to be the BGP peering address.

Command Description:

To indicate where to output packets that pass a match clause of a route map for policy routing, use the set ip next-hop command in route-map configuration mode. To delete an entry, use the no form of this command.

Use the ip policy route-map interface configuration command, the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for policy routing packets. The ip policy route-map command identifies a route map by name. Each route-map has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which policy routing occurs. The set commands specify the set actions--the particular routing actions to perform if the criteria enforced by the match commands are met.

If the interface associated with the first next hop specified with the set ip next-hop command is down, the optionally specified IP addresses are tried in turn.

When the set ip next-hop command is used with the peer-address keyword in an inbound route map of a BGP peer, the next hop of the received matching routes will be set to be the neighbor peering address, overriding any third-party next hops. So the same route map can be applied to multiple BGP peers to override third-party next hops.

When the set ip next-hop command is used with the peer-address keyword in an outbound route map of a BGP peer, the next hop of the advertised matching routes will be set to be the peering address of the local router, thus disabling the next hop calculation. The set ip next-hop command has finer granularity than the per-neighbor neighbor next-hop-self command, because you can set the next hop for some routes, but not others. The neighbor next-hop-self command sets the next hop for all routes sent to that neighbor.

The set clauses can be used in conjunction with one another. They are evaluated in the following order:

1. set ip next-hop

2. set interface

3. set ip default next-hop

4. set default interface

Example:

In the following example, three routers are on the same FDDI LAN (with IP addresses 10.1.1.1, 10.1.1.2, and 10.1.1.3). Each is in a different autonomous system. The set ip next-hop peer-address command specifies that traffic from the router (10.1.1.3) in remote autonomous system 300 for the router (10.1.1.1) in remote autonomous system 100 that matches the route map is passed through the router bgp 200, rather than sent directly to the router (10.1.1.1) in autonomous system 100 over their mutual connection to the LAN.

Router(config)# router bgp 200
Router(config-router)# neighbor 10.1.1.3 remote-as 300
Router(config-router)# neighbor 10.1.1.3 route-map set-peer-address out
Router(config-router)# neighbor 10.1.1.1 remote-as 100

Router(config)# route-map set-peer-address permit 10
Router(config-route-map)# set ip next-hop peer-address

Misconceptions:

None

Related Commands:

ip policy route-map
match ip address
match length
route-map
set default interface
set ip default next-hop verify-availability
set ip next-hop


Command:

set ip next-hop verify-availability

Mode:

Router(config-route-map)#

Syntax:

set ip next-hop verify-availability

Syntax Description:

This command has no arguments or keywords.

Command Description:

To configure policy routing to verify if the next hops of a route map are Cisco Discovery Protocol (CDP) neighbors before policy routing to those next hops, use the set ip next-hop verify-availability command in route-map configuration mode.

One example of when you might configure this command is if you have some traffic traveling via a satellite to a next hop. It might be prudent to verify that the next hop is reachable before trying to policy route to it.

This command has the following restrictions:

It causes some performance degradation.
CDP must be configured on the interface.
The next hop must be a Cisco device with CDP enabled.
It is supported in process switching and Cisco express forwarding (CEF) policy routing, but not available in dCEF, due to the dependency of the CDP neighbor database.

If the router is policy routing packets to the next hop and the next hop happens to be down, the router will try unsuccessfully to use Address Resolution Protocol (ARP) for the next hop (which is down). This behavior will continue forever.

To prevent this situation, use this command to configure the router to first verify that the next hops of the route map are the CDP neighbors of the router before routing to those next hops.

This command is optional because some media or encapsulations do not support CDP, or it may not be a Cisco device that is sending the router traffic.

If this command is set and the next hop is not a CDP neighbor, the router looks to the subsequent next hop, if there is one. If there is none, the packets simply are not policy routed.

If this command is not set, the packets are either successfully policy routed or remain forever unrouted.

If you want to selectively verify availability of only some next hops, you can configure different route map entries (under the same route map name) with different criteria (using access list matching or packet size matching), and use the set ip next-hop verify-availability command selectively.

Example:

The following example configures CEF, NetFlow, and NetFlow with flow acceleration. It also configures policy routing to verify that next hop 10.0.0.8 of the route map named test is a CDP neighbor before the router tries to policy route to it.

If the first packet is being policy routed via route map test sequence 10, the subsequent packets of the same flow always take the same route map test sequence 10, not route map test sequence 20, because they all match or pass the access list 1 check. Therefore, policy routing can be flow-accelerated by bypassing the access list check.

Router(config)# ip cef
Router(config)# ip flow-cache feature-accelerate
Router(config)# interface ethernet0/0/1
Router(config)# ip route-cache flow
Router(config)# ip policy route-map test
Router(config)# route-map test permit 10
Router(config-route-map)# match ip address 1
Router(config-route-map)# set ip precedence priority
Router(config-route-map)# set ip next-hop 10.0.0.8
Router(config-route-map)# set ip next-hop verify-availability
Router(config)# route-map test permit 20
Router(config-route-map)# match ip address 101
Router(config-route-map)# set interface Ethernet0/0/3
Router(config-route-map)# set ip tos max-throughput

Misconceptions:

None

Related Commands:

None


Command:

set ip default next-hop verify-availability

Mode:

Router(config-route-map)#

Syntax:

set ip next-hop ip-address [...ip-address] no set ip next-hop ip-address [...ip-address]

Syntax Description:

ip-address IP address of the next hop to which packets are output. The next hop must be an adjacent router.

Command Description:

To indicate where to output packets that pass a match clause of a route map for policy routing, use the set ip next-hop command in route-map configuration mode. To delete an entry, use the no form of this command.

Use the ip policy route-map interface configuration command, the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for policy routing packets. The ip policy route-map command identifies a route map by name. Each route-map has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which policy routing occurs. The set commands specify the set actions--the particular routing actions to perform if the criteria enforced by the match commands are met.

If the interface associated with the first next hop specified with the set ip next-hop command is down, the optionally specified IP addresses are tried in turn.

The set clauses can be used in conjunction with one another. They are evaluated in the following order:

1. set ip next-hop

2. set interface

3. set ip default next-hop

4. set default interface

Example:

In the following example, packets with a Level 3 length of 3 to 50 bytes are output to the router at IP address 10.14.2.2:

Router(config)# interface serial 0
Router(config-if)# ip policy route-map thataway
!
Router(config)# route-map thataway
Router(config-route-map)# match length 3 50
Router(config-route-map)# set ip next-hop 10.14.2.2

Misconceptions:

The set ip next-hop and set ip default next-hop are similar commands but have a different order of operations. Configuring the set ip next-hop command causes the system to use policy routing first and then use the routing table. Configuring the set ip default next-hop command causes the system to use the routing table first and then policy route the specified next hop.

Related Commands:

ip policy route-map
match ip address
match length
route-map
set default interface
set ip default next-hop verify-availability


Command:

set ip precedence (policy-map)

Mode:

Router(config-pmap-c)#

Syntax:

set ip precedence ip-precedence-value
no set ip precedence

Syntax Description:

ip-precedence-value A number from 0 to 7 that sets the precedence bit in the IP header.

Command Description:

To set the precedence value in the IP header, use the set ip precedence QoS policy-map configuration command. To leave the precedence value at the current setting, use the no form of this command.

Once the IP precedence bits are set, other QoS services such as weighted fair queueing (WFQ) and Weighted Random Early Detection (WRED) then operate on the bit settings.

The network gives priority (or some type of expedited handling) to marked traffic through the application of WFQ or WRED at points downstream in the network. Typically, you set IP Precedence at the edge of the network (or administrative domain); data then is queued based on the precedence. WFQ can speed up handling for certain precedence traffic at congestion points. WRED can ensure that certain precedence traffic has lower loss rates than other traffic during times of congestion.

Example:

The following example sets the IP Precedence to 5 for packets that satisfy the match criteria of the class map called class1:

Router(config)# policy-map policy1
Router(config-pmap)# class class1
Router(config-pmap-c)# set ip precedence 5

All packets that satisfy the match criteria of class1 are marked with the IP Precedence value of 5. How packets marked with the IP Precedence value of 5 are treated is determined by the network configuration.

The set ip precedence command is applied when you create a service policy in QoS policy-map configuration mode. This service policy is not yet attached to an interface or to an ATM virtual circuit. For information on attaching a service policy to an interface, refer to the "Modular Quality of Service Command-Line Interface" chapter of the Cisco IOS Quality of Service Solutions Configuration Guide.

Misconceptions:

None

Related Commands:

None


Command:

set ip precedence (route-map)

Mode:

Router(config-route-map)#

Syntax:

set ip precedence [number | name]
no set ip precedence

Syntax Description:

number | name (Optional) A number or name that sets the precedence bits in the IP header. The values for the number argument and the corresponding name argument are listed in the table below, from least to most important.

Command Description:

To set the precedence value (and an optional IP number or IP name) in the IP header, use the set ip precedence route-map configuration command. To leave the precedence value unchanged, use the no form of this command.

Number and Name Values for IP Precedence Name routinepriorityimmediateflashflash-overridecriticalinternetnetwork
Number
0
1
2
3
4
5
6
7

You can set the precedence using either a number or the corresponding name. Once the IP Precedence bits are set, other QoS services such as weighted fair queueing (WFQ) and Weighted Random Early Detection (WRED) then operate on the bit settings.

The network gives priority (or some type of expedited handling) to marked traffic through the application of WFQ or WRED at points downstream in the network. Typically, you set IP Precedence at the edge of the network (or administrative domain); data then is queued based on the precedence. WFQ can speed up handling for certain precedence traffic at congestion points. WRED can ensure that certain precedence traffic has lower loss rates than other traffic during times of congestion.

The mapping from arguments such as routine and priority to a precedence value is useful only in some instances. That is, the use of the precedence bit is evolving. You can define the meaning of a precedence value by enabling other features that use the value. In the case of the high-end Internet QoS available from Cisco, IP Precedences can be used to establish classes of service that do not necessarily correspond numerically to better or worse handling in the network.

Use the route-map (IP) global configuration command with the match and set route-map configuration commands to define the conditions for redistributing routes from one routing protocol into another, or for policy routing. Each route-map command has an associated list of match and set commands. The match commands specify the match criteria--the conditions under which redistribution or policy routing is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution or policy routing actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all of the match criteria of a route map are met.

Example:

The following example sets the IP Precedence to 5 (critical) for packets that pass the route map match:

Router(config)# interface serial 0
Router(config-if)# ip policy route-map texas

Router(config)# route-map texas
Router(config-route-map)# match length 68 128
Router(config-route-map)# set ip precedence 5

Misconceptions:

None

Related Commands:

fair-queue
ip policy route-map
route-map


Command:

set ip precedence

Mode:

Router(config-route-map)#

Syntax:

set ip precedence [number | name]
no set ip precedence

Syntax Description:

number | name (Optional) A number or name that sets the precedence bits in the IP header. The values for the number argument and the corresponding name argument are listed in the table below, from least to most important.

Command Description:

To set the precedence value (and an optional IP number or IP name) in the IP header, use the set ip precedence route-map configuration command. To leave the precedence value unchanged, use the no form of this command.

Number and Name Values for IP Precedence Name routinepriorityimmediateflashflash-overridecriticalinternetnetwork
Number
0
1
2
3
4
5
6
7

You can set the precedence using either a number or the corresponding name. Once the IP Precedence bits are set, other QoS services such as weighted fair queueing (WFQ) and Weighted Random Early Detection (WRED) then operate on the bit settings.

The way the network gives priority (or some type of expedited handling) to the marked traffic is through the application of WFQ or weighted random early detection (WRED) at points downstream in the network. Typically, you would set IP precedence at the edge of the network (or administrative domain) and have queueing act on it thereafter. WFQ can speed up handling for high precedence traffic at congestion points. WRED ensures that high precedence traffic has lower loss rates than other traffic during times of congestion.

The mapping from keywords such as routine and priority to a precedence value is useful only in some instances. That is, the use of the precedence bit is evolving. The customer can define the meaning of a precedence value by enabling other features that use the value. In the case of Cisco high-end Internet quality of service (QoS), IP precedences can be used to establish classes of service that do not necessarily correspond numerically to better or worse handling in the network. For example, IP Precedence 2 can be given 90 percent of the bandwidth on output links in the network, and IP Precedence 6 can be given 5 percent using the distributed weight fair queueing (DWFQ) implementation on the Versatile Interface Processors (VIPs).

Use the route-map (IP) global configuration command with the match and set route-map configuration commands to define the conditions for redistributing routes from one routing protocol into another, or for policy routing. Each route-map command has an associated list of match and set commands. The match commands specify the match criteria--the conditions under which redistribution or policy routing is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution or policy routing actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all of the match criteria of a route map are met.

Example:

The following example sets the IP Precedence value to 5 (critical) for packets that pass the route map match:

Router(config)# interface serial 0
Router(config-if)# ip policy route-map texas

Router(config)# route-map texas
Router(config-route-map)# match length 68 128
Router(config-route-map)# set ip precedence 5

Misconceptions:

Setting the precedence bit affects weighted fair queueing (WFQ). It acts as a multiplier on the WFQ weighting, using a formula of 4096 divided by the IP Precedence value plus 1. For more information, see the fair-queue command.

Related Commands:

fair-queue
ip policy route-map
route-map


Command:

set level

Mode:

Router(config-route-map)#

Syntax:

set level {level-1 | level-2 | level-1-2 | stub-area | backbone}
no set level {level-1 | level-2 | level-1-2 | stub-area | backbone}

Syntax Description:

level-1 | Imports routes into a Level 1 area.
level-2 | Imports routes into a Level 2 subdomain.
level-1-2 | Imports routes into Level 1 and Level 2.
stub-area | Imports routes into an Open Shortest Path First (OSPF) not-so-stubby area (NSSA) area.
backbone | Imports routes into an OSPF backbone area.

Command Description:

To indicate where to import routes, use the set level command in route-map configuration mode. To delete an entry, use the no form of this command.

This command is disabled by default.

For Intermediate System-to-Intermediate System (IS-IS) destinations, the default value is level-2. For OSPF destinations, the default value is backbone.

Use the route-map (IP) global configuration command with the match and set route-map configuration commands to define the conditions for redistributing routes from one routing protocol into another, or for policy routing. Each route-map command has an associated list of match and set commands. The match commands specify the match criteria--the conditions under which redistribution or policy routing is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution or policy routing actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all of the match criteria of a route map are met.

Example:

In the following example, routes will be imported into the Level 1 area:

Router(config)# route-map name
Router(config-route-map)# set level level-l

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set community
set local-preference
set metric
set metric-type
set tag
set weight


Command:

set local-preference

Mode:

Router(config-route-map)#

Syntax:

set local-preference number-value
no set local-preference number-value

Syntax Description:

number-value Preference value. An integer from 0 to 4294967295.

Command Description:

To specify a preference value for the autonomous system path, use the set local-preference command in route-map configuration mode. To delete an entry, use the no form of this command.

The default preference value is 100.

The preference is sent only to all routers in the local autonomous system.

You must have a match clause (even if it points to a "permit everything" list) if you want to set tags.

Use the route-map (IP) global configuration command with the match and set route-map configuration commands to define the conditions for redistributing routes from one routing protocol into another, or for policy routing. Each route-map command has an associated list of match and set commands. The match commands specify the match criteria--the conditions under which redistribution or policy routing is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution or policy routing actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all of the match criteria of a route map are met.

You can change the default preference value with the bgp default local-preference command.

Example:

The following example sets the local preference to 100 for all routes that are included in access list 1:

Router(config)# route-map map-preference
Router(config-route-map)# match as-path 1
Router(config-route-map)# set local-preference 100

Misconceptions:

None

Related Commands:

bgp default local-preference
match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set community
set metric
set metric-type
set tag
set weight


Command:

set metric (BGP, OSPF, RIP)

Mode:

Router(config-route-map)#

Syntax:

set metric metric-value
no set metric metric-value

Syntax Description:

metric-value Metric value; an integer from -294967295 to 294967295. This argument applies to all routing protocols except Interior Gateway Routing Protocol (IGRP) and Enhanced IGRP (EIGRP).

Command Description:

To set the metric value for a routing protocol, use the set metric command in route-map configuration mode. To return to the default metric value, use the no form of this command.

The default is a dynamically learned metric value.

We recommend that you consult your Cisco technical support representative before changing the default value.

Use the route-map (IP) global configuration command with the match and set route-map configuration commands to define the conditions for redistributing routes from one routing protocol into another, or for policy routing. Each route-map command has an associated list of match and set commands. The match commands specify the match criteria--the conditions under which redistribution or policy routing is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution or policy routing actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all of the match criteria of a route map are met.

Example:

The following example sets the metric value for the routing protocol to 100:

Router(config)# route-map set-metric
Router(config-route-map)# set metric 100

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set community
set metric-type
set tag
set weight


Command:

set metric-type

Mode:

Router(config-route-map)#

Syntax:

set metric-type {internal | external | type-1 | type-2}
no set metric-type {internal | external | type-1 | type-2}

Syntax Description:

internal | Intermediate System-to-Intermediate System (IS-IS) internal metric, or IGP metric as the MED for BGP.
external | IS-IS external metric.
type-1 | Open Shortest Path First (OSPF) external Type 1 metric.
type-2 | OSPF external Type 2 metric.

Command Description:

To set the metric type for the destination routing protocol, use the set metric-type command in route-map configuration mode. To return to the default, use the no form of this command.

This command is disabled by default.

Use the route-map (IP) global configuration command with the match and set route-map configuration commands to define the conditions for redistributing routes from one routing protocol into another, or for policy routing. Each route-map command has an associated list of match and set commands. The match commands specify the match criteria--the conditions under which redistribution or policy routing is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution or policy routing actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all of the match criteria of a route map are met.

Example:

The following example sets the metric type of the destination protocol to OSPF external Type 1:

Router(config)# route-map map-type
Router(config-route-map)# set metric-type type-1

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set community
set metric
set tag
set weight


Command:

set next-hop

Mode:

Router(config-route-map)#

Syntax:

set next-hop next-hop
no set next-hop next-hop

Syntax Description:

next-hop IP address of the next hop router.

Command Description:

To specify the address of the next hop, use the set next-hop command in route-map configuration mode. To delete an entry, use the no form of this command.

The default is the next hop address.

You must have a match clause (even if it points to a "permit everything" list) if you want to set tags.

Use the route-map (IP) global configuration command with the match and set route-map configuration commands to define the conditions for redistributing routes from one routing protocol into another, or for policy routing. Each route-map command has an associated list of match and set commands. The match commands specify the match criteria--the conditions under which redistribution or policy routing is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution or policy routing actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all of the match criteria of a route map are met.

Example:

In the following example, routes that pass the access list have the next hop set to 172.160.70.24:

Router(config)# route-map map_hop
Router(config-route-map)# match address 5
Router(config-route-map)# set next-hop 172.160.70.24

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set community
set metric
set tag
set weight


Command:

set origin (BGP)

Mode:

Router(config-route-map)#

Syntax:

set origin {igp | egp as-number | incomplete}
no set origin {igp | egp as-number | incomplete}

Syntax Description:

igp | Remote Interior Gateway Protocol (IGP) system.
egp | Local Exterior Gateway Protocol (EGP) system.
as-number | Remote autonomous system number. This is an integer from 0 to 65535.
incomplete | Unknown heritage.

Command Description:

To set the BGP origin code, use the set origin command in route-map configuration mode. To delete an entry, use the no form of this command.

The default is based on the route in the main IP routing table.

You must have a match clause (even if it points to a "permit everything" list) if you want to set tags.

Use the route-map (IP) global configuration command with the match and set route-map configuration commands to define the conditions for redistributing routes from one routing protocol into another, or for policy routing. Each route-map command has an associated list of match and set commands. The match commands specify the match criteria--the conditions under which redistribution or policy routing is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution or policy routing actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all of the match criteria of a route map are met.

Example:

The following example sets the origin of routes that pass the route map to IGP:

Router(config)# route-map set_origin
Router(config-route-map)# match as-path 10
Router(config-route-map)# set origin igp

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set community
set metric
set tag
set weight


Command:

set tag

Mode:

Router(config-route-map)#

Syntax:

set tag tag-value
no set tagtag-value

Syntax Description:

tag-value Name for the tag. Integer from 0 to 4294967295.

Command Description:

To set a tag value of the destination routing protocol, use the set tag command in route-map configuration mode. To delete the entry, use the no form of this command.

If not specified, the default action is to forward the tag in the source routing protocol onto the new destination protocol.

Use the route-map (IP) global configuration command with the match and set route-map configuration commands to define the conditions for redistributing routes from one routing protocol into another, or for policy routing. Each route-map command has an associated list of match and set commands. The match commands specify the match criteria--the conditions under which redistribution or policy routing is allowed for the current route-map command. The set commands specify the set actions--the particular redistribution or policy routing actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The set route-map configuration commands specify the redistribution set actions to be performed when all of the match criteria of a route map are met.

Example:

The following example sets the tag value of the destination routing protocol to 5:

Router(config)# route-map tag
Router(config-route-map)# set tag 5

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set community
set metric
set weight


Command:

set weight

Mode:

Router(config-route-map)#

Syntax:

set weight number
no set weight number

Syntax Description:

number Weight value. It can be an integer from 0 to 65535.

Command Description:

To specify the BGP weight for the routing table, use the set weight command in route-map configuration mode. To delete an entry, use the no form of this command.

The implemented weight is based on the first matched autonomous system path. Weights indicated when an autonomous system path is matched override the weights assigned by global neighbor commands. In other words, the weights assigned with the set weight route-map configuration command override the weights assigned using the neighbor weight command.

Example:

The following example sets the BGP weight for the routes matching the autonomous system path access list to 200:

Router(config)# route-map set-weight
Router(config-route-map)# match as-path 10
Router(config-route-map)# set weight 200

Misconceptions:

None

Related Commands:

match as-path
match community
match interface
match ip address
match ip next-hop
match ip route-source
match metric
match route-type
match tag
route-map
set community
set metric


Command:

banner exec

Mode:

Router(config)#

Syntax:

banner exec c banner-text c

no banner exec

Syntax Description:

c

Delimiting character of your choice, such as a pound sign (#)

banner-text

Text of your choice

Command Description:

When someone connects to the router, the MOTD banner appears before the login prompt. After the user successfully logs in to the router, the EXEC banner or incoming banner will be displayed, depending on the type of connection. For a reverse Telnet login, the incoming banner will be displayed. For all other connections, the router will display the EXEC banner.

Example:

The following example sets a MOTD banner. The pound sign (#) is used as a delimiting character.

Router(config)#banner exec  # You have just logged into the Phoenix branch router! #

Misconceptions:

None

Related Commands:

banner motd


Command:

clock set

Mode:

Router#

Syntax:

clock set hh:mm:ss day month year

clock set hh:mm:ss month day year

Syntax Description:

hh:mm:ss

Current time in hours (military format), minutes, and seconds.

day

Current day (by date) in the month.

month

Current month (by name).

year

Current year (no abbreviation).

Command Description:

To manually set the system clock, use one of the formats of the clock set EXEC command. Generally, if the system is synchronized by a valid outside timing mechanism, such as an NTP or VINES clock source, or if you have a router with calendar capability, you do not need to set the system clock. Use this command if no other time sources are available. The time specified in this command is relative to the configured time zone.

Example:

The following example manually sets the system clock to 1:32 p.m. on July 23, 1997:

Router#clock set 13:32:00 23 July 1997

Misconceptions:

None

Related Commands:

clock timezone


Command:

clock timezone

Mode:

Router(config)#

Syntax:

clock timezone zone hours [minutes]

no clock timezone

Syntax Description:

zone

Name of the time zone to be displayed when standard time is in effect.

hours

Hours offset from UTC.

minutes

(Optional) Minutes offset from UTC.

Command Description:

To set the time zone for display purposes, use the clock timezone global configuration command. To set the time to Coordinated Universal Time (UTC), use the no form of this command.

The system internally keeps time in UTC, so this command is used only for display purposes and when the time is manually set.

Example:

The following example sets the timezone to Pacific Standard Time and offsets 8 hours behind UTC:

Router(config)#clock timezone PST -8

Misconceptions:

None

Related Commands:

clock set


 Command:

ip domain-name

Mode:

Router(config)#

Syntax:

ip domain-name name

no ip domain-name name

Syntax Description:

name

Default domain name used to complete unqualified host names. Do not include the initial period that separates an unqualified name from the domain name.

Command Description:

To define a default domain name that the Cisco IOS software uses to complete unqualified host names (names without a dotted-decimal domain name), use the ip domain-name global configuration command. To disable use of the Domain Name System (DNS), use the no form of this command.

Any IP host name that does not contain a domain name (that is, any name without a dot) will have the dot and cisco.com appended to it before being added to the host table.
Example:

The following example defines cisco.com as the default domain name:

Router(config)#ip domain-name cisco.com
Misconceptions:
None

Related Commands:
ip domain-lookup


 Command:

ip host

Mode:

Router(config)#

Syntax:

ip host name-of-host [tcp-port-number] ip-address [ip-address2 ... address8]

Syntax Description:
name-of-host | Hostname to associate with an ip address
tcp-port-number | Specifies a default Tcp-port to associate with the host. The telnet command will use this port as the default for this host.
ip-address | Address to associate with a hostname
ip-address2 ... address8 | Auxiliary addresses for this host

Command Description:

To define a static host name-to-address mapping in the host cache, use the ip host global configuration command. To remove the name-to-address mapping, use the no form of this command. It is possible to specify up to 8 alternate addresses. The tcp-port-number argument is the TCP port number to connect to when using the defined host name in conjunction with an EXEC connect or Telnet command. The default is Telnet (port 23).

Example:
Router(config)#ip host Lab_A 156.12.12.12 162.12.34.1

Misconceptions:
None

Related Commands:
show hosts


 Command:

ip name-server

Mode:

Router(config)#

Syntax:

ip name-server {address} [address2 ... address6]

Syntax Description:

address

IP address of a domain-name server to configure

Command Description:

This command is used to define up to six domain name servers on the router.

Example:

The following example configures a primary dns server at 164.12.12.1, as well as a secondary at 143.34.23.8:

Router(config)#ip name-server 164.12.12.1 143.34.23.8

Misconceptions:
None

Related Commands:
ip domain-lookup


 Command:

media-type

Mode:

Router(config-if)#

Syntax:

media-type {aui | 10baset | 100baset | mii}

no media-type {aui | 10baset | 100baset | mii}

Syntax Description:

aui

Selects an AUI 15-pin physical connection. This is the default on Cisco 4000 series routers.

10baset

Selects an R-J45 10BASE-T physical connection.

100baset

Specifies an RJ-45 100BASE-T physical connection. This is the default on Cisco 7000 series and Cisco 7200 series routers.

mii

Specifies a media-independent interface.

Command Description:

To specify the physical connection on an Ethernet interface, use the media-type interface configuration command. Use the no form of this command to restore the default value.

Example:
Router(config)#int ethernet 0
Router(config-if)#media-type 10BaseT

Misconceptions:
None

Related Commands:
None


Command:

ntp peer

Mode:

Router(config)#

Syntax:

ntp peer ip-address [version number] [key keyid] [source interface] [prefer]
no ntp peer ip-address

Syntax Description:

ip-address | IP address of the peer providing, or being provided, the clock synchronization.
version | (Optional) Defines the Network Time Protocol (NTP) version number.
number | (Optional) NTP version number (1 to 3).
key | (Optional) Defines the authentication key.
keyid | (Optional) Authentication key to use when sending packets to this peer.
source | (Optional) Names the interface.
interface | (Optional) Name of the interface from which to pick the IP source address.
prefer | (Optional) Makes this peer the preferred peer that provides synchronization.

Command Description:

To configure the software clock to synchronize a peer or to be synchronized by a peer, use the ntp peer global configuration command. To disable this capability, use the no form of this command.

No peers are configured by default. If a peer is configured, the default NTP version number is 3, no authentication key is used, and the source IP address is taken from the outgoing interface.

Use this command if you want to allow this machine to synchronize with the peer, or vice versa. Using the prefer keyword reduces switching back and forth between peers.

Example:

The following address family configuration example configures network 10.108.0.0 as a local network and network 192.168.7.0 as a backdoor network:

Router(config)#ntp peer 192.168.22.33 version 2 source ethernet 0

Misconceptions:

If you are using the default version of 3 and NTP synchronization does not occur, try using NTP version 2 (NTPv2).

Related Commands:

ntp server
ntp source


Command:

ntp server

Mode:

Router(config)#

Syntax:

ntp server ip-address [version number] [key keyid] [source interface] [prefer]
no ntp server ip-address

Syntax Description:

ip-address | IP address of the time server providing the clock synchronization.
version | (Optional) Defines the NTP version number.
number | (Optional) NTP version number (1 to 3).
key | (Optional) Defines the authentication key.
keyid | (Optional) Authentication key to use when sending packets to this peer.
source | (Optional) Identifies the interface from which to pick the IP source address.
interface | (Optional) Name of the interface from which to pick the IP source address.
prefer | (Optional) Specifies that the server referenced in this command is preferred over other configured NTP servers.

Command Description:

To allow the software clock to be synchronized by a Network Time Protocol (NTP) time server, use the ntp server global configuration command. To disable this capability, use the no form of this command.

No peers are configured by default. If a peer is configured, the default NTP version number is 3, no authentication key is used, and the source IP address is taken from the outgoing interface.

Use this command if you want to allow the system to synchronize with the specified server. The server will not synchronize to this machine.

Use the prefer keyword if you use this command multiple times, and you want to set a preferred server. Using the prefer keyword reduces switching back and forth between servers.

If you are using the default version of 3 and NTP synchronization does not occur, try using NTP version 2. Some NTP servers on the Internet run version 2.

Example:

The following example configures a router to allow its software clock to be synchronized with the clock by the device at IP address 172.16.22.44 using NTP version 2:

Router(config)# ntp server 172.16.22.44 version 2

Misconceptions:

None

Related Commands:

ntp peer
ntp source


Command:

ntp source

Mode:

Router(config)#

Syntax:

ntp source type number
no ntp source

Syntax Description:

type | Type of interface.
number | Number of the interface.

Command Description:

To use a particular source address in Network Time Protocol (NTP) packets, use the ntp source global configuration command. To remove the specified source address, use the no form of this command.

Source address is determined by the outgoing interface by default.

Use this command when you want to use a particular source IP address for all NTP packets. The address is taken from the named interface. This command is useful if the address on an interface cannot be used as the destination for reply packets. If the source keyword is present on an ntp server or ntp peer global configuration command, that value overrides the global value set by this command.

Example:

The following example configures a router to use the IP address of Ethernet 0 as the source address of all outgoing NTP packets:

Router(config)# ntp source ethernet 0

Misconceptions:

None

Related Commands:

ntp peer
ntp server


 Command:

ping

Mode:

Router>
Router#

Syntax:

ping [protocol] {ip-address | hostname}

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the ping (packet internet groper) privileged EXEC command to diagnose basic network connectivity on Apollo, AppleTalk, Connectionless Network Service (CLNS), DECnet, IP, Novell IPX, VINES, or XNS networks. The optional protocol argument can be any of the following: apollo, appletalk, clns, decnet, ip, ipx, vines, or xns. To perform an extended ping, enter the ping command with no arguments.

Example:

Router>ping  10.0.0.1

Router#ping
Protocol [ip]:
Target IP address: 8.8.8.1
Repeat count [5]: 5
Datagram size [100]: 100
Timeout in seconds [2]: 2
Extended commands [n]: n
Sweep range of sizes [n]: n

Misconceptions:

None

Related Commands:
trace
telnet


Command:

send-lifetime

Mode:

Router(config-keychain)#

Syntax:

send-lifetime start-time {infinite | end-time | duration seconds}
no send-lifetime [start-time {infinite | end-time | duration seconds}]

Syntax Description:

start-time Beginning time that the key specified by the key command is valid to be sent. The syntax can be either of the following:

hh:mm:ss Month date year

hh:mm:ss date Month year

hh--hours

mm--minutes

ss--seconds

Month--first three letters of the month

date--date (1-31)

year--year (four digits)

The default start time and the earliest acceptable date is January 1, 1993.

infinite | Key is valid to be sent from the start-time value on.
end-time | Key is valid to be sent from the start-time value until the end-time value. The syntax is the same as that for the start-time value. The end-time value must be after the start-time value. The default end time is an infinite time period.
duration seconds | Length of time (in seconds) that the key is valid to be sent.

Command Description:

To set the time period during which an authentication key on a key chain is valid to be sent, use the send-lifetime key chain key configuration command. To revert to the default value, use the no form of this command.

The default is forever (the starting time is January 1, 1993, and the ending time is infinite).

Specify a start-time value and one of the following values: infinite, end-time, or duration seconds.

We recommend running Network Time Protocol (NTP) or some other time synchronization method if you intend to set lifetimes on keys.

If the last key expires, authentication will continue and an error message will be generated. To disable authentication, you must manually delete the last valid key.

Example:

The following example configures a key chain called trees. The key named chestnut will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named birch will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or discrepancies in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)#interface ethernet 0
Router(config-if)#ip rip authentication key-chain trees
Router(config-if)#ip rip authentication mode md5

Router(config)#router rip
Router(config-router)#network 172.19.0.0
Router(config-router)#version 2

Router(config)#key chain trees
Router(config-keychain)#key 1
Router(config-keychain)#key-string chestnut
Router(config-keychain)#accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain)#send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain)#key 2
Router(config-keychain)#key-string birch
Router(config-keychain)#accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain)#send-lifetime  15:00:00 Jan 25 1996 duration 3600

Misconceptions:

None

Related Commands:

accept-lifetime
key
key chain
key-string
show key chain


 Command:

trace

Mode:

Router>
Router#

Syntax:

trace [protocol] | [hostname | ip-address ]

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the trace privileged EXEC command to discover the routes that packets will actually take when traveling to their destination; appletalk, clns, ip and vines.

Example:
Router# trace ABA.NYC.mil

Type escape sequence to abort.
Tracing the route to ABA.NYC.mil (26.0.0.73)
1 DEBRIS.CISCO.COM (192.180.1.6) 1000 msec 8 msec 4 msec
2 BARRNET-GW.CISCO.COM (192.180.16.2) 8 msec 8 msec 8 msec
3 EXTERNAL-A-GATEWAY.STANFORD.EDU (192.42.110.225) 8 msec 4 msec 4 msec
4 BB2.SU.BARRNET.NET (192.200.254.6) 8 msec 8 msec 8 msec
5 SU.ARC.BARRNET.NET (192.200.3.8) 12 msec 12 msec 8 msec
6 MOFFETT-FLD-MB.in.MIL (192.52.195.1) 216 msec 120 msec 132 msec
7 ABA.NYC.mil (26.0.0.73) 412 msec 628 msec 664 msec

Misconceptions:
None

Related commands:
ping
telnet


Command:

show ntp associations

Mode:

Router>

Syntax:

show ntp associations [detail]

Syntax Description:

detail (Optional) Displays detailed information about each NTP association.

Command Description:

To show the status of Network Time Protocol (NTP) associations, use the show ntp associations EXEC command.

Example:

The following is sample output from the show ntp associations command:

Router#show ntp associations
address ref clock st  when  poll  reach  delay  offset    disp
 ~172.31.32.2 172.31.32.1 5 29  1024  377 4.2 -8.59 1.6
+~192.168.13.33 192.168.1.111 3 69   128  377 4.1 3.48 2.3
*~192.168.13.57 192.168.1.111 3 32   128  377 7.9 11.18 3.6
* master (synced), # master (unsynced), + selected, - candidate, ~ configured

Misconceptions:

None.

Related Commands:

show ntp status


Command:

show ntp status

Mode:

Router>

Syntax:

show ntp status

Syntax Description:

This command has no arguments or keywords.

Command Description:

To show the status of the Network Time Protocol (NTP), use the show ntp status EXEC command.

Example:

The following is sample output from the show ntp status command:

Router>show ntp status
Clock is synchronized, stratum 4, reference is 192.168.13.57
nominal freq is 250.0000 Hz, actual freq is 249.9990 Hz, precision is 2**19
reference time is AFE2525E.70597B34 (00:10:22.438 PDT Mon Jul 5 1993)
clock offset is 7.33 msec, root delay is 133.36 msec
root dispersion is 126.28 msec, peer dispersion is 5.98 msec

Misconceptions:

None.

Related Commands:

show ntp associations

© Cisco Systems, Inc. 2001, 2002


Command:

show key chain

Mode:

Router>

Syntax:

show key chain [name-of-chain]

Syntax Description:

name-of-chain | (Optional) Name of the key chain to display, as named in the key chain command.
column1 row 2 | column 2 row2

Command Description:

To display authentication key information, use the show key chain command in EXEC mode.

Example:

The following is sample output from the show key chain command:

Router#show key chain
Key-chain trees:
key 1 -- text "chestnut"
accept lifetime (always valid) - (always valid) [valid now]
send lifetime (always valid) - (always valid) [valid now]
key 2 -- text "birch"
accept lifetime (00:00:00 Dec 5 1995) - (23:59:59 Dec 5 1995)
send lifetime (06:00:00 Dec 5 1995) - (18:00:00 Dec 5 1995)

Misconceptions:

None.

Related Commands:

accept-lifetime

key

key chain

key-string (authentication)

send-lifetime

© Cisco Systems, Inc. 2001, 2002


Command:

mls qos cos

Mode:

Switch(config-if)#

Syntax:

mls qos cos {default-cos | override}
no mls qos cos {default-cos | override}

Syntax Description:

default-cos | Assign a default CoS value to a port. If the port is CoS trusted and packets are untagged, the default CoS value becomes a CoS value used to select one output queue to index into the CoS-to-Differentiated Services Code Point (DSCP) map. The CoS range is 0 to 7.
override | Override the CoS of the incoming packets, and apply the default CoS value on the port to all incoming packets.

Command Description:

Use the mls qos cos interface configuration command to define the default class of service (CoS) value of a port or to assign the default CoS to all incoming packets on the port. Use the no form of this command to return to the default setting.

The default CoS value for a port is 0.

CoS override is disabled by default.

You can use the default value to assign CoS and DSCP values to all packets entering a port if the port has been configured by using the override keyword.

Use the override keyword when all incoming packets on certain ports deserve higher or lower priority than packets entering from other ports. Even if a port was previously set to trust DSCP or CoS, this command overrides that trust state, and all the incoming CoS values are assigned the default CoS value configured with the mls qos cos command. If an incoming packet is tagged, the CoS value of the packet is modified with the default CoS of the port at the ingress port.

Example:

This example shows how to configure the default port CoS to 4:

Switch(config)#interface gigabitethernet 0/1
Switch(config-if)#mls qos trust cos
Switch(config-if)#mls qos cos 4

This example shows how to assign all the packets entering a port to the default port CoS value of 4:

Switch(config)#interface gigabitethernet 0/1
Switch(config-if)#mls qos cos 4
Switch(config-if)#mls qos cos override

You can verify your settings by entering the show mls qos interface privileged EXEC command.

Misconceptions:

None

Related Commands:

mls qos map
mls qos trust


Command:

mls qos map

Mode:

Switch(config)#

Syntax:

mls qos map {cos-dscp dscp1...dscp8 | dscp-cos dscp-list to cos}
no mls qos map {cos-dscp | dscp-cos}

Syntax Description:

cos-dscp dscp1...dscp8 Define the CoS-to-DSCP map.

For dscp1...dscp8, enter eight DSCP values that correspond to CoS values

0 to 7. Separate each DSCP value with a space.

The supported DSCP values are 0, 8, 10, 16, 18, 24, 26, 32, 34, 40, 46, 48, and 56.

dscp-list to cos Define the DSCP-to-CoS map.

For dscp-list, enter up to 13 DSCP values separated by spaces. Then enter the to keyword. The supported DSCP values are 0, 8, 10, 16, 18, 24, 26, 32, 34, 40, 46, 48, and 56.

For cos, enter the CoS value to which the DSCP values correspond. The CoS range is 0 to 7.

Command Description:

Use the mls qos map global configuration command to define the class of service (CoS)-to-Differentiated Services Code Point (DSCP) map or DSCP-to-CoS map. Use the no form of this command to return to the default map.

This command is available only if your switch is running the enhanced software image (EI).

Default CoS-to-DSCP Map
CoS Value | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7
DSCP Value | 0 | 8 | 16 | 24 | 32 | 40 | 48 | 56

Default DSCP-to-CoS Map
DSCP Value | 0 | 8,10 | 16,18 | 24,26 | 32,34 | 40,46 | 48 | 56
CoS Value | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7

All the maps are globally defined. You apply all maps to all ports.

If you enter the mls qos trust cos command, the default CoS-to-DSCP map is applied.

If you enter the mls qos trust dscp command, the default DSCP-to-CoS map is applied.

After a default map is applied, you can define the CoS-to-DSCP or DSCP-to-CoS map by entering consecutive mls qos map commands.

The supported DSCP values are 0, 8, 10, 16, 18, 24, 26, 32, 34, 40, 46, 48, and 56. If the mls qos trust dscp command is entered and a packet with an untrusted DSCP value is at an ingress port, the packet CoS value is set to 0.

Example:

This example shows how to define the DSCP-to-CoS map. DSCP values 16, 18, 24, and 26 are mapped to CoS 1. DSCP values 0, 8, and 10 are mapped to CoS 0.

Switch# configure terminal

Switch(config)# mls qos map dscp-cos 16 18 24 26 to 1

Switch(config)# mls qos map dscp-cos 0 8 10 to 0

This example shows how to define the CoS-to-DSCP map. CoS values 0 to 7 are mapped to DSCP values 8, 8, 8, 8, 24, 32, 56, and 56.

Switch# configure terminal

Switch(config)# mls qos map cos-dscp 8 8 8 8 24 32 56 56

You can verify your settings by entering the show mls qos maps privileged EXEC command.

Misconceptions:

The switches do not support the dscp-mutation, dscp-switch-priority, ip-prec-dscp, and policed-dscp options.

Related Commands:

mls qos cos
mls qos trust


Command:

mls qos trust

Mode:

Switch(config-if)#

Syntax:

mls qos trust [cos [pass-through dscp] | device cisco-phone | dscp]
no mls qos trust [cos [pass-through dscp] | device cisco-phone | dscp]

Syntax Description:

cos | (Optional) Classify ingress packets with packet CoS values. For untagged packets, the port default CoS value is used.
cos pass-through dscp | (Optional) Configure the interface to classify ingress packets by trusting the CoS value and to send packets without modifying the DSCP value (pass-through mode).
device cisco-phone | (Optional) Classify ingress packets by trusting the value sent from the Cisco IP phone (trusted boundary).
dscp | (Optional) Classify ingress packets with packet DSCP values (most significant 6 bits of the 8-bit service-type field). For non-IP packets, the packet CoS value is set to 0. This keyword is available only if your switch is running the enhanced software image (EI).

Command Description:

Use the mls qos trust interface configuration command to configure the port trust state. Ingress traffic can be trusted, and classification is performed by examining the class of service (CoS) or the Differentiated Services Code Point (DSCP) value. Use the no form of this command to return a port to its untrusted state.

Defaults:
The port is not trusted.
Pass-through mode is disabled.
Trusted boundary is disabled.
If no keyword is specified and the switch is running the EI, the default is dscp.

Packets entering a quality of service (QoS) domain are classified at the edge of the QoS domain. When the packets are classified at the edge, the switch port within the QoS domain can be configured to one of the trusted states because there is no need to classify the packets at every switch within the domain. Use this command to specify whether the port is trusted and which fields of the packet to use to classify traffic.

When a port is configured with trust DSCP and the incoming packet is a tagged non-IP packet, the CoS value for the packet is set to 0, and the DSCP-to-CoS map is not applied. For an untagged non-IP packet, the default port CoS value is used.

If DSCP is trusted, the DSCP field of the IP packet is not modified. However, it is still possible that the CoS value of the packet is modified (according to the DSCP-to-CoS map).

If CoS is trusted, the CoS of the packet is not modified, but DSCP can be modified (according to the CoS-to-DSCP map) if it is an IP packet.

To return a port to the untrusted state, use the no mls qos trust interface configuration command.

The trusted boundary feature prevents security problems if users disconnect their PCs from networked Cisco IP phones and connect them into the switch port to take advantage of trusted CoS settings. You must globally enable the Cisco Discovery Protocol (CDP) on both the switch and on the interface connected to the IP phone. If the phone is not detected, trusted boundary disables the trust setting on the switch port and prevents misuse of a high-priority queue.

If trusted boundary is enabled and the no mls qos trust command is entered, the port returns to the untrusted state and cannot be configured to trust if it is connected to a Cisco IP phone.

To disable trusted boundary, use the no mls qos trust device interface configuration command.

In software releases earlier than Release 12.1(11)EA1, the switch is in pass-through mode. It uses the CoS value of incoming packets without modifying the DSCP value and sends the packets from one of the four egress queues. You cannot enable or disable pass-through mode if your switch is running a software release earlier than Release 12.1(11)EA1.

In Release 12.1(11)EA1 or later, pass-through mode is disabled by default. The switch assigns a CoS value of 0 to all incoming packets without modifying the packets. It offers best-effort service to each packet regardless of the packet contents or size and sends it from a single egress queue.

You can enable pass-through mode on a switch running Release 12.1(11)EA1 or later by using the mls qos trust cos pass-through dscp interface configuration command. To disable pass-through mode, use the no mls qos trust cos pass-through interface configuration command.

Example:

This example shows how to configure a port to be a DSCP-trusted port:

Switch(config)# interface gigabitethernet0/1

Switch(config-if)# mls qos trust dscp

This example shows how to specify that the Cisco IP phone is a trusted device:

Switch(config)# interface fastethernet0/1

Switch(config-if)# mls qos trust device cisco-phone

This example shows how to configure the interface to trust the CoS of incoming packets and to send them without modifying the DSCP field:

Switch(config)# interface fastethernet0/1

Switch(config-if)# mls qos trust cos pass-through dscp

You can verify your settings by entering the show mls qos interface privileged EXEC command.

Misconceptions:

In software releases earlier than Release 12.1(11)EA1, the mls qos trust command is available only when the switch is running the EI

Related Commands:

mls qos cos
mls qos map


 Command:

mls rp ip

Mode:

Router(config)#

Syntax:

mls rp ip

no mls rp ip

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable Multilayer Switching Protocol (MLSP), use the mls rp ip global configuration command. MLSP is the protocol that runs between the switches and routers. Use the no form of this command to disable MLS.

Use this command to enable Multilayer Switching, either globally or on a specific interface.
Example:
Router(config)#mls rp ip
Misconceptions:
None

Related Commands:
mls rp management-interface
mls rp vlan-id
mls rp vtp-domain


 Command:

mls rp management-interface

Mode:

Router(config-if)#

Syntax:

mls rp management-interface

no mls rp management-interface

Syntax Description:

This command has no arguments or keywords.

Command Description:

To designate an interface as the management interface for MLSP packets, use the mls rp management-interface interface configuration command. Use the no version of the command to remove an interface as the management interface.

Use this command to designate an interface as the MLSP management interface. You must specify a router interface as a management interface. If you do not specify an interface, MLSP packets will not be sent or received.

The management interface can be any MLS interface connected to the Catalyst 5000 series switch. Specifying more than one interface is not necessary.
Example:

The following example sets the current interface as the management interface:

Router(config-if)#mls rp management-interface
Misconceptions:
None

Related Commands:
mls rp ip
mls rp vlan-id
mls rp vtp-domain


 Command:

mls rp vlan-id

Mode:

Router(config-if)#

Syntax:

mls rp vlan-id vlan-id-num

Syntax Description:

vlan-id-num

VLAN identification number.

Command Description:

To assign a VLAN ID, use the mls ip vlan-id interface configuration command.

Use this command to assign a VLAN ID to an interface. RSM VLAN interfaces or ISL-encapsulated interfaces do not require the VLAN ID to be assigned.

Example:

The following example assigns a VLAN ID of 23 to the current interface:

Router(config-if)#mls rp vlan-id 23

Misconceptions:
None

Related Commands:
mls rp ip
mls rp management-interface
mls rp vtp-domain


 Command:

mls rp vtp-domain

Mode:

Router(config-if)#

Syntax:

mls rp vtp-domain domain-name

Syntax Description:

domain-name

VTP domain name

Command Description:

To select the router interface to be Layer 3 switched and then add that interface to a VLAN Trunking Protocol (VTP) domain, use the mls rp vtp-domain interface configuration command.

This command is required only if the Catalyst switch is in a VTP domain. For an ISL interface, you can enter this command only on the primary interface. All subinterfaces that are part of the primary interface inherit the primary's VTP domain.
Example:

The following example adds the interface to the engineering VTP domain:

Router(config-if)#mls rp vtp-domain engineering
Misconceptions:
None

Related Commands:
mls rp ip
mls rp vlan-id
mls rp management-interface


Command:

area

Mode:

Router(config-router)#

Syntax:

area area-id { authentication [message-digest] | stub [no-summary] | nssa [no-redistribution] [default-information-originate] | default-cost cost | range address mask [advertise | not-advertise] | virtual-link router-id }

no area area-id [ authentication [message-digest] | stub [no-summary] | nssa [no-redistribution] [default-information-originate] | default-cost cost | range address mask [advertise | not-advertise] | virtual-link router-id ]

Syntax Description:

authentication

Enables authentication for an OSPF area

stub

Specifies a stub area to reduce routing overhead. To further reduce the number of link state advertisements (LSA) sent into a stub area, you can configure no-summary on the ABR to prevent it from sending summary LSAs (LSA type 3) into the stub area.

nssa

Specifies a not-so-stubby area. A not-so-stubby area provides the benefits of a stub area, while allowing the router to import external routes.

default-cost

Specifies a cost for the default summary route sent into a stub area

range

Use to consolidate and summarize routes at an area boundary

virtual-link

In OSPF, all areas must be connected to a backbone area (area 0). If the connection to the backbone is lost, it can be repaired by establishing a virtual link.

Command Description:

Use the area command to configure area parameters such as authentication and summarization.

Example:

Router(config-router)#area 2 range 192.168.0.1 255.255.240.0

Misconceptions:

None

Related Commands:

None


Command:

auto-cost

Mode:

Router(config-router)#

Syntax:

auto-cost reference-bandwidth ref-bw
no auto-cost reference-bandwidth

Syntax Description:

reference-bandwidth ref-bw

Rate in Mbps (bandwidth). The range is from 1 to 4294967; the default is 100.

Command Description:

To control how OSPF calculates default metrics for the interface, use the auto-cost command in router configuration mode. To assign cost based only on the interface type, use the no form of this command.

In Cisco IOS Release 10.3 and later releases, by default OSPF will calculate the OSPF metric for an interface according to the bandwidth of the interface. For example, a 64K link will get a metric of 1562, and a T1 link will have a metric of 64.

The OSPF metric is calculated as the ref-bw value divided by the bandwidth, with ref-bw equal to 108 by default, and bandwidth determined by the bandwidth command. The calculation gives FDDI a metric of 1.

If you have multiple links with high bandwidth (such as FDDI or ATM), you might want to use a larger number to differentiate the cost on those links.

The value set by the ip ospf cost command overrides the cost resulting from the auto-cost command.

Example:

The following example changes the cost of the FDDI link to 10, while the gigabit Ethernet link remains at a cost of 1. Thus, the link costs are differentiated:

Router(config-router)#auto-cost reference-bandwidth 1000

Misconceptions:

None

Related Commands:

ip ospf cost


Command:

clear ip ospf

Mode:

Router#

Syntax:

clear ip ospf [pid] {process | redistribution | counters [neighbor [intf] [nbr-id]]}

Syntax Description:

pid

(Optional) Process ID.

process

Reset OSPF process.

redistribution

Clear OSPF route redistribution.

counters

OSPF counters.

neighbor

Neighbor statistics per interface.

intf

Neighbor interface.

nbr-id

Neighbor ID.

Command Description:

To clear OSPF statistics, or to clear redistribution based on the OSPF routing process ID, use the clear ip ospf EXEC command.

Example:

Router#clear ip ospf process

Misconceptions:

None

Related Commands:

clear ip route

show ip ospf


Command:

clear ip route

Mode:

Router#

Syntax:

clear ip route {network [mask] | * }

Syntax Description:

network

Network or subnet address to remove.

mask

(Optional) Subnet address to remove.

*

Removes all routing table entries.

Command Description:

This command removes a route from the IP routing table

Example:

Router#clear ip route *

Misconceptions:

None

Related Commands:

None


Command:

compatible rfc1583

Mode:

Router(config-router)#

Syntax:

compatible rfc1583
no compatible rfc1583

Syntax Description:

This command has no arguments or keywords.

Command Description:

To restore the method used to calculate summary route costs per RFC 1583, use the compatible rfc1583 command in router configuration mode. To disable RFC 1583 compatibility, use the no form of this command.

This command is backward compatible with Cisco IOS Release 12.0.

To minimize the chance of routing loops, all OSPF routers in an OSPF routing domain should have RFC compatibility set identically.

Because of the introduction of RFC 2328, OSPF Version 2, the method used to calculate summary route costs has changed. Use the no compatible rfc1583 command to enable the calculation method used per RFC 2328.

Example:

The following example specifies that the router process is compatible with RFC 1583:

Router(config)# router ospf 1
Router(config-router)# compatible rfc1583

Misconceptions:

None

Related Commands:

None


Command:

default-metric (OSPF)

Mode:

Router(config-router)#

Syntax:

default-metric metric-value
no default-metric metric-value

Syntax Description:

metric-value Default metric value appropriate for the specified routing protocol.

Command Description:

To set default metric values for the OSPF routing protocol, use the default-metric command in router configuration mode. To return to the default state, use the no form of this command.

The default-metric command is used in conjunction with the redistribute router configuration command to cause the current routing protocol to use the same metric value for all redistributed routes. A default metric helps solve the problem of redistributing routes with incompatible metrics. Whenever metrics do not convert, using a default metric provides a reasonable substitute and enables the redistribution to proceed.

Example:

The following example shows a router in autonomous system 109 using both the Routing Information Protocol (RIP) and the OSPF routing protocols. The example advertises OSPF-derived routes using RIP and assigns the Internal Gateway Routing Protocol (IGRP)-derived routes a RIP metric of 10.

Router(config)#router rip
Router(config-router)#default-metric 10
Router(config-router)#redistribute ospf 109

Misconceptions:

The default metric command does not affect EIGRP-to-EIGRP or IGRP-to-EIGRP distribution. To configure EIGRP-to-EIGRP or IGRP-to-EIGRP distribution, use route maps.

Related Commands:

redistribute


Command:

distance ospf

Mode:

Router(config-router)#

Syntax:

distance ospf {[intra-area dist1] [inter-area dist2] [external dist3]}
no distance ospf

Syntax Description:

intra-area dist1 | (Optional) Sets the distance for all routes within an area. The default value is 110.
inter-area dist2 | (Optional) Sets the distance for all routes from one area to another area. The default value is 110.
external dist3 | (Optional) Sets the distance for routes from other routing domains, learned by redistribution. The default value is 110.

Command Description:

To define OSPF route administrative distances based on route type, use the distance ospf command in router configuration mode. To restore the default value, use the no form of this command.

Defaults:

dist1: 110

dist2: 110

dist3: 110

You must specify at least one of the keyword-argument pairs.

This command performs the same function as the distance command used with an access list. However, the distance ospf command allows you to set a distance for an entire group of routes, rather than a specific route that passes an access list.

A common reason to use the distance ospf command is when you have multiple OSPF processes with mutual redistribution, and you want to prefer internal routes from one over external routes from the other.

Example:

The following example changes the external distance to 200, making the route less reliable:

Router A Configuration

Router(config)# router ospf 1
Router(config-router)# redistribute ospf 2 subnet
Router(config-router)# distance ospf external 200
!
Router(config)# router ospf 2
Router(config-router)# redistribute ospf 1 subnet
Router(config-router)# distance ospf external 200

Router B Configuration

Router(config)# router ospf 1
Router(config-router)# redistribute ospf 2 subnet
Router(config-router)# distance ospf external 200
!
Router(config)# router ospf 2
Router(config-router)# redistribute ospf 1 subnet
Router(config-router)# distance ospf external 200

Misconceptions:

None

Related Commands:

None


Command:

ignore lsa mospf

Mode:

Router(config-router)#

Syntax:

ignore lsa mospf
no ignore lsa mospf

Syntax Description:

This command has no arguments or keywords.

Command Description:

To suppress the sending of syslog messages when the router receives link-state advertisement (LSA) Type 6 Multicast OSPF (MOSPF) packets, which are unsupported, use the ignore lsa mospf command in router configuration mode. To restore the sending of syslog messages, use the no form of this command.

This command is disabled by default. Each MOSPF packet causes the router to send a syslog message.

Cisco routers do not support LSA Type 6 MOSPF packets, and they generate syslog messages if they receive such packets. If the router is receiving many MOSPF packets, you might want to configure the router to ignore the packets and thus prevent a large number of syslog messages.

Example:

The following example configures the router to suppress the sending of syslog messages when it receives MOSPF packets:

Router(config)# router ospf 109
Router(config-router)# ignore lsa mospf

Misconceptions:

None

Related Commands:

None


 Command:

ip ospf authentication-key

Mode:

Router(config-if)#

Syntax:

ip ospf authentication-key password

no ip ospf authentication-key

Syntax Description:

password

Any continuous string of characters that can be entered from the keyboard up to 8 bytes in length.

Command Description:

To assign a password to be used by neighboring routers that are using OSPF's simple password authentication, use the ip ospf authentication-key interface configuration command. To remove a previously assigned OSPF password, use the no form of this command.

The password created by this command is used as a "key" that is inserted directly into the OSPF header when the Cisco IOS software originates routing protocol packets. A separate password can be assigned to each network on a per-interface basis. All neighboring routers on the same network must have the same password to be able to exchange OSPF information.
Example:

The following example enables the authentication key with the string yourpass:

Router(config-if)#ip ospf authentication-key yourpass

Misconceptions:

The Cisco IOS software will use this key only when authentication is enabled for an area with the area authentication router configuration command.

Related Commands:
None


 Command:

ip ospf cost

Mode:

Router(config-if)#

Syntax:

ip ospf cost cost

no ip ospf cost

Syntax Description:
cost Unsigned integer value expressed as the link state metric. It can be a value in the range 1 to 65535.

Command Description:

To explicitly specify the cost of sending a packet on an interface, use the ip ospf cost interface configuration command. To reset the path cost to the default value, use the no form of this command.

Example:
Router(config-if)#ip ospf cost  65

Misconceptions:
None

Related Commands:
None


Command:

ip ospf database-filter all out

Mode:

Router(config-if)#

Syntax:

ip ospf database-filter all out
no ip ospf database-filter all out

Syntax Description:

This command has no arguments or keywords.

Command Description:

To filter outgoing link-state advertisements (LSAs) to an OSPF interface, use the ip ospf database-filter all out command in interface configuration mode. To restore the forwarding of LSAs to the interface, use the no form of this command.

This command performs the same function that the neighbor database-filter command performs on a neighbor basis.

This command is disabled by default. All outgoing LSAs are flooded to the interface.

Example:

The following example prevents flooding of OSPF LSAs to broadcast, nonbroadcast, or point-to-point networks reachable through Ethernet interface 0:

Router(config-if)#interface ethernet 0
Router(config-if)#ip ospf database-filter all out

Misconceptions:

None

Related Commands:

neighbor database-filter


 Command:

ip ospf dead-interval

Mode:

Router(config-if)#

Syntax:

ip ospf dead-interval seconds

no ip ospf dead-interval

Syntax Description:
 seconds Length of the ospf dead interval in seconds

Command Description:

To set how long hello packets must not have been seen before its neighbors declare the router down, use the ip ospf dead-interval interface configuration command.

Example:
Router(config-if)#ip ospf dead-interval  60

Misconceptions:
None

Related Commands:
None


Command:

ip ospf demand-circuit

Mode:

Router(config-if)#

Syntax:

ip ospf demand-circuit
no ip ospf demand-circuit

Syntax Description:

This command has no arguments or keywords.

Command Description:

To configure OSPF to treat the interface as an OSPF demand circuit, use the ip ospf demand-circuit command in interface configuration mode. To remove the demand circuit designation from the interface, use the no form of this command.

On point-to-point interfaces, only one end of the demand circuit must be configured with this command. Periodic hello messages are suppressed and periodic refreshes of link-state advertisements (LSAs) do not flood the demand circuit. This command allows the underlying data link layer to be closed when the topology is stable. In point-to-multipoint topology, only the multipoint end must configured with this command.

The circuit is not a demand circuit by default.

Example:

The following example configures the BRI 0/0 interface as a demand-circuit:

Router(config)#interface bri 0/0
Router(config-if)#ip ospf demand-circuit

Misconceptions:

A common misconception is that this command is the only command necessary to efficiently run OSPF over an ISDN line. Care should also be taken to ensure that OSPF topology rules are followed when an ISDN line is up. The router should also be configured and monitored to ensure that the OSPF cost of an ISDN interface does not change due to PPP multilink. Without proper configuration, it is possible for a router to continuously dial an ISDN interface in order to send unnecessary LSAs.

Related Commands:

ip ospf hello-interval


Command:

ip ospf flood-reduction

Mode:

Router(config-if)#

Syntax:

ip ospf flood-reduction
no ip ospf flood-reduction

Syntax Description:

This command has no arguments or keywords.

Command Description:

By default, OSPF routers refresh their LSAs by flooding them every thirty minutes. If the topology has not changed, then this flooding can cause unnecessary congestion.

This command is disabled by default.

All routers supporting the OSPF demand circuit are compatible and can interact with routers supporting flooding reduction.

Example:

The following example reduces the flooding of unnecessary LSAs on serial interface 0:

Router(config-if)#interface serial 0
Router(config-if)#ip ospf flood-reduction

Misconceptions:

None

Related Commands:

show ip ospf interface show ip ospf neighbor


 Command:

ip ospf hello-interval

Mode:

Router(config-if)#

Syntax:

ip ospf hello-interval seconds

no ip ospf hello-interval

Syntax Description:

seconds

The OSPF hello-interval in seconds

Command Description:

To specify the interval between hello packets that the Cisco IOS software sends on the interface, use the ip ospf hello-interval interface configuration command.

Example:

Router(config-if)#ip ospf hello-interval 15

Misconceptions:
None

Related Commands:
None


 Command:

ip ospf message-digest-key

Mode:

Router(config-if)#

Syntax:

ip ospf message-digest-key key-id md5 key

no ip ospf message-digest-key key-id

Syntax Description:

key-id

An identifier in the range from 1 to 255

key

Alphanumeric password of up to 16 bytes

Command Description:

To enable OSPF Message Digest 5 (MD5) authentication, use the ip ospf message-digest-key interface configuration command. To remove an old MD5 key, use the no form of this command.

Usage Guidelines:

Usually, one key per interface is used to generate authentication information when sending packets and to authenticate incoming packets. The same key identifier on the neighbor router must have the same key value.

The process of changing keys is as follows. Suppose the current configuration is as follows:

interface ethernet 1
 ip ospf message-digest-key 100 md5 OLD

You change the configuration to the following:

interface ethernet 1
 ip ospf message-digest-key 101 md5 NEW

The system assumes its neighbors do not have the new key yet, so it begins a rollover process. It sends multiple copies of the same packet, each authenticated by different keys. In this example, the system sends out two copies of the same packet—the first one authenticated by key 100 and the second one authenticated by key 101.

Rollover allows neighboring routers to continue communication while the network administrator is updating them with the new key. Rollover stops once the local system finds that all its neighbors know the new key. The system detects that a neighbor has the new key when it receives packets from the neighbor authenticated by the new key.

After all neighbors have been updated with the new key, the old key should be removed. In this example, you would enter the following:

interface ethernet 1
 no ip ospf message-digest-key 100

Then, only key 101 is used for authentication on Ethernet interface 1.

It is good practice not to keep more than one key per interface. Every time you add a new key, you should remove the old key to prevent the local system from continuing to communicate with a hostile system that knows the old key. Removing the old key also reduces overhead during rollover.
Example:

The following example sets a new key 19 with the password 8ry4222:

Router(config)#interface ethernet 1
Router(config-if)#ip ospf message-digest-key 10 md5 xvv560qle
Router(config-if)#ip ospf message-digest-key 19 md5 8ry4222

Misconceptions:
None

Related Commands:
None


Command:

ip ospf mtu-ignore

Mode:

Router(config-if)#

Syntax:

ip ospf mtu-ignore
no ip ospf mtu-ignore

Syntax Description:

This command has no arguments or keywords.

Command Description:

To disable OSPF MTU mismatch detection on receiving DBD packets, use the ip ospf mtu-ignore command in interface configuration mode. To reset to default, use the no form of this command.

OSPF checks whether neighbors are using the same MTU on a common interface. This check is performed when neighbors exchange Database Descriptor (DBD) packets. If the receiving MTU in the DBD packet is higher than the IP MTU configured on the incoming interface, OSPF adjacency will not be established.

Example:

The following example disables MTU mismatch detection on receiving DBD packets:

Router(config)#interface serial 0/0
Router(config-if)#ip ospf mtu-ignore

Misconceptions:

None

Related Commands:

None


Command:

ip ospf name-lookup

Mode:

Router(config)#

Syntax:

ip ospf name-lookup
no ip ospf name-lookup

Syntax Description:

This command has no arguments or keywords.

Command Description:

To configure OSPF to look up Domain Name System (DNS) names for use in all OSPF show EXEC command displays, use the ip ospf name-lookup command in global configuration mode. To disable this function, use the no form of this command.

This command makes it easier to identify a router because the router is displayed by name rather than by its router ID or neighbor ID.

Example:

The following example configures OSPF to look up DNS names for use in all OSPF show EXEC command displays:

Router(config)# ip ospf name-lookup

Misconceptions:

None

Related Commands:

None


 Command:

ip ospf network

Mode:

Router(config-if)#

Syntax:

ip ospf network {broadcast  | non-broadcast  | {point-to-multipoint [non-broadcast ]}}

no ip ospf network

Syntax Description:
broadcast | Sets the network type to broadcast
non-broadcast | Sets the network type to NBMA
point-to-multipoint | Sets the network type to point-to-multipoint
non-broadcast

Sets the point-to-multipoint network to be nonbroadcast. If you use the non-broadcast keyword, the neighbor command is required.
Command Description:

To configure the OSPF network type to a type other than the default for a given media, use the ip ospf network interface configuration command. To return to the default value, use the no form of this command.

Example:
Router(config-if)#ip ospf network non-broadcast

Misconceptions:
None

Related Commands:
None


 Command:

ip ospf priority

Mode:

Router(config-if)#

Syntax:

ip ospf priority number

Syntax Description:
number 8-bit unsigned integer that specifies the priority. The range is from 0 to 255.

Command Description:

To set the router priority, which helps determine the designated router for this network, use the ip ospf priority interface configuration command. To return to the default value, use the no form of this command.

Example:
Router(config-if)#ip ospf priority  100

Misconceptions:
None

Related Commands:
None


Command:

ip ospf retransmit-interval

Mode:

Router(config-if)#

Syntax:

ip ospf retransmit-interval seconds
no ip ospf retransmit-interval

Syntax Description:

seconds Time (in seconds) between retransmissions. It must be greater than the expected round-trip delay between any two routers on the attached network. The range is from 1 to 65535 seconds. The default is 5 seconds.

Command Description:

To specify the time between link-state advertisement (LSA) retransmissions for adjacencies belonging to the interface, use the ip ospf retransmit-interval command in interface configuration mode. To return to the default value, use the no form of this command.

When a router sends an LSA to its neighbor, it keeps the LSA until it receives back the acknowledgment message. If the router receives no acknowledgment, it will resend the LSA.

The setting of this parameter should be conservative, or needless retransmission will result. The value should be larger for serial lines and virtual links.

The default is 5 seconds.

Example:

The following example sets the retransmit interval value to 8 seconds:

Router(config)#interface ethernet 2
Router(config-if)#ip ospf retransmit-interval 8

Misconceptions:

None

Related Commands:

None


Command:

log-adjacency-changes

Mode:

Router(config-router)#

Syntax:

log-adjacency-changes [detail]
no log-adjacency-changes [detail]

Syntax Description:

detail (Optional) Sends a syslog message for each state change, not just when a neighbor goes up or down.

Command Description:

To configure the router to send a syslog message when an OSPF neighbor goes up or down, use the log-adjacency-changes command in router configuration mode. To turn off this function, use the no form of this command.

This command is enabled by default.

This command allows you to know about OSPF neighbors going up or down without turning on the debug ip ospf adjacency command. The log-adjacency-changes command provides a higher level view of those changes of the peer relationship with less output. This command is on by default but only up/down (full/down) events are reported, unless the detail keyword is also configured.

Example:

The following example configures the router to send a syslog message when an OSPF neighbor state changes:

Router(config-router)#log-adjacency-changes detail

Misconceptions:

None

Related Commands:

None


 Command:

network area

Mode:

Router(config-router)#

Syntax:

network address wildcard-mask area area-id

Syntax Description:

area

Specifies the area to associate with the network address

Command Description:

To define the interfaces on which OSPF runs and to define the area ID for those interfaces, use the network area router configuration command.

Example:

Router(config)#network 131.108.0.0 0.0.255.255 area 2
Misconceptions:
None

Related Commands:
None


 Command:

router ospf

Mode:

Router(config)#

Syntax:

router ospf process-id

Syntax Description:
process-id Internally used identification parameter for an OSPF routing process. It is locally assigned and can be any positive integer. A unique value is assigned for each OSPF routing process.

Command Description:

To configure an OSPF routing process, use the router ospf global configuration command. To terminate an OSPF routing process, use the no form of this command.

Example:
Router(config)#router ospf 1

Misconceptions:
None

Related Commands:
show ip ospf


Command:

router-id

Mode:

Router(config-router)#

Syntax:

router-id ip-address
no router-id ip-address

Syntax Description:

ip-address Router ID in IP address format.

Command Description:

To use a fixed router ID, use the router-id command in router configuration mode. To force OSPF to use the previous OSPF router ID behavior, use the no form of this command.

You can configure an arbitrary value in the IP address format for each router. However, each router ID must be unique.

If this command is used on an OSPF router process which is already active (has neighbors), the new router-ID is used at the next reload or at a manual OSPF process restart. To manually restart the OSPF process, use the clear ip ospf command.

Example:

The following example specifies a fixed router-id:

Router(config-router)# router-id 10.1.1.1

Misconceptions:

None

Related Commands:

clear ip ospf
router ospf


Command:

timers lsa-group-pacing

Mode:

Router(config-router)#

Syntax:

timers lsa-group-pacing seconds
no timers lsa-group-pacing

Syntax Description:

seconds Number of seconds in the interval at which LSAs are grouped and refreshed, checksummed, or aged. The range is from 10 to 1800 seconds. The default value is 240 seconds.

Command Description:

To change the interval at which OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged, use the timers lsa-group-pacing command in router configuration mode. To restore the default value, use the no form of this command.

OSPF LSA group pacing is enabled by default. For typical customers, the default group pacing interval for refreshing, checksumming, and aging is appropriate and you need not configure this feature.

The duration of the LSA group pacing is inversely proportional to the number of LSAs the router is handling. For example, if you have about 10,000 LSAs, decreasing the pacing interval would benefit you. If you have a very small database (40 to 100 LSAs), increasing the pacing interval to 10 to 20 minutes might benefit you slightly.

Example:

The following example changes the OSPF pacing between LSA groups to 60 seconds:

Router(config)#router ospf
Router(config-router)#timers lsa-group-pacing 60

Misconceptions:

None

Related Commands:

None


Command:

timers spf

Mode:

Router(config-router)#

Syntax:

timers spf spf-delay spf-holdtime
no timers spf spf-delay spf-holdtime

Syntax Description:

spf-delay | Delay time (in seconds) between when OSPF receives a topology change and when it starts an SPF calculation. It can be an integer from 0 to 65535. The default time is 5 seconds. A value of 0 means that there is no delay; that is, the SPF calculation is started immediately.
spf-holdtime | Minimum time (in seconds) between two consecutive SPF calculations. It can be an integer from 0 to 65535. The default time is 10 seconds. A value of 0 means that there is no delay; that is, two SPF calculations can be done, one immediately after the other.

Command Description:

To configure the delay time between when OSPF receives a topology change and when it starts a shortest path first (SPF) calculation, and the hold time between two consecutive SPF calculations, use the timers spf command in router configuration mode. To return to the default timer values, use the no form of this command.

Setting the delay and hold time low causes routing to switch to the alternate path more quickly in the event of a failure. However, it requires the router to use more CPU processing time.

Example:

The following example changes the delay to 10 seconds and the hold time to 20 seconds:

Router(config-router)#timers spf 10 20

Misconceptions:

None

Related Commands:

None


Command:

show ip ospf database

Mode:

Router>

Syntax:

show ip ospf [process-id [area-id]] database

show ip ospf [process-id [area-id]] database [adv-router [ip-address]]

show ip ospf [process-id [area-id]] database [asbr-summary] [link-state-id]

show ip ospf [process-id [area-id]] database [asbr-summary] [link-state-id] [adv-router [ip-address]]

show ip ospf [process-id [area-id]] database [asbr-summary] [link-state-id] [self-originate] [link-state-id]

show ip ospf [process-id [area-id]] database [database-summary]

show ip ospf [process-id [area-id]] database [external] [link-state-id]

show ip ospf [process-id [area-id]] database [external] [link-state-id] [adv-router [ip-address]]

show ip ospf [process-id [area-id]] database [external] [link-state-id] [self-originate] [link-state-id]

show ip ospf [process-id [area-id]] database [network] [link-state-id]

show ip ospf [process-id [area-id]] database [network] [link-state-id] [adv-router [ip-address]]

show ip ospf [process-id [area-id]] database [network] [link-state-id] [self-originate] [link-state-id]

show ip ospf [process-id [area-id]] database [nssa-external] [link-state-id]

show ip ospf [process-id [area-id]] database [nssa-external] [link-state-id] [adv-router [ip-address]]

show ip ospf [process-id [area-id]] database [nssa-external] [link-state-id] [self-originate] [link-state-id]

show ip ospf [process-id [area-id]] database [opaque-area] [link-state-id]

show ip ospf [process-id [area-id]] database [opaque-area] [link-state-id] [adv-router [ip-address]]

show ip ospf [process-id [area-id]] database [opaque-area] [link-state-id] [self-originate] [link-state-id]

show ip ospf [process-id [area-id]] database [opaque-as] [link-state-id]

show ip ospf [process-id [area-id]] database [opaque-as] [link-state-id] [adv-router [ip-address]]

show ip ospf [process-id [area-id]] database [opaque-as] [link-state-id] [self-originate] [link-state-id]

show ip ospf [process-id [area-id]] database [opaque-link] [link-state-id]

show ip ospf [process-id [area-id]] database [opaque-link] [link-state-id] [adv-router [ip-address]]

show ip ospf [process-id [area-id]] database [opaque-link] [link-state-id] [self-originate] [link-state-id]

show ip ospf [process-id [area-id]] database [router] [link-state-id]

show ip ospf [process-id [area-id]] database [router] [adv-router [ip-address]]

show ip ospf [process-id [area-id]] database [router] [self-originate] [link-state-id]

show ip ospf [process-id [area-id]] database [self-originate] [link-state-id]

show ip ospf [process-id [area-id]] database [summary] [link-state-id]

show ip ospf [process-id [area-id]] database [summary] [link-state-id] [adv-router [ip-address]]

show ip ospf [process-id [area-id]] database [summary] [link-state-id] [self-originate] [link-state-id]

Syntax Description:

process-id | (Optional) Internal identification. It is locally assigned and can be any positive integer. The number used here is the number assigned administratively when enabling the OSPF routing process.
area-id | (Optional) Area number associated with the OSPF address range defined in the network router configuration command used to define the particular area.
adv-router [ip-address] | (Optional) Displays all the link-state advertisements (LSAs) of the specified router. If no IP address is included, the information is about the local router itself (in this case, the same as the self-originate keyword).
asbr-summary | (Optional) Displays information only about the Autonomous System Boundary Router (ASBR) summary LSAs
link-state-id | (Optional) Portion of the Internet environment that is being described by the advertisement. The value entered depends on the type of the LSA. The value must be entered in the form of an IP address.
database-summary | (Optional) Displays how many of each type of LSA for each area there are in the database, and the total.
external | (Optional) Displays information only about the external LSAs.
network | (Optional) Displays information only about the network LSAs.
nssa-external | (Optional) Displays information only about the not so stubby area (NSSA) external LSAs.
opaque-area | (Optional) Displays information about the opaque Type 10 LSAs. Type 10 denotes an area-local scope. Refer to RFC 2370 for more information on the opaque LSA options.
opaque-as | (Optional) Displays information about the opaque Type 11 LSAs. Type 11 denotes that the LSA is flooded throughout the autonomous system.
opaque-link | (Optional) Displays information about the opaque Type 9 LSAs. Type 9 denotes a link-local scope.
router | (Optional) Displays information only about the router LSAs.
self-originate | (Optional) Displays only self-originated LSAs (from the local router).
summary | (Optional) Displays information only about the summary LSAs.

Command Description:

To display lists of information related to the OSPF database for a specific router, use the show ip ospf database command in EXEC mode. The various forms of this command deliver information about different OSPF link-state advertisements(LSAs).

Example:

The following is sample output from the show ip ospf database command when no arguments or keywords are used:

Router#show ip ospf database
OSPF Router with ID(192.168.1.11) (Process ID 1)
                 Router Link States(Area 0)
Link ID   ADV Router   Age   Seq# Checksum Link count
192.168.1.8 192.168.1.8 1381 0x8000010D    0xEF60 2
192.168.1.11 192.168.1.11 1460 0x800002FE    0xEB3D 4
192.168.1.12 192.168.1.12 2027 0x80000090    0x875D 3
192.168.1.27 192.168.1.27 1323 0x800001D6    0x12CC 3
                 Net Link States(Area 0)
Link ID ADV Router   Age   Seq# Checksum
172.16.1.27 192.168.1.27 1323 0x8000005B    0xA8EE
172.17.1.11 192.168.1.11 1461 0x8000005B    0x7AC
                 Type-10 Opaque Link Area Link States (Area 0)
Link ID ADV Router   Age Seq# Checksum Opaque ID
10.0.0.0 192.168.1.11 1461 0x800002C8    0x8483   0
10.0.0.0 192.168.1.12 2027 0x80000080    0xF858   0
10.0.0.0 192.168.1.27 1323 0x800001BC    0x919B   0
10.0.0.1 192.168.1.11 1461 0x8000005E    0x5B43   1

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip ospf flood-list

Mode:

Router>

Syntax:

show ip ospf flood-list interface-type interface-number

Syntax Description:

interface-type | Interface type over which the LSAs will be flooded.
interface-number | Interface number over which the LSAs will be flooded.

Command Description:

To display a list of OSPF link-state advertisements (LSAs) waiting to be flooded over an interface, use the show ip ospf flood-list command in EXEC mode. Use this command to observe OSPF packet pacing.

Example:

The following is sample output of the show ip ospf flood-list command:

Router#show ip ospf flood-list ethernet 1
Interface Ethernet1, Queue length 20
Link state flooding due in 12 msec
Type LS ID  ADV RTR   Seq NO Age Checksum
5 10.2.195.0 192.168.0.163 0x80000009 0 0xFB61
5 10.1.192.0 192.168.0.163 0x80000009 0 0x2938
5 10.2.194.0 192.168.0.163 0x80000009 0 0x757
5 10.1.193.0 192.168.0.163 0x80000009 0 0x1E42
5 10.2.193.0 192.168.0.163 0x80000009 0 0x124D
5 10.1.194.0 192.168.0.163 0x80000009 0 0x134C

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip ospf interface

Mode:

Router>

Syntax:

show ip ospf interface [interface-type interface-number]

Syntax Description:

interface-type | (Optional) Interface type.
interface-number | (Optional) Interface number.

Command Description:

To display OSPF-related interface information, use the show ip ospf interface command in EXEC mode.

Example:

The following is sample output of the show ip ospf interface command when Ethernet interface 0 is specified:

Router#show ip ospf interface ethernet 0
Ethernet 0 is up, line protocol is up
Internet Address 192.168.254.202, Mask 255.255.255.0, Area 0.0.0.0
AS 201, Router ID 192.77.99.1, Network Type BROADCAST, Cost: 10
Transmit Delay is 1 sec, State OTHER, Priority 1
Designated Router id 192.168.254.10, Interface address 192.168.254.10
Backup Designated router id 192.168.254.28, Interface addr 192.168.254.28
Timer intervals configured, Hello 10, Dead 60, Wait 40, Retransmit 5
Hello due in 0:00:05
Neighbor Count is 8, Adjacent neighbor count is 2
  Adjacent with neighbor 192.168.254.28 (Backup Designated Router)
  Adjacent with neighbor 192.168.254.10 (Designated Router)

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip ospf neighbor

Mode:

Router>

Syntax:

show ip ospf neighbor [interface-type interface-number] [neighbor-id] [detail]

Syntax Description:

interface-type | (Optional) Interface type.
interface-number | (Optional) Interface number.
neighbor-id | (Optional) Neighbor ID.
detail | (Optional) Displays all neighbors given in detail (list all neighbors).

Command Description:

To display OSPF-neighbor information on a per-interface basis, use the show ip ospf neighbor command in EXEC mode.

Example:

The following is sample output from the show ip ospf neighbor command showing a single line of summary information for each neighbor:

Router#show ip ospf neighbor

ID Pri State Dead Time Address Interface

10.199.199.137 1 FULL/DR 0:00:31 192.168.80.37 Ethernet0

172.16.48.1 1 FULL/DROTHER 0:00:33 172.16.48.1 Fddi0

172.16.48.200 1 FULL/DROTHER 0:00:33 172.16.48.200 Fddi0

10.199.199.137 5 FULL/DR 0:00:33 172.16.48.189 Fddi0

The following is sample output showing summary information about the neighbor that matches the neighbor ID:

Router#show ip ospf neighbor 10.199.199.137

Neighbor 10.199.199.137, interface address 192.168.80.37

In the area 0.0.0.0 via interface Ethernet0

Neighbor priority is 1, State is FULL

Options 2

Dead timer due in 0:00:32

Link State retransmission due in 0:00:04

Neighbor 10.199.199.137, interface address 172.16.48.189

In the area 0.0.0.0 via interface Fddi0

Neighbor priority is 5, State is FULL

Options 2

Dead timer due in 0:00:32

Link State retransmission due in 0:00:03

If you specify the interface along with the neighbor ID, the Cisco IOS software displays the neighbors that match the neighbor ID on the interface, as in the following sample display:

Router#show ip ospf neighbor ethernet 0 10.199.199.137

Neighbor 10.199.199.137, interface address 192.168.80.37

In the area 0.0.0.0 via interface Ethernet0

Neighbor priority is 1, State is FULL

Options 2

Dead timer due in 0:00:37

Link State retransmission due in 0:00:04

You can also specify the interface without the neighbor ID to show all neighbors on the specified interface, as in the following sample display:

Router#show ip ospf neighbor fddi 0

ID Pri State Dead Time Address Interface

172.16.48.1 1 FULL/DROTHER 0:00:33 172.16.48.1 Fddi0

172.16.48.200 1 FULL/DROTHER 0:00:32 172.16.48.200 Fddi0

5 FULL/DR 0:00:32 172.16.48.189 Fddi0

The following is sample output from the show ip ospf neighbor detail command:

Router#show ip ospf neighbor detail

Neighbor 192.168.5.2, interface address 10.225.200.28

In the area 0 via interface Ethernet1

Neighbor priority is 1, State is FULL, 6 state changes

DR is 10.225.200.28 BDR is 10.225.200.30

Options is 0x42

Dead timer due in 00:00:36

Neighbor is up for 00:09:46

Index 1/1, retransmission queue length 0, number of retransmission 1

First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0)

Last retransmission scan length is 1, maximum is 1

Last retransmission scan time is 0 msec, maximum is 0 msec

Table 17 describes the significant fields shown in the displays.

Table 17 show ip ospf neighbor detail Field Descriptions

Field | Description
Neighbor | Neighbor router ID.
interface address | IP address of the interface.
In the area | Area and interface through which the OSPF neighbor is known.
Neighbor priority | Router priority of the neighbor, neighbor state.
State | OSPF state.
state changes | Number of state changes since the neighbor was created.This value can be reset using the clear ip ospf counters neighbor command.
DR is | Router ID of the designated router for the interface.
BDR is | Router ID of the backup designated router for the interface.
Options | Hello packet options field contents. (E-bit only. Possible values are 0 and 2; 2 indicates area is not a stub; 0 indicates area is a stub.)
Dead timer | Expected time before Cisco IOS software will declare the neighbor dead.
Neighbor is up for | Number of hours:minutes:seconds since the neighbor went into 2-way state.
Index | Neighbor location in the area-wide and autonomous system-wide retransmission queue.
retransmission queue length | Number of elements in retransmission queue.
number of retransmission | Number of times update packets have been retransmitted during flooding.
First | Memory location of the flooding details.
Next | Memory location of the flooding details.
Last retransmission scan length | Number of LSAs in the last retransmission packet.
maximum | Maximum number of LSAs sent in any retransmission packet.
Last retransmission scan time | Time taken to build last retransmission packet.
maximum | Maximum time taken to build any retransmission packet.

Misconceptions:

None.

Related Commands:

None.


Command:

show ip ospf request-list

Mode:

Router>

Syntax:

dshow ip ospf request-list [neighbor] [interface] [interface-neighbor]

Syntax Description:

neighbor | (Optional) Displays the list of all LSAs requested by the router from this neighbor.
interface | (Optional) Displays the list of all LSAs requested by the router from this interface.
interface-neighbor | (Optional) Displays the list of all LSAs requested by the router on this interface, from this neighbor.

Command Description:

To display a list of all link-state advertisements (LSAs) requested by a router, use the show ip ospf request-list command in EXEC mode. The information displayed by the show ip ospf request-list command is useful in debugging OSPF routing operations.

Example:

The following is sample output from the show ip ospf request-list command:

Router#show ip ospf request-list serial 0
OSPF Router with ID (192.168.1.11) (Process ID 1)
Neighbor 192.168.1.12, interface Serial0 address 172.16.1.12
Type LS ID   ADV RTR   Seq NO Age Checksum
1 192.168.1.12 192.168.1.12 0x8000020D 8 0x6572

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip ospf retransmission-list

Mode:

Router>

Syntax:

show ip ospf retransmission-list [neighbor] [interface] [interface-neighbor]

Syntax Description:

neighbor | (Optional) Displays the list of all LSAs requested by the router from this neighbor.
interface | (Optional) Displays the list of all LSAs requested by the router from this interface.
interface-neighbor | (Optional) Displays the list of all LSAs requested by the router on this interface, from this neighbor.

Command Description:

To display a list of all link-state advertisements (LSAs) waiting to be resent, use the show ip ospf retransmission-list command in EXEC mode.

Example:

The following is sample output from the show ip ospf retransmission-list command:

Router#show ip ospf retransmission-list serial 0
OSPF Router with ID (192.168.1.12) (Process ID 1)
Neighbor 192.168.1.11, interface Serial0 address 172.16.1.11
Link state retransmission due in 3764 msec, Queue length 2
Type LS ID   ADV RTR   Seq NO Age Checksum
1 192.168.1.12 192.168.1.12 0x80000210 0 0xB196

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show ip ospf summary-address

Mode:

Router>

Syntax:

show ip ospf [process-id] summary-address

Syntax Description:

process-id (Optional) OSPF area ID.

Command Description:

To display a list of all summary address redistribution information configured under an OSPF process, use the show ip ospf summary-address command in EXEC mode. The process-id argument can be entered as a decimal number or as an IP address format.

Example:

The following is sample output from the show ip ospf summary-address command:

Router#show ip ospf summary-address
OSPF Process 2, Summary-address
10.2.0.0/255.255.0.0 Metric -1, Type 0, Tag 0
10.2.0.0/255.255.0.0 Metric -1, Type 0, Tag 10

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


show ip ospf

Command:

show ip ospf

Mode:

Router#

Syntax:

show ip ospf { [process-id] | border-routers | database | interface | virtual-links }

Syntax Description:

process-id | Displays information about a specific instance of OSPF, it is the same value specified by the router ospf command
border-routers | Displays the internal OSPF routing table entries to an area border router (ABR) and autonomous system boundary router (ASBR)
database | Displays lists of information related to the OSPF database for a specific router
interface | Display OSPF-related interface information, including timers, neighbor ID's, and network type, and area details
virtual-links | Displays parameters about and the current state of OSPF virtual links, including timers, and state of adjacency

Command Description:

Displays statistics and status information of running ospf processes.

Example:

Router#show ip ospf interface

Routing Process "ospf 201" with ID 192.42.110.200

Supports only single TOS(TOS0) route

It is an area border and autonomous system boundary router

Redistributing External Routes from,

      igrp 200 with metric mapped to 2, includes subnets in redistribution

      rip with metric mapped to 2

      igrp 2 with metric mapped to 100

      igrp 32 with metric mapped to 1

Number of areas in this router is 3

Area 192.42.110.0

      Number of interfaces in this area is 1

      Area has simple password authentication

      SPF algorithm executed 6 times

Misconceptions:

None

Related commands:

router ospf

debug all


Command:

callback forced-wait

Mode:

Router(config-line)#

Syntax:

callback forced-wait

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use this command when the router is calling back a modem that initiated a call, then dropped the connection, but requires a rest period before subsequent input is accepted.

Example:

Router(config-line)#callback forced-wait

Misconceptions:

None

Related Commands:

ppp callback

script callback


 Command:

ppp authentication

Mode:

Router(config-if)#

Syntax:

ppp authentication {chap | chap pap | pap chap | pap} [if-needed] [list-name | default] [callin]

no ppp authentication

Syntax Description:

chap

Enables CHAP on a serial interface.

pap

Enables PAP on a serial interface.

chap pap

Enables both CHAP and PAP, and performs CHAP authentication before PAP.

pap chap

Enables both CHAP and PAP, and performs PAP authentication before CHAP.

if-needed

(Optional) Used with TACACS and XTACACS. Do not perform CHAP or PAP authentication if the user has already provided authentication. This option is available only on asynchronous interfaces.

list-name

(Optional) Used with AAA/TACACS+. Specifies the name of a list of TACACS+ methods of authentication to use. If no list name is specified, the system uses the default. Lists are created with the aaa authentication ppp command.

default

(Optional) Used with AAA/TACACS+. Created with the aaa authentication ppp command.

callin

(Optional) Specifies authentication on incoming (received) calls only.

Command Description:

The ppp authentication command is used configure the PPP PAP or CHAP authentication protocols on an interface. The interface must be using ppp encapsulation to access these protocols.

Example:
Router(config-if)#ppp authentication pap
Misconceptions:
None

Related Commands:
ppp pap
encapsulation ppp
username


 Command:

ppp callback

Mode:

Router(config-if)#

Syntax:

ppp callback {accept | request }

Syntax Description:

accept Enables this dialer interface to accept PPP callback requests (and function as the PPP callback server)
request

Enables this dialer interface to request PPP callback (and function as the PPP callback client)

Command Description:

To enable a dialer interface that is not a data terminal ready (DTR) interface to function either as a callback client that requests callback or as a callback server that accepts callback requests, use the ppp callback interface configuration command.

Example:

Router(config-if)#ppp callback accept
Misconceptions:
None

Related Commands:
script callback
callback forced-wait


Command:

ppp chap refuse

Mode:

Router(config-if)#

Syntax:

ppp chap refuse [callin]
no ppp chap refuse [callin]

Syntax Description:

callin (Optional) This keyword specifies that the router will refuse to answer CHAP authentication challenges received from the peer, but will still require the peer to answer any CHAP challenges the router sends.

Command Description:

To refuse Challenge Handshake Authentication Protocol (CHAP) authentication from peers requesting it, use the ppp chap refuse command in interface configuration mode. To allow CHAP authentication, use the no form of this command.

This command specifies that CHAP authentication is disabled for all calls, meaning that all attempts by the peer to force the user to authenticate using CHAP will be refused. If the callin keyword is used, CHAP authentication is disabled for incoming calls from the peer, but will still be performed on outgoing calls to the peer.

If outbound Password Authentication Protocol (PAP) has been enabled (using the ppp pap sent-username command), PAP will be suggested as the authentication method in the refusal packet.

Example:

The following example specifies ISDN BRI number 0. The method of encapsulation on the interface is PPP. This example disables CHAP authentication from occurring if a peer calls in requesting CHAP authentication.

Router(config)#interface bri 0
Router(config-if)#encapsulation ppp
Router(config-if)#ppp chap refuse

Misconceptions:

None

Related Commands:

aaa authentication ppp
ppp authentication
ppp chap hostname
ppp chap password


 Command:

ppp multilink

Mode:

Router(config-if)#

Syntax:

ppp multilink [bap]

Syntax Description:

bap Specifies bandwidth allocation control negotiation and dynamic allocation of bandwidth on a link

Command Description:

To enable Multilink PPP (MLP) on an interface and, optionally, to enable dynamic bandwidth allocation, use the ppp multilink interface configuration command.

Example:

Router(config-if)#ppp multilink
Misconceptions:
None

Related Commands:
encapsulation ppp


 Command:

ppp pap

Mode:

Router(config-if)#

Syntax:

ppp pap [refuse | sent-username username password password]

Syntax Description:

refuse Directs ppp to refuse a peer request to authenticate remotely with PPP using Password Authentication Protocol
sent-username

Specifies a username and password to be authenticated by the peer

Command Description:

Configures the PPP Password Authentication Protocol. PAP is a simple clear-text authentication protocol that authenticates by comparing a received username/password pair to a local database.

Example:

Router(config-if)#ppp pap sent-username admin password 12345

Misconceptions:

None

Related Commands:
encapsulation ppp
ppp authentication
username


Command:

ppp quality

Mode:

Router(config-if)#

Syntax:

ppp quality percentage

no ppp quality

Syntax Description:

percentage

Specifies the link quality threshold. Range is 1 to 100.

Command Description:

To enable Link Quality Monitoring (LQM) on a serial interface, use the ppp quality command in interface configuration mode. To disable LQM, use the no form of this command.

The percentages are calculated for both incoming and outgoing directions. The outgoing quality is calculated by comparing the total number of packets and bytes sent to the total number of packets and bytes received by the destination node. The incoming quality is calculated by comparing the total number of packets and bytes received to the total number of packets and bytes sent by the destination node.

If the link quality percentage is not maintained, the link is deemed to be of poor quality and is taken down. LQM implements a time lag so that the link does not bounce up and down.

Example:

The following example enables LQM on serial interface 2:

interface serial 2

encapsulation ppp

ppp quality 80

Misconceptions:

None

Related Commands:

exec

keepalive


Command:

pppoe-client dial-pool-number

Mode:

Router(config-if)#

Syntax:

pppoe-client dial-pool-number number

Syntax Description:

number Specifies the dialer interface to use for cloning.

Command Description:

Configures the PPPoE client and specifies the dialer interface to use for cloning.

Example:

The following is the show running-config from a router configured with :

Router(config-if)# pppoe-client dial-pool-number 1
vpdn enable
vpdn-group 1
 request-dialin
  protocol pppoe
!
interface ethernet1/1
 pppoe-client dial-pool-number 1
 pppoe-client dial-pool-number 2
!
interface dialer 1
 ip address negotiated
 dialer pool 1
 dialer-group 1
!
interface dialer 2
 ip address negotiated
 dialer pool 2
 dialer-group 2

Misconceptions:

None.

Related Commands:

None.


 Command:

script callback

Mode:

Router(config-line)#

Syntax:

script callback chat-script-name

Syntax Description:

This command has no arguments or keywords.

Command Description:

To specify that a chat script start on a line any time a client requests a callback, use the script callback line configuration command. Use the no form of this command to disable this feature. This command specifies that if an originating client requests callback, the device will be disconnected and the chat script defined by the argument regexp will be executed to call back the client. The first available line specified for callback, and for which a chat script has been applied, will be used for the callback.

Example:

Router(config-line)#script callback supra4

Misconceptions:

None

Related Commands:
callback forced-wait
ppp callback
chat-script


 Command:

username

Mode:

Router(config)#

Syntax:

username name {nopassword  | password password | password encryption-typeencrypted-password}

username name password secret

username name [access-class number]

username name [autocommand command]

username name [callback-dialstring telephone-number]

username name [callback-rotary rotary-group-number]

username name [callback-line [tty ]line-number [ending-line-number]]

username name [nocallback-verify ]

username name [noescape ] [nohangup ]

username name [privilege level]

Syntax Description:

name

Host name, server name, user ID, or command name. The name argument can be only one word. White spaces and quotation marks are not allowed.
nopassword

No password is required for this user to log in. This is usually most useful in combination with the autocommand keyword.
password

Specifies a possibly encrypted password for this username.
password

Password a user enters.
encryption-type

(Optional) Single-digit number that defines whether the text immediately following is encrypted, and, if so, what type of encryption is used. Currently defined encryption types are 0, which means that the text immediately following is not encrypted, and 7, which means that the text is encrypted using a Cisco-defined encryption algorithm.
encrypted-password

(Optional) Encrypted password a user enters.
password

Password to access the name argument. A password must be from 1 to 25 characters, can contain embedded spaces, and must be the last option specified in the username command.
secret

For CHAP authentication: specifies the secret for the local router or the remote device. The secret is encrypted when it is stored on the local router. The secret can consist of any string of up to 11 ASCII characters. There is no limit to the number of username and password combinations that can be specified, allowing any number of remote devices to be authenticated.
access-class

(Optional) Specifies an outgoing access list that overrides the access list specified in the access-class line configuration command. It is used for the duration of the user's session.
number

(Optional) Access list number.
autocommand

(Optional) Causes the specified command to be issued automatically after the user logs in. When the command is complete, the session is terminated. Because the command can be any length and contain embedded spaces, commands using the autocommand keyword must be the last option on the line.
command

The command string. Because the command can be any length and contain embedded spaces, commands using the autocommand keyword must be the last option on the line.
callback-dialstring

(Optional) For asynchronous callback only: permits you to specify a telephone number to pass to the DCE device.
telephone-number

For asynchronous callback only: telephone number to pass to the DCE device.

callback-rotary

(Optional) For asynchronous callback only: permits you to specify a rotary group number. The next available line in the rotary group is selected.

rotary-group-number

For asynchronous callback only: integer between 1 and 100 that identifies the group of lines on which you want to enable a specific username for callback.

callback-line

(Optional) For asynchronous callback only: specific line on which you enable a specific username for callback.
tty

(Optional) For asynchronous callback only: standard asynchronous line.
line-number

For asynchronous callback only: relative number of the terminal line (or the first line in a contiguous group) on which you want to enable a specific username for callback. Numbering begins with zero.
ending-line-number

(Optional) Relative number of the last line in a contiguous group on which you want to enable a specific username for callback. If you omit the keyword (such as tty ), then line-number and ending-line-number are absolute rather than relative line numbers.

nocallback-verify

(Optional) Authentication not required for EXEC callback on the specified line.
noescape

(Optional) Prevents a user from using an escape character on the host to which that user is connected.
nohangup

(Optional) Prevents Cisco IOS from disconnecting the user after an automatic command (set up with the autocommand keyword) has completed. Instead, the user gets another EXEC prompt.
privilege

(Optional) Sets the privilege level for the user.
level

(Optional) Number between 0 and 15 that specifies the privilege level for the user.

Command Description:

To establish a username-based authentication system, enter the username global configuration command.

Example:

Router(config)#username jjones password supersecretpassword

Misconceptions:

None

Related commands:
ppp pap
ppp authentication


%command%

Command:

show ppp multilink

Mode:

Router>

Syntax:

show ppp multilink [bundle-interface]

Syntax Description:

bundle-interface

(Optional) The name of a bundle interface. Enter the name of a bundle interface to display information for only that bundle.

Command Description:

To display bundle information for the Multilink PPP (MLP) bundles, use the show ppp multilink command in EXEC mode.

Example:

Router#show ppp multilink

No active bundles

The following is sample output when a single MLP bundle (named bundle1) is on a system:

Router#show ppp multilink

Bundle bundle1, 3 members, first link is BRI0: B-channel 1

0 lost fragments, 8 reordered, 0 unassigned, sequence 0x1E/0x1E rcvd/sent

The following is sample output when two active bundles are on a system. Subsequent bundles would be displayed below the previous bundle.

Router#show ppp multilink

Bundle bundle1, 3 members, first link is BRI0: B-Channel 1

0 lost fragments, 8 reordered, 0 unassigned, sequence 0x1E/0x1E rcvd/sent

Bundle bundle2, 4 members, first link is BRI2: B-Channel 1

0 lost fragments, 28 reordered, 0 unassigned, sequence 0x12E/0x12E rcvd/sent

The following example shows output when a stack group has been created. On stack group member systema, The MLP bundle named bundle1 has bundle interface Virtual-Access4. Two child interfaces are joined to this bundle interface. The first is a local PRI channel (serial 0:4), and the second is an interface from stack group member systemb.

Router#show ppp multilink

Bundle bundle1 2 members, Master link is Virtual-Access4

0 lost fragments, 0 reordered, 0 unassigned, 100/255 load

0 discarded, 0 lost received, sequence 40/66 rcvd/sent

members 2

Serial0:4

systemb:Virtual-Access6 (10.1.1.1)

The following is sample output when the PPP Bandwidth Allocation Control Protocol (BACP) is enabled for the multilink bundle:

Router#show ppp multilink

Bundle bundle1, 1 member, Master link is Virtual-Access1

Bundle under BAP control

Dialer Interface is Dialer1

0 lost fragments, 0 reordered, 0 unassigned, sequence 0x0/0x0 rcvd/sent

0 discarded, 0 lost received, 1/255

Member links: 1

BRI0:1

Discriminators Local Remote

BRI0:1 24 1

Misconceptions:

None

Related commands:

ppp multilink

© Cisco Systems, Inc. 2001, 2002


Command:

class (policy-map)

Mode:

Router(config-pmap-c)#

Syntax:

class {class-name | class-default}

no class {class-name | class-default}

Syntax Description:

class-name | The name of the class for which you want to configure or modify policy.
class-default | Specifies the default class so that you can configure or modify its policy.

Command Description:

To specify the name of the class whose policy you want to create or change or to specify the default class (commonly known as the class-default class) before you configure its policy, use the class QoS policy-map configuration command. To remove a class from the policy map, use the no form of this command.

Enter the policy-map command to identify the policy map and enter QoS policy-map configuration mode before you use the class command. After you specify a policy map, you can configure policy for new classes or modify policy for any existing classes in that policy map.

The class name that you specify in the policy map ties the characteristics for that class—that is, its policy—to the class map and its match criteria, as configured using the class-map command.

When you configure policy for a class and specify its bandwidth and attach the policy map to an interface, class-based weighted fair queueing (CBWFQ) determines if the bandwidth requirement of the class can be satisfied. If so, CBWFQ allocates a queue for the bandwidth requirement.

When a class is removed, available bandwidth for the interface is incremented by the amount previously allocated to the class.

The maximum number of classes you can configure for a router—and, therefore, within a policy map—is 64.

The predefined default class called class-default is the class to which traffic is directed if that traffic does not satisfy the match criteria of other classes whose policy is defined in the policy map.

You can define a class policy to use either tail drop (by using the queue-limit command) or Weighted Random Early Detection (WRED) packet drop (by using the random-detect command). The queue-limit and random-detect commands cannot be used in the same class policy, but they can be used in two class policies in the same policy map.

You can configure the bandwidth command when either the queue-limit or the random-detect command is configured in a class policy. The bandwidth command specifies the amount of bandwidth allocated for the class.

For the default class, you can configure the fair-queue (class-default) command. The fair-queue command specifies the number of dynamic queues for the default class. The fair-queue command can be used in the same class policy as either the queue-limit or random-detect command. It cannot be used with the bandwidth command.

Example:

The following example configures three class policies included in the policy map called policy1. Class1 specifies policy for traffic that matches access control list 136. Class2 specifies policy for traffic on interface ethernet101. The third class is the default class to which packets that do not satisfy configured match criteria are directed.

! The following commands create class-maps class1 and class2
! and define their match criteria:
class-map class1
 match access-group 136
class-map class2
 match input-interface ethernet101
! The following commands create the policy map, which is defined to contain policy
! specification for class1, class2, and the default class:
policy-map policy1
class class1
 bandwidth 2000
 queue-limit 40
class class2
 bandwidth 3000
 random-detect
 random-detect exponential-weighting-constant 10
class class-default
 fair-queue 16
 queue-limit 20

Misconceptions:

None.

Related Commands:

class-map

policy-map

queue-limit

random-detect (interface)


class-map

Command:

class-map

Mode:

Router(config)#

Syntax:

class-map [match-all | match-any] class-map-name
no class-map [match-all | match-any] class-map-name

Syntax Description:

match-all | match-any Determines how packets are evaluated when multiple match criteria exist. Packets must either meet all of the match criteria (match-all) or one of the match criteria (match-any) in order to be considered a member of the class.

class-map-name Name of the class for the class map. The name can be a maximum of 40 alphanumeric characters. The class name is used for both the class map and to configure policy for the class in the policy map.

Command Description:

To create a class map to be used for matching packets to a specified class, use the class-map global configuration command. To remove an existing class map from the router, use the no form of this command.

Example:

The following example specifies class101 as the name of a class, and it defines a class map for this class. The class called class101 specifies policy for traffic that matches access control list 101:

Router(config)#class-map class101
Router(config-cmap)#match access-group 101

Misconceptions:

None

Related commands:

policy-map


Command:

compress

Mode:

Router(config-if)#

Syntax:

compress [predictor | stac | mppc [ignore-pfc]]

no compress [predictor | stac | mppc [ignore-pfc]]

Syntax Description:

predictor

(Optional) Specifies a predictor compression algorithm will be used.

stac

(Optional) Specifies a Stacker (LZS) compression algorithm will be used.

mppc

(Optional) Specifies the MPPC compression algorithm will be used.

ignore-pfc

(Optional) Specifies the protocol field compression flag negotiated through LCP will be ignored.

Command Description:

To configure software compression for Point-to-Point Protocol (PPP) encapsulation, use the compress interface configuration command. To disable compression, use the no form of this command.

Usage Guidelines:

End-point devices must be configured to use the same compression method (predictor, Stacker or MPPC).

Compression reduces the size of frames via lossless data compression. The compression algorithm used is a predictor algorithm (the RAND compression algorithm), which uses a compression dictionary to predict what the next character in the frame will be.

PPP encapsulation supports both predictor and Stacker compression algorithms.

MPPC Compression

The compress command using the mppc and ignore-pfc options support compression between Cisco routers, access servers, and Microsoft clients such as Windows 95 and Windows NT. MPPC implements an LZ based compression algorithm that uses a compression dictionary to compress PPP packets. The ignore-pfc keyword instructs the router to ignore the protocol field compression flag negotiated by LCP. For example, the uncompressed standard protocol field value for IP is 0x0021 and 0x21 when compression is enabled. When the ignore-pfc option is enabled, the router will continue to use the uncompressed value (0x0021). Using the ignore-pfc option is helpful for some asynchronous driver devices which use an uncompressed protocol field (0x0021), even though the pfc is negotiated between peers. If protocol rejects are displayed when the debug ppp negotiation command is enabled, setting the ignore-pfc option may remedy the problem.

System Performance

Compression is accomplished through software and may significantly affect system performance. We recommend that you disable compression if CPU load exceeds 65 percent. To display the CPU load, use the show process cpu EXEC command.

You should never enable compression for connections to a public data network.

If the majority of your traffic is already compressed files, we recommend that you not use compression. If the files are already compressed, the additional processing time spent in unsuccessfully attempting to compress them again will slow system performance.

Example:

The following example enables predictor compression on serial interface 0:

  Router(config)#interface serial 0

  Router(config-if)#encapsulation ppp

  Router(config-if)#compress predictor

The following example configures BRI interface 0 to perform MPPC:

  Router(config)#interface BRI 0

  Router(config-if)#ip unnumbered ethernet 0

  Router(config-if)#encapsulation ppp

  Router(config-if)#isdn spid1 5551234

  Router(config-if)#dialer map ip 172.21.71.74 5551234

  Router(config-if)#dialer-group 1

  Router(config-if)#compress mppc

The following example configures asynchronous interface 1 to implement MPPC and ignore the protocol field compression flag negotiated by LCP:

  Router(config)#interface async 1

  Router(config-if)#ip unnumbered ethernet 0

  Router(config-if)#encapsulation ppp

  Router(config-if)#default routing

  Router(config-if)#async dynamic routing

  Router(config-if)#async mode interactive

  Router(config-if)#peer default ip address 172.21.71.74

  Router(config-if)#compress mppc ignore-pfc

Misconceptions:

None

Related Commands:

encapsulation ppp


 Command:

custom-queue-list

Mode:

Router(config-if)#

Syntax:

custom-queue-list list

no custom-queue-list [list]

Syntax Description:

list

Any number from 1 to 16 for the custom queue list.

Command Description:

To assign a custom queue list to an interface, use the custom-queue-list interface configuration command. To remove a specific list or all list assignments, use the no form of this command.

Only one queue list can be assigned per interface. Use this command in place of the priority-list command (not in addition to it). Custom queueing allows a fairness not provided with priority queueing. With custom queueing, you can control the interface's available bandwidth when it is unable to accommodate the aggregate traffic enqueued. Associated with each output queue is a configurable byte count, which specifies how many bytes of data should be delivered from the current queue by the system before the system moves on to the next queue. When a particular queue is being processed, packets are sent until the number of bytes sent exceeds the queue byte count or until the queue is empty.

Use the show queueing custom and show interfaces commands to display the current status of the custom output queues.

Example:

In the following example, custom queue list number 3 is assigned to serial interface 0:

Router(config)#interface serial 0
Router(config-if)#custom-queue-list 3
Misconceptions:
None

Related Commands:
queue-list default
queue-list interface
queue-list queue byte-count
queue-list queue limit
show interfaces
show queueing


 Command:

fair-queue

Mode:

Router(config-if)#

Syntax:

fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]]

no fair-queue

Syntax Description:

congestive-discard-threshold

(Optional) Number of messages allowed in each queue. The default is 64 messages, and a new threshold must be a power of 2 in the range 16 to 4096. When a conversation reaches this threshold, new message packets are discarded.

dynamic-queues

(Optional) Number of dynamic queues used for best-effort conversations (that is, a normal conversation not requiring any special network services). Values are 16, 32, 64, 128, 256, 512, 1024, 2048, and 4096. The default is 256.

reservable-queues

(Optional) Number of reservable queues used for reserved conversations in the range 0 to 1000. The default is 0. Reservable queues are used for interfaces configured for features such as Resource Reservation Protocol (RSVP).

Command Description:

To enable weighted fair queueing (WFQ) for an interface, use the fair-queue interface configuration command. To disable weighted fair queueing for an interface, use the no form of this command. This command enables WFQ. With WFQ, packets are classified by flow. For example, packets with the same source IP address, destination IP address, source TCP or UDP port, destination TCP or UDP port, and protocol belong to the same flow; see the table below for a full list of protocols and traffic stream discrimination fields.

When enabled for an interface, WFQ provides traffic priority management that automatically sorts among individual traffic streams without requiring that you first define access lists. Enabling WFQ requires use of this command only.

When WFQ is enabled for an interface, new messages for high-bandwidth traffic streams are discarded after the configured or default congestive discard threshold has been met. However, low-bandwidth conversations, which include control message conversations, continue to enqueue data. As a result, the fair queue may occasionally contain more messages than its configured threshold number specifies.

WFQ uses a traffic data stream discrimination registry service to determine which traffic stream a message belongs to. For each forwarding protocol, Table shows the attributes of a message that are used to classify traffic into data streams.

Fair queueing is enabled by default for physical interfaces whose bandwidth is less than or equal to 2.048 Mbps and that do not use the following: X.25 and Synchronous Data Link Control (SDLC) encapsulations; Link Access Procedure, Balanced (LAPB); tunnels; loopbacks; dialer; bridges; or virtual interfaces. Fair queueing is not an option for these protocols. However, if custom queueing or priority queueing is enabled for a qualifying link, it overrides fair queueing, effectively disabling it. Additionally, fair queueing is automatically disabled if you enable the autonomous or silicon switching engine mechanisms.

Table: Weighted Fair Queueing
Traffic Stream Discrimination Fields
Forwarder Fields Used

AppleTalk

  • Source net, node, socket
  • Destination net, node, socket
  • Type

CLNS

  • Source NSAP
  • Destination NSAP

DECnet

  • Source address
  • Destination address

Frame Relay switching

  • DLCI value

IP

  • ToS
  • IP protocol
  • Source IP address (if message is not fragmented)
  • Destination IP address (if message is not fragmented)
  • Source TCP/UDP port
  • Destination TCP/UDP port

Transparent bridging

  • Unicast: source MAC, destination MAC
  • Ethertype SAP/SNAP multicast: destination MAC address

Source-route bridging

  • Unicast: source MAC, destination MAC
  • SAP/SNAP multicast: destination MAC address

VINES

  • Source network/host
  • Destination network/host
  • Level 2 protocol

Apollo

  • Source network/host/socket
  • Destination network/host/socket
  • Level 2 protocol

XNS

  • Source/destination network/host/socket
  • Level 2 protocol

Novell NetWare

  • Source/destination network/host/socket
  • Level 2 protocol

All others (default)

  • Control protocols (one queue per protocol)

It is important to note that IP precedence, congestion in Frame Relay switching, and discard eligibility flags affect the weights used for queueing.

IP precedence, which is set by the host or by policy maps, is a number in the range of 0 to 7. Data streams of precedence number are weighted so that they are given an effective bit rate of number+1 times as fast as a data stream of precedence 0, which is normal.

In Frame Relay switching, message flags for forward explicit congestion notification (FECN), backward explicit congestion notification (BECN), and discard eligibility (DE) message flags cause the algorithm to select weights that effectively impose reduced queue priority, providing the application with "slow down" feedback and sorting traffic, giving the best service to applications within their committed information rate (CIR).

Fair queueing is supported for all LAN and line (WAN) protocols except X.25, including LAPB and SDLC.

Example:

The following example enables use of WFQ on serial interface 0, with a congestive threshold of 300. This threshold means that messages will be discarded from the queueing system only when 300 or more messages have been queued and the message is in a data stream that has more than one message in the queue. The transmit queue limit is set to 2, based on the 384-kilobit (Kb) line set by the bandwidth command:

Router(config)#interface serial 0
Router(config-if)#bandwidth 384
Router(config-if)#fair-queue 300

Unspecified parameters take the default values.

The following example requests a fair queue with a congestive discard threshold of 64 messages, 512 dynamic queues, and 18 RSVP queues:

Router(config)#interface Serial 3/0
Router(config-if)#ip unnumbered Ethernet 0/0
Router(config-if)#fair-queue 64 512 18
Misconceptions:
None

Related Commands:
custom-queue-list
priority-group
priority-list default
show interfaces
show queueing


 Command:

ip tcp header-compression

Mode:

Router(config-if)#

Syntax:

ip tcp header-compression [on | off | passive]

no ip tcp header-compression

Syntax Description:

on

(Optional) Turns header compression on.

off

(Optional) Turns header compression off.

passive

(Optional) On SLIP lines, prevents transmission of compressed packets until a compressed packet arrives from the asynchronous link, unless a user specifies SLIP on the command line. For PPP, this option functions the same as the on option.

Command Description:

To configure TCP header compression on the asynchronous link, use the ip tcp header-compression interface configuration command. To disable header compression, use the no form of this command.

Header compression data areas are initialized to handle up to 16 simultaneous TCP connections. Currently, you cannot change this number. You can only turn header compression on or off or use the passive keyword.

On lines configured for PPP encapsulation, the keywords passive and on cause the same behavior. Before attempting header compression, PPP automatically negotiates whether compression is available at each end of the connection.

There are two ways to implement header compression when the line is configured for ip tcp header-compression passive:

  • The user enters the /compressed option with the slip EXEC commands to force the line into compressed mode. This overrides the passive setting and causes the interface to behave as if header compression is enabled.
  • The user enters slip or slip default and the connecting system sends compressed packets to the server. The server detects the use of compression by the connecting system and automatically enters compressed mode.

If a line is configured for passive header compression and you use the slip or ppp EXEC command to enter asynchronous mode, you will see the interface is set to match the compression status used by the host at the other end of the asynchronous line.

Router>slip 10.0.0.1
Password:
Entering SLIP mode.
Interface IP address is 10.0.0.1, MTU is 1500 bytes
Header compression will match your system.

The message "Header compression will match your system" indicates the interface is set to match the compression status used by the host at the other end of the asynchronous line. If the line was configured to have header compression on, this line would read "Header compression is On."
Example:

The following example enables Van Jacobson TCP header compression. The passive keyword prevents transmission of compressed packets until a compressed packet arrives from the IP link. Notice that asynchronous routing and dynamic addressing are also enabled.

Router(config)#interface async 6
Router(config-if)#async dynamic routing
Router(config-if)#async dynamic address
Router(config-if)#ip tcp header-compression passive
Misconceptions:
None

Related Commands:
None


Command:

max-reserved-bandwidth

Mode:

Router(config-if)#

Syntax:

max-reserved-bandwidth percent
no max-reserved-bandwidth

Syntax Description:

percent Percent of interface bandwidth allocated for RSVP, CBWFQ, LLQ, IP RTP Priority, Frame Relay IP RTP Priority, and Frame Relay PIPQ.

Command Description:

To change the percent of interface bandwidth allocated for Resource Reservation Protocol (RSVP), class-based weighted fair queueing (CBWFQ), low latency queueing (LLQ), IP RTP Priority, Frame Relay IP RTP Priority, and Frame Relay PVC Interface Priority Queueing (PIPQ), use the max-reserved-bandwidth interface configuration command. To restore the default value, use the no form of this command.

The default is 75 percent.

The sum of all bandwidth allocation on an interface should not exceed 75 percent of the available bandwidth on an interface. The remaining 25 percent of bandwidth is used for overhead, including Layer 2 overhead, control traffic, and best-effort traffic.

If you need to allocate more than 75 percent for RSVP, CBWFQ, LLQ, IP RTP Priority, Frame Relay IP RTP Priority, and Frame Relay PIPQ, you can use the max-reserved-bandwidth command. The percent argument specifies the maximum percentage of the total interface bandwidth that can be used.

If you do use the max-reserved-bandwidth command, make sure that not too much bandwidth is taken away from best-effort and control traffic.

The max-reserved-bandwidth command is intended for use on main interfaces only; it has no effect on virtual circuits (VCs) or ATM permanent virtual circuits (PVCs).

Example:

In the following example, the policy map called policy1 is configured for three classes with a total of 8 Mbps configured bandwidth, as shown in the output from the show policy-map command:

Router#show policy-map policy1
Policy Map policy1
Weighted Fair Queueing
Class class1
Bandwidth 2500 (kbps) Max Threshold 64 (packets)
Class class2
Bandwidth 2500 (kbps) Max Threshold 64 (packets)
Class class3
Bandwidth 3000 (kbps) Max Threshold 64 (packets)

When you enter the service-policy command in an attempt to attach the policy map on a 10-Mbps Ethernet interface, an error message such as the following is produced:

I/f Ethernet1/1 class class3 requested bandwidth 3000 (kbps) Available only 2500 (kbps)

The error message is produced because the default maximum configurable bandwidth is 75 percent of the available interface bandwidth, which in this example is 7.5 Mbps. To change the maximum configurable bandwidth to 80 percent, use the max-reserved-bandwidth command in interface configuration mode, as follows:

max-reserved-bandwidth 80
service output policy1
end

To verify that the policy map was attached, enter the show policy-map interface command:

Router#show policy-map interface e1/1
Ethernet1/1 output :policy1
Weighted Fair Queueing
Class class1
Output Queue:Conversation 265
Bandwidth 2500 (kbps) Packets Matched 0 Max Threshold 64 (packets)
(discards/tail drops) 0/0
Class class2
Output Queue:Conversation 266
Bandwidth 2500 (kbps) Packets Matched 0 Max Threshold 64 (packets)
(discards/tail drops) 0/0
Class class3
Output Queue:Conversation 267
Bandwidth 3000 (kbps) Packets Matched 0 Max Threshold 64 (packets)
(discards/tail drops) 0/0

Virtual Template Configuration Example

The following example configures a strict priority queue in a virtual template configuration with CBWFQ. The max-reserved-bandwidth command changes the maximum bandwidth allocated between CBWFQ and IP RTP Priority from the default (75 percent) to 80 percent.

multilink virtual-template 1
interface virtual-template 1
 ip address 172.16.1.1 255.255.255.0
 no ip directed-broadcast
 ip rtp priority 16384 16383 25
service-policy output policy1
ppp multilink
ppp multilink fragment-delay 20
ppp multilink interleave
max-reserved-bandwidth 80
end
interface Serial0/1
bandwidth 64
ip address 10.1.1.2 255.255.255.0
no ip directed-broadcast
encapsulation ppp
ppp multilink
end

Misconceptions:

To make the virtual access interface function properly, do not configure the bandwidth command on the virtual template. Configure it on the actual interface, as shown in the example.

Related Commands:

None


Command:

policy-map

Mode:

Switch(config)#

Syntax:

policy-map policy-map-name
no policy-map policy-map-name

Syntax Description:

policy-map-name Name of the policy map.

Command Description:

Use the policy-map global configuration command to create or modify a policy map that can be attached to multiple interfaces and to enter policy-map configuration mode. Use the no form of this command to delete an existing policy map and return to global configuration mode.

Entering the policy-map command enables the policy-map configuration mode. These configuration commands are available:

class: defines the classification match criteria for the specified class map. For more information, see the class command.

description: describes the policy map (up to 200 characters).

exit: exits policy-map configuration mode and returns to global configuration mode.

no: removes a previously defined policy map.

rename: renames the policy map.

To return to global configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.

Before you can configure policies for classes whose match criteria are defined in a class map, use the policy-map command to specify the name of the policy map to be created or modified. Entering this command also enables the policy-map configuration mode in which you can configure or modify the class policies for that policy map.

You can configure class policies in a policy map only if the classes have match criteria defined for them. Use the class-map and match commands to configure the match criteria for a class. Only one match command per class map is supported.

Only one policy map per interface per direction is supported. You can apply the same policy map to multiple interfaces but only in the ingress direction.

Example:

This example shows how to create a policy map called policy1. When attached to the ingress direction, it matches all the incoming traffic defined in class1 and polices the traffic at an average rate of 1 Mbps and bursts at 65536 bytes. Traffic exceeding the profile is dropped.

Switch(config)#policy-map policy1

Switch(config-pmap)#class class1

Switch(config-pmap-c)#police 1000000 65536 exceed-action drop

Switch(config-pmap-c)#exit

Switch(config-pmap)#

This example shows how to delete policymap2:

Switch(config)#no policy-map policymap2

Misconceptions:

In a policy map, the class named class-default is not supported. The switch does not filter traffic based on the policy map defined by the class class-default policy-map configuration command.

Related Commands:

None


%command%

Command:

random-detect (interface)

Mode:

Router(config-if)#

Syntax:

random-detect [dscp-based | prec-based]

no random-detect [dscp-based | prec-based]

Syntax Description:

dscp-based | (Optional) Specifies that WRED is to use the differentiated services code point (DSCP) value when it calculates the drop probability for a packet.
prec-based | (Optional) Specifies that WRED is to use the IP Precedence value when it calculates the drop probability for a packet.

Command Description:

To enable Weighted Random Early Detection (WRED) or distributed WRED (DWRED), use the random-detect interface configuration command. To configure WRED as class policy in a policy map, use the random-detect interface and policy-map class configuration command. To disable WRED or DWRED, use the no form of this command.

Example:

The following example configures WRED on the High-Speed Serial Interface (HSSI) 0/0/0 interface:

interface Hssi 0/0/0

random-detect

The following example configures the policy map called policy1 to contain policy specification for the class called class1. During times of congestion, WRED packet drop is used instead of tail drop.

! The following commands create the class map called class1:

class-map class 1

match input-interface FE0/1

! The following commands define policy1 to contain policy specification for class1:

policy-map policy1

class class 1

bandwidth 1000

random-detect

The following example enables WRED to use the DSCP value 8. The minimum threshold for the DSCP value 8 is 24 and the maximum threshold is 40. This configuration was performed at the interface level.

Router(config-if)#interface seo/0

Router(config-if)#random-detect dscp-based

Router(config-if)#random-detect dscp 8 24 40

The following example enables WRED to use the DSCP value 8 for class c1. The minimum threshold for DSCP value 8 is 24 and the maximum threshold is 40. The last line attaches the service policy to the output interface or virtual circuit (VC) p1.

Router(config-if)#class-map c1

Router(config-cmap)#match access-group101

Router(config-if)#policy-map p1

Router(config-pmap)#class c1

Router(config-pmap-c)#bandwidth 48

Router(config-pmap-c)#random-detect dscp-based

Router(config-pmap-c)#random-detect dscp 8 24 40

Router(config-if)#service-policy output p1

Misconceptions:

None

Related commands:

policy-map
show interfaces

© Cisco Systems, Inc. 2001, 2002


 Command:

priority-group

Mode:

Router(config-if)#

Syntax:

priority-group list-number

no priority-group list-number

Syntax Description:

list-number

Priority list number assigned to the interface. Any number from 1 to 16.

Command Description:

To assign the specified priority list to an interface, use the priority-group interface configuration command. To remove the specified priority group assignment, use the no form of this command.

Only one list can be assigned per interface. Priority output queueing provides a mechanism to prioritize packets transmitted on an interface.

Use the show queueing priority and show interfaces commands to display the current status of the output queues.

Example:

The following example causes packets for transmission on serial interface 0 to be classified by priority list 1:

Router(config)#interface serial 0
Router(config-if)#priority-group 1

The following sample configuration shows how to establish queueing priorities based on the address of the serial link on a STUN connection. Note that you must use the priority-group interface configuration command to assign a priority group to an output interface.

stun peer-name 131.108.254.6
stun protocol-group 1 sdlc
!
interface serial 0
! Disable the ip address for interface serial 0:
no ip address
! Enable the interface for STUN:
encapsulation stun
!
stun group 2
stun route address 10 tcp 131.108.254.8 local-ack priority
!
! Assign priority group 1 to the input side of interface serial 0:
priority-group 1
! Assign a low priority to priority list 1 on serial link identified
! by group 2 and address A7:
priority-list 1 stun low address 2 A7

Misconceptions:

None

Related Commands:
priority-list default
priority-list interface
priority-list queue-limit
show interfaces
show queueing


 Command:

priority-list default

Mode:

Router(config)#

Syntax:

priority-list list-number default {high | medium | normal | low}

no priority-list list-number

Syntax Description:

list-number

Any number from 1 to 16 that identifies the priority list.

high | medium | normal | low

Priority queue level. The normal queue is used, if you use the no form of this command.

Command Description:

To assign a priority queue for those packets that do not match any other rule in the priority list, use the priority-list default global configuration command. To return to the default or assign normal as the default, use the no form of this command.

When you use multiple rules, remember the system reads the priority settings in order of appearance. When classifying a packet, the system searches the list of rules specified by priority-list commands for a matching protocol or interface type. When a match is found, the system assigns the packet to the appropriate queue. The system searches the list in the order it is specified, and the first matching rule terminates the search.

Example:

The following example sets the priority queue for those packets that do not match any other rule in the priority list to a low priority:

router(config)#priority-list 1 default low

Misconceptions:

None

Related Commands:
priority-group
priority-list interface
priority-list protocol
priority-list queue-limit
show queueing


 Command:

priority-list interface

Mode:

Router(config)#

Syntax:

priority-list list-number protocol protocol-name {high | medium | normal | low} queue-keyword keyword-value

no priority-list list-number protocol [protocol-name {high| medium | normal | low} queue-keyword keyword-value]

Syntax Description:

list-number

Any number from 1 to 16 that identifies the priority list selected by the user.

protocol-name

Protocol type: aarp, apollo, appletalk, arp, bridge (transparent), clns, clns_es, clns_is, compressedtcp,cmns, decnet, decnet_node, decnet_router-l1, decnet_router-l2,dlsw, ip, ipx, pad, rsrb, stun, vines,xns, and x25.

high | medium | normal | low

Priority queue level.

queue-keyword keyword-value

Possible keywords are fragments, gt, list, lt, tcp, and udp. See table below.

Command Description:

To establish queueing priorities based on the protocol type, use the priority-list protocol global configuration command. To remove a priority list entry assigned by protocol type, use the no form of this command followed by the appropriate list-number argument and the protocol keyword.

When you use multiple rules for a single protocol, remember the system reads the priority settings in order of appearance. When classifying a packet, the system searches the list of rules specified by priority-list commands for a matching protocol type. When a match is found, the system assigns the packet to the appropriate queue. The system searches the list in the order it is specified, and the first matching rule terminates the search.

The decnet_router-l1 keyword refers to the multicast address for all level 1 routers, which are intra-area routers, and the decnet_router-l2 keyword refers to all level 2 routers, which are inter-area routers.

The dlsw, rsrb, and stun keywords refer only to direct encapsulation.

Use the tables below to configure the queueing priorities for your system.

Table: Protocol Priority Queue Keywords and Values
Option Description

fragments

Assigns the priority level defined to fragmented IP packets (for use with the
IP protocol only). More specifically, this command matches IP packets whose fragment offset field is nonzero. The initial fragment of a fragmented IP packet has a fragment offset of zero, so such packets are not matched by this command.

    Note Packets with a nonzero fragment offset do not contain TCP or UDP headers. Other instances of this command that use the tcp or udp keyword will always fail to match such packets.

gt byte-count

Specifies a greater-than count. The priority level assigned goes into effect
when a packet size exceeds the value entered for the argument byte-count.

    Note The size of the packet must also include additional bytes because of MAC encapsulation on the outgoing interface.

list list-number

Assigns traffic priorities according to a specified list when used with AppleTalk, bridging, IP, IPX, VINES, or XNS. The argument list-number is
the access list number as specified by the access-list global configuration command for the specified protocol-name. For example, if the protocol is AppleTalk, list-number should be a valid AppleTalk access list number.

lt byte-count

Specifies a less-than count. The priority level assigned goes into effect when a packet size is less than the value entered for the argument byte-count.

    Note The size of the packet must also include additional bytes because of MAC encapsulation on the outgoing interface.

tcp port

Assigns the priority level defined to TCP segments originating from or destined to a specified port (for use with the IP protocol only).

udp port

Assigns the priority level defined to UDP packets originating from or destined to a specified port (for use with the IP protocol only).

Table: Common TCP Services and Their Port Numbers
Service Port

FTP data

20

FTP

21

SMTP

25

Telnet

23

Table: Common UDP Services and Their Port Numbers
Service Port

DNS

53

NFS

2049

RPC

111

SNMP

161

TFTP

69

Example:

The following example assigns 1 as the arbitrary priority list number, specifies DECnet as the protocol type, and assigns a high-priority level to the DECnet packets transmitted on this interface:
Router(config)#priority-list 1 protocol decnet high

The following example assigns a medium-priority level to every DECnet packet with a size greater than 200 bytes:

Router(config)#priority-list 2 protocol decnet medium gt 200

The following example assigns a medium-priority level to every DECnet packet with a size less than 200 bytes:

Router(config)#priority-list 4 protocol decnet medium lt 200

The following example assigns a high-priority level to traffic that matches IP access list 10:

Router(config)#priority-list 1 protocol ip high list 10

The following example assigns a medium-priority level to Telnet packets:

Router(config)#priority-list 4 protocol ip medium tcp 23

The following example assigns a medium-priority level to UDP Domain Name Service packets:

Router(config)#priority-list 4 protocol ip medium udp 53

The following example assigns a high-priority level to traffic that matches Ethernet type code access list 201:

Router(config)#priority-list 1 protocol bridge high list 201

The following example assigns a high-priority level to DLSw+ traffic with TCP encapsulation:

Router(config)#priority-list 1 protocol ip high tcp 2065

The following example assigns a high-priority level to DLSw+ traffic with direct encapsulation:

Router(config)#priority-list 1 protocol dlsw high
Note These commands define a rule that determines how packets are attached to an interface. Once the rule is defined, the packet is actually attached to the interface using the priority-group command.
Misconceptions:
None

Related Commands:
priority-group
priority-list default
priority-list queue-limit
show queueing


 Command:

priority-list protocol

Mode:

Router(config)#

Syntax:

priority-list list-number protocol protocol-name {high | medium | normal | low} queue-keyword keyword-value

no priority-list list-number protocol [protocol-name {high | medium | normal | low} queue-keyword keyword-value]

Syntax Description:

list-number

Any number from 1 to 16 that identifies the priority list selected by the user.

protocol-name

Protocol type: aarp, apollo, appletalk, arp, bridge (transparent), clns, clns_es, clns_is, compressedtcp, cmns, decnet, decnet_node, decnet_router-l1, decnet_router-l2, dlsw, ip, ipx, pad, rsrb, stun, vines, xns, and x25.

high | medium | normal | low

Priority queue level.

queue-keyword keyword-value

Possible keywords are fragments, gt, list, lt, tcp, and udp.

Command Description:

To establish queueing priorities based upon the protocol type, use the priority-list protocol global configuration command. To remove a priority list entry assigned by protocol type, use the no form of this command followed by the appropriate list-number argument and the protocol keyword.

When you use multiple rules for a single protocol, remember that the system reads the priority settings in order of appearance. When classifying a packet, the system searches the list of rules specified by priority-list commands for a matching protocol type. When a match is found, the system assigns the packet to the appropriate queue. The system searches the list in the order it is specified, and the first matching rule terminates the search.

The decnet_router-l1 keyword refers to the multicast address for all level 1 routers, which are intra-area routers, and the decnet_router-l2 keyword refers to all level 2 routers, which are inter-area routers.

The dlsw, rsrb, and stun keywords refer only to direct encapsulation.

Use the tables to configure the queueing priorities for your system.

Table: Protocol Priority Queue Keywords and Values
Option Description

fragments

Assigns the priority level defined to fragmented IP packets (for use with the IP protocol only). More specifically, this command matches IP packets whose fragment offset field is nonzero. The initial fragment of a fragmented IP packet has a fragment offset of zero, so such packets are not matched by this command.

    Note Packets with a nonzero fragment offset do not contain TCP or UDP headers, so other instances of this command that use the tcp or udp keyword will always fail to match such packets.

gt byte-count

Specifies a greater-than count. The priority level assigned goes into effect when a packet size exceeds the value entered for the argument byte-count.

    Note The size of the packet must also include additional bytes because of MAC encapsulation on the outgoing interface.

list list-number

Assigns traffic priorities according to a specified list when used with AppleTalk, bridging, IP, IPX, VINES, or XNS. The argument list-number is the access list number as specified by the access-list global configuration command for the specified protocol-name. For example, if the protocol is AppleTalk, list-number should be a valid AppleTalk access list number.

lt byte-count

Specifies a less-than count. The priority level assigned goes into effect when a packet size is less than the value entered for the argument byte-count.

    Note The size of the packet must also include additional bytes because of MAC encapsulation on the outgoing interface.

tcp port

Assigns the priority level defined to TCP segments originating from or destined to a specified port (for use with the IP protocol only).

udp port

Assigns the priority level defined to UDP packets originating from or destined to a specified port (for use with the IP protocol only).

Table: Common TCP Services and Their Port Numbers
Service Port

FTP data

20

FTP

21

SMTP

25

Telnet

23

Table: Common UDP Services and Their Port Numbers
Service Port

DNS

53

NFS

2049

RPC

111

SNMP

161

TFTP

69

Example:

The following example assigns 1 as the arbitrary priority list number, specifies DECnet as the protocol type, and assigns a high-priority level to the DECnet packets transmitted on this interface:

Router(config)#priority-list 1 protocol decnet high

The following example assigns a medium-priority level to every DECnet packet with a size greater than 200 bytes:

Router(config)#priority-list 2 protocol decnet medium gt 200

The following example assigns a medium-priority level to every DECnet packet with a size less than 200 bytes:

Router(config)#priority-list 4 protocol decnet medium lt 200

The following example assigns a high-priority level to traffic that matches IP access list 10:

Router(config)# priority-list 1 protocol ip high list 10

The following example assigns a medium-priority level to Telnet packets:

Router(config)# priority-list 4 protocol ip medium tcp 23

The following example assigns a medium-priority level to UDP Domain Name Service packets:

Router(config)#priority-list 4 protocol ip medium udp 53

The following example assigns a high-priority level to traffic that matches Ethernet type code access list 201:

Router(config)#priority-list 1 protocol bridge high list 201

The following example assigns a high-priority level to DLSw+ traffic with TCP encapsulation:

Router(config)#priority-list 1 protocol ip high tcp 2065

The following example assigns a high-priority level to DLSw+ traffic with direct encapsulation:

Router(config)#priority-list 1 protocol dlsw high
Note These commands define a rule that determines how packets are attached to an interface. Once the rule is defined, the packet is actually attached to the interface using the priority-group command.

Misconceptions:

None

Related Commands:
None


 Command:

priority-list queue-limit

Mode:

Router(config)#

Syntax:

priority-list list-number queue-limit [high-limit [medium-limit [normal-limit [low-limit]]]]

no priority-list list-number queue-limit

Syntax Description:

list-number

Any number from 1 to 16 that identifies the priority list.

high-limit medium-limit normal-limit low-limit

(Optional) Priority queue maximum length. A value of 0 for any of the four arguments means that the queue can be of unlimited size for that particular queue.

Command Description:

To specify the maximum number of packets that can be waiting in each of the priority queues, use the priority-list queue-limit global configuration command. To select the normal queue, use the no form of this command.

If a priority queue overflows, excess packets are discarded and quench messages can be sent, if appropriate, for the protocol.

The default queue limit arguments are listed below.

Table: Default Priority Queue
Packet Limits
Priority Queue Argument Packet Limits

high-limit

20

medium-limit

40

normal-limit

60

low-limit

80

Note If priority queueing is enabled and there is an active ISDN (Integrated Services Digital Network) call in the queue, changing the configuration of the priority-list queue-limit command drops the call from the queue. For more information about priority queueing, refer to the Quality of Service Configuration Guide, Release 12.0.

Example:

The following example sets the maximum packets in the priority queue to 10:

Router(config)#priority-list 2 queue-limit 10 40 60 80

Misconceptions:

None

Related Commands:
priority-group
priority-list default
priority-list interface
priority-list protocol
show queueing


%command%

Command:

queue-limit

Mode:

Router(config-pmap)#

Syntax:

queue-limit number-of-packets

no queue-limit number-of-packets

Syntax Description

number-of-packets

A number in the range from 1 to 64 specifying the maximum number of packets that the queue for this class can accumulate.

Command Description:

To specify or modify the maximum number of packets the queue can hold for a class policy configured in a policy map, use the queue-limit policy-map class configuration command. To remove the queue packet limit from a class, use the no form of this command.

Example:

The following example configures a policy map called policy11 to contain policy for a class called acl203. Policy for this class is set so that the queue reserved for it has a maximum packet limit of 40.

Router(config)#policy-map policy11

Router(config-pmap)#class acl203

Router(config-pmap)#bandwidth 2000

Router(config-pmap)#queue-limit 40

Misconceptions:

None

Related commands:

custom-queue-list
show queue
show queueing

© Cisco Systems, Inc. 2001, 2002


 Command:

queue-list default

Mode:

Router(config)#

Syntax:

queue-list list-number default queue-number

no queue-list list-number default queue-number

Syntax Description:

list-number

Number of the queue list. Any number from 1 to 16.

queue-number

Number of the queue. Any number from 1 to 16. The default number of the queue list is queue number 1.

Command Description:

To assign a priority queue for those packets that do not match any other rule in the queue list, use the queue-list default global configuration command. To restore the default value, use the no form of this command.

When you use multiple rules, remember that the system reads the queue-list commands in order of appearance. When classifying a packet, the system searches the list of rules specified by queue-list commands for a matching protocol or interface type. When a match is found, the system assigns the packet to the appropriate queue. The system searches the list in the order it is specified, and the first matching rule terminates the search.

Queue number 0 is a system queue. It is emptied before any of the other queues are processed. The system enqueues high-priority packets, such as keepalives, to this queue.

Use the show interfaces command to display the current status of the output queues.

Example:

In the following example, the default queue for list 10 is set to queue number 2:

Router(config)#queue-list 10 default 2

Misconceptions:

None

Related Commands:
custom-queue-list
queue-list interface
queue-list queue byte-count
queue-list queue limit
show queueing


 Command:

queue-list interface

Mode:

Router(config)#

Syntax:

queue-list list-number interface interface-type interface-number queue-number

no queue-list list-number interface interface-type interface-number queue-number

Syntax Description:

list-number

Number of the queue list. Any number from 1 to 16.

interface-type

Name of the interface

interface-number

Number of the interface

queue-number

Number of the queue. Any number from 1 to 16.

Command Description:

To establish queueing priorities on packets entering on an interface, use the queue-list interface global configuration command. To remove an entry from the list, use the no form of this command.

When you use multiple rules, remember that the system reads the queue-list commands in order of appearance. When classifying a packet, the system searches the list of rules specified by queue-list commands for a matching protocol or interface type. When a match is found, the system assigns the packet to the appropriate queue. The list is searched in the order it is specified, and the first matching rule terminates the search.

Example:

In the following example, queue list 4 establishes queueing priorities for packets entering on interface tunnel 3. The queue number assigned is 10.

Router(config)#queue-list 4 interface tunnel 3 10

Misconceptions:

None

Related Commands:
custom-queue-list
queue-list default
queue-list queue byte-count
queue-list queue limit
show queueing


 Command:

queue-list queue byte-count

Mode:

Router(config)#

Syntax:

queue-list list-number queue queue-number byte-count byte-count-number

no queue-list list-number queue queue-number byte-count byte-count-number

Syntax Description:

list-number

Number of the queue list. Any number from 1 to 16.

queue-number

Number of the queue. Any number from 1 to 16.

byte-count-number

Average number of bytes the system allows to be delivered from a given queue during a particular cycle. The default byte count is 1500 bytes.

Command Description:

To specify how many bytes the system allows to be delivered from a given queue during a particular cycle, use the queue-list queue byte-count global configuration command. To return the byte count to the default value, use the no form of this command.

Example:

In the following example, queue list 9 establishes the byte count as 1400 for queue number 10:

Router(config)#queue-list 9 queue 10 byte-count 1400

Misconceptions:
None

Related Commands:
custom-queue-list
queue-list default
queue-list interface
queue-list queue limit
show queueing


 Command:

queue-list queue limit

Mode:

Router(config)#

Syntax:

queue-list list-number queue queue-number limit limit-number

no queue-list list-number queue queue-number limit limit-number

Syntax Description:

list-number

Number of the queue list. Any number from 1 to 16.

queue-number

Number of the queue. Any number from 1 to 16.

limit-number

Maximum number of packets that can be enqueued at any time. The range is 0 to 32767 queue entries. A value of 0 means that the queue can be of unlimited size. The default queue is 20 entries.

Command Description:

To designate the queue length limit for a queue, use the queue-list queue limit global configuration command. To return the queue length to the default value, use the no form of this command.

Example:

In the following example, the queue length of queue 10 is increased to 40:

Router(config)#queue-list 5 queue 10 limit 40

Misconceptions:

None

Related Commands:
custom-queue-list
queue-list default
queue-list interface
queue-list queue byte-count
show queueing


 Command:

queue-list queue protocol

Mode:

Router(config)#

Syntax:

queue-list list-number protocol protocol-name queue-number queue-keyword keyword-value

no queue-list list-number protocol protocol-name queue-number queue-keyword keyword-value

Syntax Description:

list-number

Number of the queue list. Any number from 1 to 16.

protocol-name

Required argument that specifies the protocol type: aarp, apollo, appletalk, arp, bridge (transparent), clns, clns_es, clns_is, cmns, compressedtcp, decnet, decnet_node, decnet_routerl1, decnet_routerl2, dlsw, ip, ipx, pad, rsrb, stun, vines, xns, and x25.

queue-number

Number of the queue. Any number from 1 to 16.

queue-keyword keyword-value

Possible keywords are gt, list, lt, tcp, and udp.

Command Description:

To establish queueing priority based upon the protocol type, use the queue-list protocol global configuration command. To remove an entry from the list, use the no form of this command with the appropriate list number.

When you use multiple rules, remember the system reads the queue-list commands in order of appearance. When classifying a packet, the system searches the list of rules specified by queue-list commands for a matching protocol or interface type. When a match is found, the packet is assigned to the appropriate queue. The list is searched in the order it is specified, and the first matching rule terminates the search.

The decnet_router-l1 keyword refers to the multicast address for all level 1 routers, which are intra-area routers, and the decnet_router-l2 keyword refers to all level 2 routers, which are interarea routers.

The dlsw, rsrb, and stun keywords refer only to direct encapsulation.

Use the tables from the priority-list protocol command to configure the queueing priorities for your system.

Example:

The following example assigns 1 as the custom queue list, specifies DECnet as the protocol type, and assigns 3 as a queue number to the packets transmitted on this interface:

Router(config)#queue-list 1 protocol decnet 3

The following example assigns DECnet packets with a size greater than 200 bytes to queue number 2:

Router(config)#queue-list 2 protocol decnet 2 gt 200

The following example assigns DECnet packets with a size less than 200 bytes to queue number 2:

Router(config)#queue-list 4 protocol decnet 2 lt 200

The following example assigns traffic that matches IP access list 10 to queue number 1:

Router(config)#queue-list 1 protocol ip 1 list 10

The following example assigns Telnet packets to queue number 2:

Router(config)#queue-list 4 protocol ip 2 tcp 23

The following example assigns UDP Domain Name Service packets to queue number 2:

Router(config)#queue-list 4 protocol ip 2 udp 53

The following example assigns traffic that matches Ethernet type code access list 201 to queue number 1:

Router(config)#queue-list 1 protocol bridge 1 list 201

Misconceptions:

None

Related Commands:
priority-list protocol
custom-queue-list
queue-list default
queue-list queue byte-count
queue-list queue limit
show queueing


Command:

show queue

Mode:

Router>

Syntax:

show queue interface-name interface-number [vc [vpi/] vci]]

Syntax Description:

interface-name | The name of the interface.
interface-number | The number of the interface.
vc | (Optional) For ATM interfaces only, shows the fair queueing configuration for a specified permanent virtual circuit (PVC). The name can be up to 16 characters long.
vpi (Optional) ATM network virtual path identifier (VPI) for this PVC. The absence of the "/" and a vpi value defaults the vpi value to 0.

On the Cisco 7200 and 7500 series routers, this value ranges from 0 to 255.

The vpi and vci arguments cannot both be set to 0; if one is 0, the other cannot be 0.

If this value is omitted, information for all VCs on the specified ATM interface or subinterface is displayed.

vci (Optional) ATM network virtual channel identifier (VCI) for this PVC. This value ranges from 0 to 1 less than the maximum value set for this interface by the atm vc-per-vp command. Typically, lower values 0 to 31 are reserved for specific traffic (F4 Operation, Administration, and Maintenance (OAM), switched virtual circuit (SVC) signalling, Integrated Local Management Interface (ILMI), and so on) and should not be used.

The VCI is a 16-bit field in the header of the ATM cell. The VCI value is unique only on a single link, not throughout the ATM network, because it has local significance only.

The vpi and vci arguments cannot both be set to 0; if one is 0, the other cannot be 0.

Command Description:

To display the contents of packets inside a queue for a particular interface or virtual circuit (VC), use the show queue EXEC command.

This command displays the contents of packets inside a queue for a particular interface or VC. The show queue command is primarily for internal debugging purposes and custom queueing.

This command does not support VIP-distributed Weighted Random Early Detection WRED (DWRED). You can use the vc keyword and the show queue command arguments to display output for a PVC only on Enhanced ATM port adapters (PA-A3) that support per-VC queueing.

This command is not recommended for use with the modular QoS CLI (MQC) features. Use the show policy interface command.

Example:

The following examples show sample output when the show queue command is entered and either weighted fair queueing (WFQ), WRED, or flow-based WRED are configured.

WFQ Example

The following is sample output from the show queue command for PVC 33 on the atm2/0.33 ATM subinterface. Two conversations are active on this interface. WFQ ensures that both data streams receive equal bandwidth on the interface while they have messages in the pipeline.

Router#show queue atm2/0.33 vc 33
Interface ATM2/0.33 VC 0/33
Queueing strategy: weighted fair
Total output drops per VC: 18149
Output queue: 57/512/64/18149 (size/max total/threshold/drops)
Conversations 2/2/256 (active/max active/max total)
Reserved Conversations 3/3 (allocated/max allocated)
(depth/weight/discards/tail drops/interleaves) 29/4096/7908/0/0
Conversation 264, linktype: ip, length: 254
source: 10.1.1.1, destination: 10.0.2.20, id: 0x0000, ttl: 59,
TOS: 0 prot: 17, source port 1, destination port 1
(depth/weight/discards/tail drops/interleaves) 28/4096/10369/0/0
Conversation 265, linktype: ip, length: 254
source: 10.1.1.1, destination: 10.0.2.20, id: 0x0000, ttl: 59,
TOS: 32 prot: 17, source port 1, destination port 2

Flow-Based WRED Example

The following is sample output from the show queue command issued for serial interface 1 on which flow-based WRED is configured. The output shows information for each packet in the queue; the data identifies the packet by number, the flow-based queue to which the packet belongs, the protocol used, and so forth.

Router#show queue Serial1
Output queue for Serial1 is 2/0
Packet 1, flow id:160, linktype:ip, length:118, flags:0x88
source:10.1.3.4, destination:10.1.2.2, id:0x0000, ttl:59,
TOS:32 prot:17, source port 1, destination port 515
data:0x0001 0x0203 0x0405 0x0607 0x0809 0x0A0B 0x0C0D
0x0E0F 0x1011 0x1213 0x1415 0x1617 0x1819 0x1A1B
Packet 2, flow id:161, linktype:ip, length:118, flags:0x88
source:10.1.3.5, destination:10.1.2.2, id:0x0000, ttl:59,
TOS:64 prot:17, source port 1, destination port 515
data:0x0001 0x0203 0x0405 0x0607 0x0809 0x0A0B 0x0C0D
0x0E0F 0x1011 0x1213 0x1415 0x1617 0x1819 0x1A1B

The following is sample output from the show queue command issued for serial interface 3 on which WRED is configured. The output has been truncated to show only 2 of the 24 packets.

Router#show queue Serial3
Output queue for Serial3 is 24/0
Packet 1, linktype:ip, length:118, flags:0x88
source:10.1.3.25, destination:10.1.2.2, id:0x0000, ttl:59,
TOS:192 prot:17, source port 1, destination port 515
data:0x0001 0x0203 0x0405 0x0607 0x0809 0x0A0B 0x0C0D
0x0E0F 0x1011 0x1213 0x1415 0x1617 0x1819 0x1A1B
Packet 2, linktype:ip, length:118, flags:0x88
source:10.1.3.26, destination:10.1.2.2, id:0x0000, ttl:59,
TOS:224 prot:17, source port 1, destination port 515
data:0x0001 0x0203 0x0405 0x0607 0x0809 0x0A0B 0x0C0D
0x0E0F 0x1011 0x1213 0x1415 0x1617 0x1819 0x1A1B

Misconceptions:

None

Related Commands:

None


 Command:

show queueing

Mode:

Router>

Syntax:

show queueing [custom | fair | priority | red]

Syntax Description:

custom

(Optional) Status of the custom queueing list configuration.

fair

(Optional) Status of the fair queueing configuration.

priority

(Optional) Status of the priority queueing list configuration.

red

(Optional) Status of the Weighted Random Early Detection (WRED) configuration.

Command Description:

To list all or selected configured queueing strategies, use the show queueing EXEC command.

Examples:

The following is a sample of output from the show queueing custom command:

Router#show queueing custom
Current custom queue configuration:

       List   Queue  Args
       3      10     default
       3      3      interface Tunnel3
       3      3      protocol ip
       3      3      byte-count 444 limit 3

The following is a sample of output from the show queueing command. There are two active conversations in the serial interface 0. Weighted fair queueing ensures that both of these IP data streams—both using TCP—receive equal bandwidth on the interface while they have messages in the pipeline, even though there is more FTP data in the queue than RCP data.

Router#show queueing

Current fair queue configuration:

Interface           Discard     Dynamic      Reserved
                    threshold   queue count  queue count
Serial0             64          256          0
Serial1             64          256          0
Serial2             64          256          0
Serial3             64          256          0

Current priority queue configuration:

List   Queue  Args
1      high   protocol cdp
2      medium interface Ethernet1

Current custom queue configuration:

Current RED queue configuration:

Interface: Ethernet3   Exp-weight-constant: 9
  Class    Min-th    Max-th   Mark-prob
  0        20        40       1/10
  1        22        40       1/10
  2        24        40       1/10
  3        26        40       1/10
  4        28        40       1/10
  5        31        40       1/10
  6        33        40       1/10
  7        35        40       1/10
  rsvp     37        40       1/10

Misconceptions:

None

Related commands:
custom-queue-list
fair-queue
priority-group
priority-list interface
priority-list queue-limit
queue-list interface
queue-list queue byte-count


Command:

show traffic-shape statistics

Mode:

Router#

Syntax:

show traffic-shape statistics [interface-type interface-number]

Syntax Description:

interface-type | (Optional) The type of the interface. If no interface is specified, traffic-shaping details for all configured interfaces are shown.
interface-number | (Optional) The number of the interface.

Command Description:

To display the current traffic-shaping statistics, use the show traffic-shape statistics EXEC command.

You must have first enabled traffic shaping using the traffic-shape rate, traffic-shape group, or frame-relay traffic-shaping command to display traffic-shaping information.

Example:

The following is sample output from the show traffic-shape statistics command:

Router# show traffic-shape statistics
Access Queue Packets Bytes Packets Bytes Shaping
I/F List Depth Delayed Delayed Active
Et0       101    0         2         180       0         0         no
Et1              0         0         0         0         0         no

Misconceptions:

None

Related Commands:

None


Command:

show traffic-shape

Mode:

Router#

Syntax:

show traffic-shape [interface-type interface-number]

Syntax Description:

interface-type | (Optional) The type of the interface. If no interface is specified, traffic-shaping details for all configured interfaces are shown.
interface-number | (Optional) The number of the interface.

Command Description:

To display the current traffic-shaping configuration, use the show traffic-shape EXEC command.

You must have first enabled traffic shaping using the traffic-shape rate, traffic-shape group, or frame-relay traffic-shaping command to display traffic-shaping information.

Example:

The following is sample output from the show traffic-shape command:

Router# show traffic-shape
Interface Fa0/0
Access Target Byte Sustain Excess Interval Increment Adapt
VC List Rate Limit bits/int bits/int (ms) (bytes) Active
- 1000000 6250 25000 25000 25 3125 -

Misconceptions:

None

Related Commands:

None


Command:

connect

Mode:

Router>
Router#

Syntax:

connect [ip-address | hostname]

Syntax Description:

ip-address

Ip address of the remote-host

hostname

Name of the remote-host

Command Description:

To log on to a host that supports Telnet, rlogin, or LAT, use the connect EXEC command.

Example:

Router#connect 10.0.0.1
  Trying 10.0.0.1 ...
  % Destination unreachable; gateway or host down
  Router#connect othersystem

Misconceptions:

None

Related Commands:

disconnect

telnet


 Command:

disconnect

Mode:

Router#

Syntax:

disconnect [connection]

Syntax Description:
connection Number of the line or name of the active network connection to be disconnected

Command Description:

To disconnect a line, use the disconnect EXEC command.

Example:

Router#disconnect

Misconceptions:
None

Related Commands:
connect
telnet


 Command:

telnet

Mode:

Router>
Router#

Syntax:

telnet {host} [port] [keyword]

Syntax Description:

host

A host name or an IP address

port

(Optional) A decimal TCP port number; the default is the Telnet router port (decimal 23) on the host

keyword

(Optional) One of the keywords listed in the following table

Command Description:

This command will create a connection to a remote system. The keywords for telnet are shown in the following table:

Table: Telnet Command Connection Options
Option | Description
/debug | Enables Telnet debugging mode.
/encrypt kerberos | Enables an encrypted Telnet session. This keyword is available only if you have the Kerberized Telnet subsystem. If you authenticate using Kerberos Credentials, the use of this keyword initiates an encryption negotiation with the remote server. If the encryption negotiation fails, the Telnet connection will be reset. If the encryption negotiation is successful, the Telnet connection will be established, and the Telnet session will continue in encrypted mode (all Telnet traffic for the session will be encrypted).
/line | Enables Telnet line mode. In this mode, the Cisco IOS software sends no data to the host until you press Return. You can edit the line using the standard Cisco IOS software command-editing characters. The /line keyword is a local switch; the remote router is not notified of the mode change.
/noecho | Disables local echo.
/route path | Specifies loose source routing. The path argument is a list of host names or IP addresses that specify network nodes and ends with the final destination.
/source-interface | Specifies the source interface.
/stream | Turns on stream processing, which enables a raw TCP stream with no Telnet control sequences. A stream connection does not process Telnet options and can be appropriate for connections to ports running UUCP and other non-Telnet protocols.
port-number | Port number.
bgp | Border Gateway Protocol.
chargen | Character generator.
cmd rcmd | Remote commands.
daytime | Daytime.
discard | Discard.
domain | Domain Name Service.
echo | Echo.
exec | EXEC.
finger | Finger
ftp | File Transfer Protocol.
ftp-data | FTP data connections (used infrequently).
gopher | Gopher.
hostname | NIC hostname server.
ident | Ident Protocol.
irc | Internet Relay Chat
klogin | Kerberos login.
kshell | Kerberos shell.
login | Login (rlogin).
lpd | Printer service.
nntp | Network News Transport Protocol.
node | Connect to a specific LAT node
pop2 | Post Office Protocol v2.
pop3 | Post Office Protocol v3.
port | Destination LAT port name.
smtp | Simple Mail Transport Protocol.
sunrpc | Sun Remote Procedure Call.
syslog | Syslog.
tacacs | Specify TACACS security.
talk | Talk.
telnet | Telnet.
time | Time.
uucp | Unix-to-Unix Copy Program.
whois | Nickname.
www | World Wide Web (HTTP).

Example:
Router#telnet  10.0.0.1
Router>telnet  mywebserver.mydomain.com

Misconceptions:
None

Related commands:
ping
disconnect
connect


Command:

distance

Mode:

Router(config-router)#

Syntax:

distance weight {source ip-address {source wildcard}} [ip standard access list number] | [ip standard access list name]

no distance weight {source ip-address {source wildcard}} [ip standard access list number] | [ip standard access list name]

Syntax Description:

weight

The weight argument is used to set a routing protocol's administrative distance. This can be an integer from 1 to 255. The higher the value, the lower the trust rating. Used alone, the argument weight specifies a default administrative distance that the Cisco IOS software uses when no other specification exists for a routing source. Routes with a distance of 255 are not installed in the routing table.

source ip address

(Optional) Routing source's IP address in four-part, dotted decimal notation.

source wildcard

Source wildcard mask in four-part, dotted decimal format. A bit set to 1 in the wildcard mask argument instructs the software to ignore the corresponding bit in the ip address value. A bit set to 0 in the wildcard mask instructs the software to look for a match in the corresponding bit.

ip standard access list number, ip standard access list name

Number or name of a standard IP access list to be applied to incoming routing updates.

Command Description:

The distance command is used to prioritize routing information from different sources, because some pieces of routing information may be more accurate than others. An administrative distance is a rating of the trustworthiness of a routing information source, such as an individual router or a group of routers. In a large network, some routing protocols and some routers can be more reliable than others as sources of routing information. Also, when multiple routing processes are running in the same router for IP, it is possible for the same route to be advertised by more than one routing process. By specifying administrative distance values, you enable the router to intelligently discriminate between sources of routing information. The router will always pick the route whose routing protocol has the lowest administrative distance.

Table: Default Administrative Distances

Route Source

Default Distance

Connected interface

0

Static route

1

EIGRP summary route

5

External BGP

20

Internal EIGRP

90

IGRP

100

OSPF

110

IS-IS

115

RIP

120

EGP

140

External EIGRP

170

Internal BGP

200

Unknown

255

Example:

Router(config-router)#distance 255
Router(config-router)#distance 90 192.31.7.0 0.0.0.255
Router(config-router)#distance 120 128.88.1.3 0.0.0.0

The first distance router configuration command sets the default administrative distance to 255, which instructs the router to ignore all routing updates from routers for which an explicit distance has not been set. The second distance command sets the administrative distance to 90 for all routers on the Class C network 192.31.7.0. The third distance command sets the administrative distance to 120 for the router with the address 128.88.1.3.

Misconceptions:

The distance command does not get sent in routing updates. The command only affects routes on the local router.

Related Commands:

access-list

ip access-list standard

distribute-list

redistribute


Command:

distribute-list in

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

distribute-list {access-list-number| prefix prefix-list-name [gateway prefix-list-nam]} in [interface-type interface-numbe]
no distribute-list {access-list-number | prefix prefix-list-name [gateway prefix-list-name]} in [interface-type interface-number]

Syntax Description:

access-list-number | Standard IP access list number. The list defines which networks are to be received and which are to be suppressed in routing updates.
prefix prefix-list-name | Name of a prefix list. The list defines which networks are to be received and which are to be suppressed in routing updates, based upon matching the network prefix to the prefixes in the list.
gateway prefix-list-name | (Optional) Name of the prefix list to be applied to the gateway of the prefix being updated.
in | Applies the access list to incoming routing updates.
interface-type | (Optional) Interface type.
interface-number | (Optional) Interface number on which the access list should be applied to incoming updates. If no interface is specified, the access list will be applied to all incoming updates.

Command Description:

To filter networks received in updates, use the distribute-list in command in address family or router configuration mode. To disable this function, use the no form of this command.

Using a prefix list allows filtering based upon the prefix length, making it possible to filter either on the prefix list, the gateway, or both for incoming updates.

Specify either an access list or a prefix list with the distribute-list in command.

Use the gateway keyword only with the prefix-list keyword.

To suppress networks from being advertised in updates, use the distribute-list out command.

Example:

In the following example, the BGP routing process accepts only two networks—network 0.0.0.0 and network 131.108.0.0:

Router(config)#access-list 1 permit 0.0.0.0
Router(config)#access-list 1 permit 131.108.0.0
Router(config)#access-list 1 deny 0.0.0.0 255.255.255.255
Router(config)#router bgp
Router(config-router)#network 131.108.0.0
Router(config-router)#distribute-list 1 in

In the following example, The RIP process accepts only prefixes with prefix lengths of /8 to /24:

Router(config)#ip prefix-list max24 seq 5 permit 0.0.0.0/0 ge 8 le 24
Router(config)#router rip
Router(config-router)#network 131.108.0.0
Router(config-router)#distribute-list prefix max24 in

In the following example, the RIP process filters on packet length and accepts routing updates from address 192.1.1.1 only:

Router(config)#ip prefix-list max24 seq 5 permit 0.0.0.0/0 ge 8 le 24
Router(config)#ip prefix-list allowlist seq5 permit 192.1.1.1/32
Router(config)#router rip
Router(config-router)#network 131.108.0.0
Router(config-router)#distribute-list prefix max24 gateway allowlist in

Misconceptions:

The distribute-list in command does not have the same effect on link-state protocols as it does with distance-vector protocols. Link state protocols do not advertise routes. Instead, they advertise links. As a result, a network can be filtered from a router using this command, but other routers will still learn of the route. For example, this command can prevent an OSPF router from entering a route into the routing table, but it cannot prevent that router from advertising link state information about the network. (Source: Bill Parkhurst and Steve Barnes, CCIE Power Session, Networkers 2003. I have personally configured the distribute-list in command under OSPF.)

Related Commands:

access-list (IP extended)
distribute-list out
ip prefix-list
redistribute


Command:

distribute-list out

Mode:

Router(config-router)#

Router(config-router-af)#

Syntax:

distribute-list {access-list-number | prefix prefix-list-name [gateway prefix-list-name]} out [interface-name | routing-process | as-number]
no distribute-list {access-list-number | prefix prefix-list-name [gateway prefix-list-name]} out [interface-name | routing-process | as-number]

Syntax Description:

access-list-number | Standard IP access list number. The list defines which networks are to be received and which are to be suppressed in routing updates.
prefix prefix-list-name | Name of a prefix list. The list defines which networks are to be received and which are to be suppressed in routing updates, based upon matching the network prefix to the prefixes in the list.
gateway prefix-list-name | (Optional) Name of the prefix list to be applied to the gateway of the prefix being updated.
out | Applies the access list to outgoing routing updates.
interface-name | (Optional) Name of a particular interface.
routing-process | (Optional) Name of a particular routing process, or the keyword static or connected.
as-number | (Optional) Autonomous system number.

Command Description:

To suppress networks from being advertised in updates, use the distribute-list out command in address family or router configuration mode. To disable this function, use the no form of this command.

When redistributing networks, a routing process name can be specified as an optional trailing argument to the distribute-list command. Specifying an argument causes the access list or prefix list to be applied to only those routes derived from the specified routing process. After the process-specific access list or prefix list is applied, any access list or prefix list specified by a distribute-list command without a process name argument will be applied. Addresses not specified in the distribute-list command will not be advertised in outgoing routing updates.

Use the gateway keyword only with the prefix-list keyword.

Example:

The following example causes only one network (network 131.108.0.0) to be advertised by a RIP routing process:

Router(config)#access-list 1 permit 131.108.0.0
Router(config)#access-list 1 deny 0.0.0.0 255.255.255.255
Router(config)#router rip
Router(config-router)#network 131.108.0.0
Router(config-router)#distribute-list 1 out

Misconceptions:

This command is intended for use with distance-vector protocols. It can be used with link-state protocols, but it has no effect. Since link-state protocols advertise links instead of routes, this command does not filter outgoing updates.

Related Commands:

access-list (IP extended)
distribute-list in
ip prefix-list
redistribute


Command:

ip policy route-map

Mode:

Router(config-if)#

Syntax:

ip policy route-map map-tag
no ip policy route-map map-tag

Syntax Description:

map-tag Name of the route map to use for policy routing. The name must match a map-tag value specified by a route-map command.

Command Description:

To identify a route map to use for policy routing on an interface, use the ip policy route-map command in interface configuration mode. To disable policy routing on the interface, use the no form of this command.

By default, no policy routing occurs on the interface.

You might enable policy routing if you want your packets to take a route other than the obvious shortest path.

The ip policy route-map command identifies a route map to use for policy routing. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria the conditions under which policy routing is allowed for the interface. The set commands specify the set actions the particular policy routing actions to perform if the criteria enforced by the match commands are met. The no ip policy route-map command deletes the pointer to the route map.

Policy routing can be performed on any match criteria that can be defined in an extended IP access list when using the match ip address command and referencing an extended IP access list.

Example:

The following example sends packets with the destination IP address of 172.120.16.18 to a router at IP address 172.130.3.20:

Router(config-if)#interface serial 0
Router(config-if)#ip policy route-map wethersfield

Router(config-if)#route-map wethersfield
Router(config-if)#match ip address 172.120.16.18
Router(config-if)#set ip next-hop 172.130.3.20

Misconceptions:

None

Related Commands:

match ip address
match length
route-map
set default interface
set interface
set ip default next-hop verify-availability
set ip next-hop


Command:

ip prefix-list

Mode:

Router(config)#

Syntax:

ip prefix-list list-name [seq seq-value] {deny | permit network/length} [ge ge-value] [le le-value]

no ip prefix-list list-name [seq seq-value] {deny | permit network/length} [ge ge-value] [le le-value]

Syntax Description:

list-name

The name of the prefix list.

seq

(Optional) Applies the sequence number to the prefix list entry being created or deleted.

seq-value

(Optional) Specifies the sequence number for the prefix list entry.

deny

Denies access for a matching condition.

permit

Allows access for a matching condition.

network/length

(Mandatory) The network parameter specifies the network number. The / is typed followed by the number of set bits in the network mask. An example is 192.168.10.0/24.

 ge

(Optional) Applies the value specified in the ge-value to the prefix list as the minimum prefix length to be matched. For example, the command ip prefix-list Test deny 192.0.0.0/8 ge 25 denies routes that have 192 in the first octet of the network number and a mask greater than or equal to 25 bits.

ge-value

(Optional) Specifies the minimum number of mask bits that must be matched.

 le

(Optional) Applies the value specified in the le-value to the prefix list. For example, the command ip prefix-list Test permit 192.0.0.0/8 le 24 accepts routes that have 192 in the first octet of the network number and a mask length up to 24 bits. Note that the ge ge-value and le le-value parameters can be combined. For example, ip prefix-list ABC permit 0.0.0.0/0 ge 8 le 24 permits mask lengths from eight to 24 bits in all address space.

le-value

(Optional) Specifies the maximum number of mask bits that must be matched.

Command Description:

A prefix list is used to filter routing updates. Prefix lists are more efficient and easier to manage than distribution lists because lines can be added or deleted to form a prefix list without having to recreate the list. An implicit deny all is at the end of every prefix list. The first match in the prefix list is used and the rest of the prefix list is ignored. An empty prefix list permits all prefixes. The router always begins the filtering starting at the top of the prefix list with the lower sequence number. Sequence numbers are automatically generated by default. Prefix lists are applied to specific BGP neighbors using the neighbor prefix-list command.

Example:

Router(config)#ip prefix-list abc permit 192.0.0.0/8 le 24

Misconceptions:

Some people believe that distribution lists are easier than prefix lists. Advantages include (1) improved performance when loading and route lookup large lists and (2) support for incremental updates and greater flexibility. A prefix list can be changed by adding or deleting specific portions without having to recreate the entire list. The IOS tracks how many times a specific prefix list entry is considered a match. To clear the hit count table of prefix list entries, use the clear ip prefix-list EXEC command.

Related Commands:

neighbor prefix-list

show ip prefix-list

distribute-list


 Command:

passive-interface

Mode:

Router(config-router)#

Syntax:

passive-interface type number

no passive-interface type number

Syntax Description:

type | Interface type
number | Interface number
default | Sets all interfaces as passive. Individual interfaces can have the passive parameter removed by using the no passive-interface type number command. This parameter is useful in ISPs and large enterprise networks that have routers that contain more than 200 interfaces.

Command Description:

The passive-interface command keeps a router from sending routing updates out an interface.

Example:

Router(config-router)#passive interface serial 0/0
Misconceptions:

A passive interface performs differently when using EIGRP, OSPF, IS-IS, and BGP than it does with RIP and IGRP. When using the passive-interface command with EIGRP, inbound and outbound hellos are prevented. Therefore, EIGRP neighboring cannot occur. Use the distribute-list command with EIGRP to control routing updates. When using the passive-interface command with OSPF, routing information is neither sent, nor received through the specified interface. The best way to control OSPF routing updates is to create a stub, NSSA, or totally stub area. The distribute-list command can also be used, but see the Misconceptions area of that command for information on using it within OSPF. The passive-interface command does not work with BGP. BGP is not a traditional routing protocol in that it is never really run on an interface. Instead a neighbor (peer) is specified. BGP has no idea which physical interface is actually performing the neighbor peering. If two BGP neighbors are NOT to peer with each other, do not enter neighbor statements. When configuring other routing protocols, an interface is never specified. Instead the network command is used. When the protocol is active, the protocol knows that an interface is active for that particular protocol. This can been seen by using the show ip protocols command. Conversely, with BGP, network commands are used to specify what networks to advertise and neighbor commands to specify BGP peers. With BGP, use a route map to filter out routes.

Related Commands:
distribute-list
area


Command:

redistribute

Mode:

Router(config-router)#

Syntax:

redistribute protocol [process-id] [metric metric-value] [metric-type type-value] [match {internal | external 1 | external 2}] [tag tag-value] [route-map map-tag] [weight weight] [subnets]

no redistribute protocol [process-id] [metric metric-value] [metric-type type-value] [match {internal | external 1 | external 2}] [tag tag-value] [route-map map-tag] [weight weight] [subnets]

Syntax Description:

protocol

The routing protocol that is being "brought into" or redistributed into another routing protocol. For example, if bringing RIP routes into OSPF, the commands used would be as follows:

Router(config)#router ospf 1
Router(config-router)#redistribute rip

The following keywords can be used with the redistribute command: bgp, egp, eigrp, igrp, iso-igrp, isis, odr, ospf, mobile, static, connected, and rip.

The keyword static is used to redistribute IP static routes.

The keyword connected refers to routes which are established automatically by virtue of having enabled IP on an interface. For routing protocols such as OSPF, these routes will be redistributed as external to the autonomous system.

process-id

For bgp, eigrp, egp, igrp, or eigrp this is an autonomous system number, which is a 16-bit decimal number. For ospf, this is an appropriate OSPF process ID from which routes are to be redistributed. This identifies the routing process. This value takes the form of a nonzero decimal number. For rip, no process-id value is needed.

metric metric-value

Metric used for the redistributed route. If a value is not specified for this option, and no value is specified using the default-metric command, the default metric value is 0. Use a value consistent with the destination protocol. For example, if redistributing RIP into OSPF, use OSPF metrics in the redistribution statement:
Router(config)#router ospf 1
Router(config-router)#redistribute igrp 77 metric 100

OSPF's metric is cost. IGRP uses the combination of bandwidth, delay, reliability, load, and MTU. Since OSPF routers only understand cost, you must translate IGRP's metrics into one that OSPF understands.

metric-type type-value

When used with OSPF, the metric-type type-value defines the external link type associated with the default route advertised into the OSPF routing domain. It can be one of two values:

1—Type 1 external route

2—Type 2 external route

If a metric-type is not specified, the Cisco IOS software adopts a Type 2 external route.

match {internal | external 1 | external 2}

For OPSF, the criteria by which OSPF routes are redistributed into other routing domains. It an be one of the following:

internal—Routes that are internal to a specific autonomous system.

external 1—Routes that are external to the autonomous system, but are imported into OSPF as type 1 external routes.

external 2—Routes that are external to the autonomous system, but are imported into OSPF as type 2 external routes.

tag tag-value

32-bit decimal value attached to each external route. This is not used by the OSPF protocol itself. It may be used to communicate information between Autonomous System Boundary Routers. If none is specified, then the remote autonomous system number is used for routes from BGP and EGP. For other protocols, zero (0) is used.

route-map

Route map should be interrogated to filter the importation of routes from this source routing protocol to the current routing protocol. If not specified, all routes are redistributed. If this keyword is specified, but no route map tags are listed, no routes will be imported.

map-tag

A route map is used to filter the importation of routes. If not specified, all routes are redistributed. The map-tag identifies by a number or name which route map to use. If the route-map keyword is specified, but no route map tags are listed, no routes will be imported.

weight weight

Defines the network weight when redistributing routes into BGP. Weight is an integer from 0 to 65535.

subnets

Allows subnetworks to be redistributed into OSPF. By default, subnetworks are not redistributed into OSPF, only routes that are not subnetted.

Command Description:

To redistribute routes from one routing domain into another routing domain, use the redistribute router configuration command. To disable redistribution, use the no form of this command.

A router receiving a link-state protocol such as OSPF with an internal metric will consider the cost of the route from itself to the redistributing router plus the advertised cost to reach the destination. An external metric only considers the advertised metric to reach the destination.

Whenever you use the redistribute or the default-information router configuration commands to redistribute routes into an OSPF routing domain, the router automatically becomes an Autonomous System Boundary Router (ASBR). An ASBR does not, by default, generate a default route into the OSPF routing domain.

When routes are redistributed between OSPF processes, no OSPF metrics are preserved. When routes are redistributed into OSPF and no metric is specified in the metric keyword, the default metric that OSPF uses is 20 for routes from all protocols except a BGP route, which gets a metric of 1. Furthermore, when the router redistributes from one OSPF process to another OSPF process on the same router, and if no default metric is specified, the metrics in one process are carried to the redistributing process.

The only directly connected routes affected by the redistribute command are the routes not specified by the network command.

You cannot use the default-metric command to affect the metric used to advertise connected routes.

Example:

The following example causes OSPF routes to be redistributed into a BGP domain:

Router(config)#router bgp 109
 Router(config-router)#redistribute ospf 1 match internal

The following example causes IGRP routes (for Autonomous System 1) to be redistributed into an OSPF domain. Subnets are also redistributed. The metric for these routes is converted from an IGRP metric to an OSPF cost of 100:

Router(config)#router ospf 110
Router(config-router)#redistribute igrp 1 metric 100 subnets

The following example causes the specified IGRP process routes to be redistributed into an OSPF domain. The IGRP-derived metric will be converted to an OSPF cost of 100 and RIP routes to a cost value of 200.

Router(config)#router ospf 109 Router(config-router)#redistribute igrp 108 metric 100 subnets
Router(config-router)#redistribute rip metric 200 subnets

In the following example, network 20.0.0.0 will appear as an external LSA in OSPF 1 with a cost of 100 (the cost is preserved):

Router(config)#interface ethernet 0
Router(config-if)#ip address 20.0.0.1 255.0.0.0
Router(config-if)#ip ospf cost 100
Router(config-if)#interface ethernet 1
Router(config-if)#ip address 10.0.0.1 255.0.0.0
Router(config)#router ospf 1
Router(config-router)#network 10.0.0.0 0.255.255.255 area 0
Router(config-if)#redistribute ospf 2 subnet
Router(config)#router ospf 2
Router(config-router)#network 20.0.0.0 0.255.255.255 area 0

The metric value specified in the redistribute command supercedes the metric value specified using the default-metric command.

When redistributing one protocol into another, each protocol's metrics play an important role in redistribution. RIP uses hop count as its metric while IGRP/EIGRP uses bandwidth and delay. When routes are redistributed, a metric must be defined that is understood by the protocol into which the routes are going. There are two methods for defining metrics during redistribution: (1) use the metric parameter in conjunction with the redistribute command or (2) use the default-metric router configuration command. The metric metric-value specified in the redistribute command supersedes the metric value specified by the default-metric command. For example, when defining the metric for a specific redistribution, the redistribute...metric command is used:

Router(config)#router rip

Router(config-router)#redistribute static metric 1

Router(config-router)#redistribute ospf 1 metric 2

The other option is to assign all redistributed routes the same metric using the default-metric command. When this is done all redistributions receive the same metric. In the example shown below, all redistributions receive the metric of one hop count:

Router(config)#router rip

Router(config-router)#redistribute static

Router(config-router)#redistribute ospf 1

Misconceptions:

None

Related Commands:

show ip route

show ip protocols

distribute-list

default-information originate


Command:

show ip local policy

Mode:

Router>

Syntax:

show ip local policy

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the route map used for local policy routing, if any, use the show ip local policy command in EXEC mode.

Example:

The following is sample output from the show ip local policy command:

Router#show ip local policy
Local policy routing is enabled, using route map equal
route-map equal, permit, sequence 10
Match clauses:
length 150 200
Set clauses:
ip next-hop 10.10.11.254
Policy routing matches: 0 packets, 0 bytes
route-map equal, permit, sequence 20
Match clauses:
ip address (access-lists): 101
Set clauses:
ip next-hop 10.10.11.14
Policy routing matches: 2 packets, 172 bytes

Misconceptions:

None.

Related Commands:

ip local policy route-map

match ip address

match length

route-map (IP)

set default interface

set interface

set ip default next-hop verify-availability

set ip next-hop

© Cisco Systems, Inc. 2001, 2002


Command:

show ip policy

Mode:

Router>

Syntax:

show ip policy

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the route map used for policy routing, use the show ip policy command in EXEC mode.

Example:

The following is sample output from the show ip policy command:

Router#show ip policy
Interface Route map
local equal
Ethernet0 equal

Misconceptions:

None.

Related Commands:

match ip address

match length

route-map (IP)

set default interface

set interface

set ip default next-hop verify-availability

set ip next-hop

© Cisco Systems, Inc. 2001, 2002


Command:

show route-map ipc

Mode:

Router>

Syntax:

show route-map ipc

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display counts of the one-way route map interprocess communication (IPC) messages sent from the rendezvous point (RP) to the Versatile Interface Processor (VIP) when NetFlow policy routing is configured, use the show route-map ipc command in EXEC mode.

This command displays the counts of one-way route map IPC messages from the RP to the VIP when NetFlow policy routing is configured. If you execute this command on the RP, the messages are shown as "Sent." If you execute this command on the VIP console, the IPC messages are shown as "Received."

Example:

The following is sample output from the show route-map ipc command when it is executed on the RP:

Router#show route-map ipc
Route-map RP IPC Config Updates Sent
Name: 4
Match access-list: 2
Match length: 0
Set precedence: 1
Set tos: 0
Set nexthop: 4
Set interface: 0
Set default nexthop: 0
Set default interface: 1
Clean all: 2

The following is sample output from the show route-map ipc command when it is executed on the VIP:
VIP-Slot0#show route-map ipc Route-map LC IPC Config Updates Received Name: 4 Match access-list: 2 Match length: 0 Set precedence: 1 Set tos: 0 Set nexthop: 4 Set interface: 0 Set default nexthop: 0 Set default interface: 1 Clean all: 2

Misconceptions:

None.

Related Commands:

set ip next-hop verify-availability

© Cisco Systems, Inc. 2001, 2002


Command:

show route-map

Mode:

Router>

Syntax:

show route-map [map-name]

Syntax Description:

map-name (Optional) Name of a specific route map.

Command Description:

To display configured route maps, use the show route-map command in EXEC mode.

Example:

The following is sample output from the show route-map command:

Router#show route-map
route-map abc, permit, sequence 10
Match clauses:
tag 1 2
Set clauses:
metric 5
route-map xyz, permit, sequence 20
Match clauses:
tag 3 4
Set clauses:
metric 6

Misconceptions:

None.

Related Commands:

redistribute (IP)

route-map (IP)

© Cisco Systems, Inc. 2001, 2002


 Command:

auto-summary

Mode:

Router(config-router)#

Syntax:

auto-summary

Syntax Description:

This command has no arguments or keywords.

Command Description:

This command applies to a RIP routing process. To restore the default behavior of automatic summarization of subnet routes into network-level routes, use the auto summary router configuration command. To disable this function and transmit subprefix routing information across classful network boundaries, use the no form of this command. RIP Version 1 always uses automatic summarization. If you are using RIP Version 2, you can turn off automatic summarization by specifying no auto-summary. Disable automatic summarization if you must perform routing between disconnected subnets. When automatic summarization is off, subnets are advertised.

Example:

Router(config-router)#no auto-summary

Misconceptions:
None

Related Commands:
ip summary-address eigrp
summary-address


Command:

clear ip eigrp neighbors

Mode:

Router#

Syntax:

clear ip eigrp neighbors [ip-address | type number]

Syntax Description:

ip-address

(Optional) Address of the neighbor

type number

(Optional) Interface type and number. Specifying these arguments removes from the neighbor table all entries learned via this interface.

Command Description:

To delete entries from the neighbor table, use the clear ip eigrp neighbors EXEC command.

Example:

Router#clear ip eigrp neighbors 128.12.43.1

Misconceptions:

None

Related Commands:

clear ip route

show ip eigrp


Command:

default-metric (IGRP)

Mode:

Router(config-router)#

Syntax:

default-metric bandwidth delay reliability load mtu
no default-metric bandwidth delay reliability loading mtu

Syntax Description:

bandwidth | Minimum bandwidth of the route in kbps. It can be 0 or any positive integer.
delay | The amount of time it would take for a packet to travel from the router to the destination network while encountering no congestion.
reliability | Likelihood of successful packet transmission expressed as a number from 0 to 255. The value 255 means 100 percent reliability; 0 means no reliability.
load | The level of congestion of the path expressed as a number from 0 to 255 (255 is 100 percent congested).
mtu | Maximum transmission unit (MTU) size of the route in bytes. It can be 0 or any positive integer.

Command Description:

To set metrics for IGRP or Enhanced IGRP (EIGRP), use the default-metric command in router configuration mode. To remove the metric value and restore the default state, use the no form of this command.

A default metric is required to redistribute a protocol into IGRP or EIGRP, unless you specify a metric in the edistribute command. Automatic metric translations occur between IGRP and EIGRP. You do not need default metrics to redistributed IGRP or EIGRP into itself.

Metric defaults have been carefully set to work for a wide variety of networks. Take great care when changing these values.

Keeping the same metrics is supported only when redistributing from IGRP, EIGRP, or static routes.

By default, only connected routes and interface static routes can be redistributed without a default metric.

Example:

The following example takes redistributed Routing Information Protocol (RIP) metrics and translates them into IGRP metrics with values as follows: bandwidth = 1000, delay = 100, reliability = 250, loading = 100, and MTU = 1500.

Router(config)#router igrp 109
Router(config-router)#network 172.16.0.0
Router(config-router)#redistribute rip
Router(config-router)#default-metric 1000 100 250 100 1500

Misconceptions:

The default metric command does not affect EIGRP-to-EIGRP or IGRP-to-EIGRP distribution. To configure EIGRP-to-EIGRP or IGRP-to-EIGRP distribution, use route maps.

Related Commands:

redistribute


Command:

default-metric (Rip)

Mode:

Router(config-router)#

Syntax:

default-metric metric-value
no default-metric [number-value]

Syntax Description:

number-value Default metric value.

Command Description:

To set default metric values for Routing Information Protocol (RIP), use the default-metric command in router configuration mode. To return to the default state, use the no form of this command.

The default-metric command is used in conjunction with the redistribute router configuration command to cause the current routing protocol to use the same metric value for all redistributed routes. A default metric helps solve the problem of redistributing routes with incompatible metrics. Whenever metrics do not convert, using a default metric provides a reasonable substitute and enables the redistribution to proceed.

Example:

The following example shows a router running both RIP and OSPF. The example advertises OSPF-derived routes using RIP and assigns the OSPF-derived routes a RIP metric of 10.

Router(config)#router rip
Router(config-router)#default-metric 10
Router(config-router)#redistribute ospf 109

Misconceptions:

None

Related Commands:

redistribute


Command:

input-queue

Mode:

Router(config-router)#

Syntax:

input-queue depth
no input-queue [depth]

Syntax Description:

depth Numerical value associated with the depth of the RIP input queue. The larger the numerical value, the larger the depth of the queue. The range is from 0 to 1024.

Command Description:

To adjust the depth of the Routing Information Protocol (RIP) input queue, use the input-queue command in router configuration mode. To remove the configured depth and restore the default depth, use the no form of this command.

The default is 50.

Consider using the input-queue command if you have a high-end router sending at high speed to a low-speed router that might not be able to receive at the high speed. Configuring this command will help prevent the routing table from losing information.

Example:

The following example sets the depth of the RIP input queue to 100:

Router(config-router)# input-queue 100

Misconceptions:

None

Related Commands:

None


Command:

ip rip authentication key-chain

Mode:

Router(config-if)#

Syntax:

ip rip authentication key-chain name-of-chain
no ip rip authentication key-chain [name-of-chain]

Syntax Description:

name-of-chain Enables authentication and specifies the group of keys that are valid.

Command Description:

To enable authentication for Routing Information Protocol (RIP) Version 2 packets and to specify the set of keys that can be used on an interface, use the ip rip authentication key-chain command in interface configuration mode. To prevent authentication, use the no form of this command.

If no key chain is configured with the key-chain command, no authentication is performed on the interface (not even the default authentication).

By default, no authentication is provided for RIP packets.

Example:

The following example configures the interface to accept and send any key belonging to the key chain named trees:

Router(config-if)#ip rip authentication key-chain trees

Misconceptions:

None

Related Commands:

key chain


Command:

ip rip authentication mode

Mode:

Router(config-if)#

Syntax:

ip rip authentication mode {text | md5}
no ip rip authentication mode

Syntax Description:

text | Clear text authentication.
md5 | Keyed Message Digest 5 (MD5) authentication.

Command Description:

To specify the type of authentication used in Routing Information Protocol (RIP) Version 2 packets, use the ip rip authentication mode command in interface configuration mode. To restore clear text authentication, use the no form of this command.

RIP Version 1 does not support authentication.

By default, clear text authentication is provided for RIP packets.

Example:

The following example configures the interface to use MD5 authentication:

Router(config-if)#ip rip authentication mode md5

Misconceptions:

None

Related Commands:

ip rip authentication key-chain
key chain


Command:

ip rip receive version

Mode:

Router(config-if)#

Syntax:

ip rip receive version [1] [2]
no ip rip receive version

Syntax Description:

1 | (Optional) Accepts only RIP Version 1 packets on the interface.
2 | (Optional) Accepts only RIP Version 2 packets on the interface.

Command Description:

To specify a Routing Information Protocol (RIP) version to receive on an interface basis, use the ip rip receive version command in interface configuration mode. To follow the global version rules, use the no form of this command.

This command is disabled by default.

Use this command to override the default behavior of RIP as specified by the version command. This command applies only to the interface being configured. You can configure the interface to accept both RIP versions.

Example:

The following example configures the interface to receive both RIP Version 1 and Version 2 packets:

Router(config-if)#ip rip receive version 1 2

The following example configures the interface to receive only RIP Version 1 packets:

Router(config-if)#ip rip receive version 1

Misconceptions:

None

Related Commands:

ip rip authentication key-chain
key chain
ip rip send version
version


Command:

ip rip send version

Mode:

Router(config-if)#

Syntax:

ip rip send version [1] [2]
no ip rip send version

Syntax Description:

1 | (Optional) Sends only RIP Version 1 packets out the interface.
2 | (Optional) Sends only RIP Version 2 packets out the interface.

Command Description:

To specify a Routing Information Protocol (RIP) version to send on an interface basis, use the ip rip send version command in interface configuration mode. To follow the global version rules, use the no form of this command.

The default is to send version 1 or version configured by the version command.

Use this command to override the default behavior of RIP as specified by the version command. This command applies only to the interface being configured.

Example:

The following example configures the interface to send both RIP Version 1 and Version 2 packets out the interface:

Router(config-if)# ip rip send version 1 2

The following example configures the interface to send only RIP Version 2 packets out the interface:

Router(config-if)# ip rip send version 2

Misconceptions:

None

Related Commands:

ip rip receive version
show ip protocols
version


 Command:

ip route

Mode:

Router(config)#

Syntax:

ip route prefix mask {address | interface} [distance] [tag tag] [permanent]

no ip route prefix mask {address | interface} [distance] [tag tag] [permanent]

Syntax Description:

prefix

IP route prefix for the destination

mask

Prefix mask for the destination

address

IP address of the next hop that can be used to reach that network

interface

Network interface to use

distance

(Optional) An administrative distance

tag tag

(Optional) Tag value that can be used as a "match" value for controlling redistribution via route maps

permanent

(Optional) Specifies that the route will not be removed, even if the interface shuts down

Command Description:

To establish static routes, use the ip route global configuration command. To remove static routes, use the no form of this command.

Example:
Router(config)#ip route 10.0.0.0 255.0.0.0 131.108.3.4 110

Misconceptions:
None

Related Commands:
show ip route


 Command:

ip route-cache cef

Mode:

Router(config-if)#

Syntax:

ip route-cache cef

no ip route-cache cef

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable Cisco Express Forwarding (CEF) operation on an interface after CEF operation has been disabled, use the ip route-cache cef interface configuration command. To disable CEF operation on an interface, use the no form of this command. CEF is advanced Layer 3 switching technology for IP. CEF optimizes network performance and scalability for networks with dynamic, topologically dispersed traffic patterns, such as those associated with Web-based applications and interactive type sessions. All interfaces supporting CEF or dCEF are enabled by default when you enable standard CEF or dCEF operation globally. You use the no form of the command to turn off CEF operation on a particular interface. Some interfaces do not support CEF or dCEF and you may want to disable CEF or DCEF on that particular interface. For example, policy routing and CEF cannot be used together. You might want one interface to support policy routing while the other interfaces support CEF. In this case, you would turn on CEF globally, but turn off CEF on the interface configured for policy routing. This enables all but one interface to express forward.

Example:
Router(config-if)#ip route-cache cef

Misconceptions:
None

Related Commands:
ip route-cache
show ip cache


Command:

ip route-cache

Mode:

Router(config-if)#

Syntax:

ip route-cache [cbus]

no ip route-cache [cbus]

ip route-cache same-interface

no ip route-cache same-interface

ip route-cache [flow]

no ip route-cache [flow]

ip route-cache distributed

no ip route-cache distributed

Syntax Description:

cbus

(Optional) Enables both autonomous switching and fast switching. This command is supported only on the AGS+ (with a switch processor card) and the Cisco 7000.

same-interface

Enables fast-switching packets back out the interface on which they arrived.

flow

(Optional) Enables the RSP to perform flow switching on the interface.

distributed

Enables VIP distributed switching on the interface. This feature can be enabled on Cisco 7500 series routers with an RSP and Versatile Interface Processor (VIP) controllers. If both ip route-cache flow and ip route-cache distributed are configured, the VIP does distributed flow switching. If only ip route-cache distributed is configured, the VIP does distributed switching.

Command Description:

Use the ip route-cache interface configuration command to control the use of high-speed switching caches for IP routing. To disable any of these switching modes, use the no form of this command. Using the route cache is often called fast switching. The route cache allows outgoing packets to be load-balanced on a per-destination basis. The ip route-cache command with no additional keywords enables fast switching. Cisco routers generally offer better packet transfer performance when fast switching is enabled, with one exception. On networks using slow serial links (64K and below), disabling fast switching to enable the per-packet load sharing is usually the best choice. Not all switching methods are available on all platforms.

Example:

Router(config-if)#ip route-cache

Misconceptions:

None

Related Commands:

show ip cache


 Command:

ip routing

Mode:

Router(config)#

Syntax:

ip routing

no ip routing

Syntax Description:

This command has no arguments or keywords.

Command Description:

Enables the routing of IP packets. This option is enabled by default, and is required for routing of IP packets. To disable IP routing, use the no form of this command.

Example:
Router(config)#ip routing

Misconceptions:
None

Related Commands:
ipx routing


Command:

ip split-horizon (IGRP)

Mode:

Router(config-if)#

Syntax:

ip split-horizon.

no ip split-horizon

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the split horizon mechanism, use the ip split-horizon command in interface configuration mode. To disable the split horizon mechanism, use the no form of this command.

For all interfaces except those for which either Frame Relay or Switched Multimegabit Data Service (SMDS) encapsulation is enabled, the default condition for this command is ip split-horizon; in other words, the split horizon feature is active. If the interface configuration includes either the encapsulation frame-relay or encapsulation smds command, then the default is for split horizon to be disabled. Split horizon is not disabled by default for interfaces using any of the X.25 encapsulations.

Note: For networks that include links over X.25 packet-switched networks (PSNs), the neighbor router configuration command can be used to defeat the split horizon feature. You can as an alternative explicitly specify the no ip split-horizon command in your configuration. However, if you do so you must similarly disable split horizon for all routers in any relevant multicast groups on that network.

Note: If split horizon has been disabled on an interface and you want to enable it, use the ip split-horizon command to restore the split horizon mechanism.

Note: In general, changing the state of the default for the ip split-horizon command is not recommended, unless you are certain that your application requires a change in order to advertise routes properly. If split horizon is disabled on a serial interface (and that interface is attached to a PSN), you must disable split horizon for all routers and access servers in any relevant multicast groups on that network.

Example:

The following simple example disables split horizon on a serial link. The serial link is connected to an X.25 network.

interface serial 0

encapsulation x25

no ip split-horizon

Misconceptions:

None.

Related Commands:

network (IGRP)


Command:

ip split-horizon (RIP)

Mode:

Router(config-if)#

Syntax:

ip split-horizon

no ip split-horizon

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the split horizon mechanism, use the ip split-horizon command in interface configuration mode. To disable the split horizon mechanism, use the no form of this command.

For all interfaces except those for which either Frame Relay or Switched Multimegabit Data Service (SMDS) encapsulation is enabled, the default condition for this command is ip split-horizon; in other words, the split horizon feature is active. If the interface configuration includes either the encapsulation frame-relay or encapsulation smds command, then the default is for split horizon to be disabled. Split horizon is not disabled by default for interfaces using any of the X.25 encapsulations.

NoteFor networks that include links over X.25 packet switched networks (PSNs), the neighbor router configuration command can be used to defeat the split horizon feature. You can as an alternative explicitly specify the no ip split-horizon command in your configuration. However, if you do so you must similarly disable split horizon for all routers in any relevant multicast groups on that network.

Note: If split horizon has been disabled on an interface and you want to enable it, use the ip split-horizon command to restore the split horizon mechanism.

Note: In general, changing the state of the default for the ip split-horizon command is not recommended, unless you are certain that your application requires a change in order to properly advertise routes. If split horizon is disabled on a serial interface (and that interface is attached to a PSN), you must disable split horizon for all routers and access servers in any relevant multicast groups on that network.

Example:

The following simple example disables split horizon on a serial link. The serial link is connected to an X.25 network.

interface serial 0

encapsulation x25

no ip split-horizon

Misconceptions:

None.

Related Commands:

Neighbor (RIP)


 Command:

ip subnet-zero

Mode:

Router(config)#

Syntax:

ip subnet-zero

no ip subnet-zero

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the use of subnet zero for interface addresses and routing updates, use the ip subnet-zero global configuration command. To restore the default (disabled), use the no form of this command.

Example:
Router(config)#ip subnet-zero

Misconceptions:
none

Related Commands:
ip classless


Command:

ip summary-address rip

Mode:

Router(config-if)#

Syntax:

ip summary-address rip ip-address ip-network-mask
no ip summary-address rip ip-address ip-network-mask

Syntax Description:

ip-address | IP address to be summarized.
ip-network-mask | IP network mask that drives route summarization for the specified IP address.

Command Description:

To configure a Cisco router running Routing Information Protocol (RIP) to advertise a summarized local IP address pool on a network access server so that the address pool can be provided to dialup clients and specify the IP address and network mask that identify the routes to be summarized, use the ip summary-address rip command in router configuration mode. To disable the configuration of the ip summary-address rip command, use the no form of this command.

Example:

In the following example the major network is 10.0.0.0. The summary address 10.2.0.0 overrides the autosummary address of 10.0.0.0, so that 10.2.0.0 is advertised out Ethernet interface 1 and 10.0.0.0 is not advertised.

Router(config)# router rip
Router(config-router)# network 10.0.0.0
Router(config-router)# neighbor 2.2.2.2 peer-group mygroup
Router(config-router)# exit
Router(config)# router interface e1
Router(config-if)# ip address 10.1.1.1 255.255.255.0
Router(config-if)# ip summary-address rip 10.2.0.0 255.255.0.0
Router(config-if)# no ip split-horizon

Misconceptions:

If split horizon is enabled, neither autosummary nor interface summary addresses (those configured with the ip summary-address rip command) are advertised.

Related Commands:

auto-summary
ip split-horizon RIP


Command:

metric holddown

Mode:

Router(config-router)#

Syntax:

metric holddown
no metric holddown

Syntax Description:

This command has no arguments or keywords.

Command Description:

To keep new Interior Gateway Routing Protocol (IGRP) routing information from being used for a certain period of time, use the metric holddown command in router configuration mode. To disable this feature, use the no form of this command.

The holddown state keeps new routing information from being used for a certain period of time. This function can prevent routing loops caused by slow convergence. It is sometimes advantageous to disable the holddown state to increase the ability of the network to quickly respond to topology changes; this command provides this function.

Use the metric holddown command if other routers or access servers within the IGRP autonomous system are not configured with the no metric holddown command. If all routers are not configured the same way, you increase the possibility of routing loops being created.

Example:

The following example disables metric holddown:

Router(config)#router igrp 15
Router(config-router)#network 10.108.0.0
Router(config-router)#network 192.168.7.0
Router(config-router)#no metric holddown

Misconceptions:

None

Related Commands:

metric maximum-hops
metric weights
timers basic


Command:

metric maximum-hops

Mode:

Router(config-router)#

Syntax:

metric maximum-hops hops-number
no metric maximum-hops hops-number

Syntax Description:

hops-number Maximum hop count (in decimal). The default value is 100 hops; the maximum number of hops that can be specified is 255.

Command Description:

To have the IP routing software advertise as unreachable those routes with a hop count higher than is specified by the command (Interior Gateway Routing Protocol [IGRP] only), use the metric maximum-hops command in router configuration mode. To reset the value to the default, use the no form of this command.

The default is 100 hops.

This command provides a safety mechanism that breaks any potential count-to-infinity problems. It causes the IP routing software to advertise as unreachable routes with a hop count greater than the value assigned to the hops-number argument.

Example:

In the following example, a router in autonomous system 71 attached to network 10.0.0.0 wants a maximum hop count of 200, doubling the default. The network administrators configured the router hop count to 200 because they have a complex WAN that can generate a large hop count under normal (nonlooping) operations.

Router(config)#router igrp 71
Router(config-router)#network 10.0.0.0
Router(config-router)#metric maximum-hops 200

Misconceptions:

None

Related Commands:

metric holddown
metric weights


 Command:

network (RIP, RIPv2, and IGRP)

Mode:

Router(config-router)#

Syntax:

network network-address

Syntax Description:

This command has no arguments or keywords.

Command Description:

To specify a list of networks for a Routing Information Protocol (RIP), RIP version 2, or Interior Gateway Routing Protocol (IGRP) routing process, use this form of the network router configuration command. To remove an entry, use the no form of this command.

Example:

Router(config)#router rip
Router(config-router)#network 172.16.0.0
Misconceptions:
None

Related Commands:
router rip
router igrp
show ip route


Command:

offset-list (IGRP)

Mode:

Router(config-router)#

Syntax:

offset-list {access-list-number | access-list-name} {in | out} offset [interface-type interface-number]
no offset-list {access-list-number | access-list-name} {in | out} offset [interface-type interface-number]

Syntax Description:

access-list-number | access-list-name | Standard access list number or name to be applied. Access list number 0 indicates all access lists. If the offset value is 0, no action is taken. For IGRP, the offset is added to the delay component only.
in | Applies the access list to incoming metrics.
out | Applies the access list to outgoing metrics.
offset | Positive offset to be applied to metrics for networks matching the access list. If the offset is 0, no action is taken.
interface-type | (Optional) Interface type to which the offset list is applied.
interface-number | (Optional) Interface number to which the offset list is applied.

Command Description:

To add an offset to incoming and outgoing metrics to routes learned via IGRP (IGRP), use the offset-list command in router configuration mode. To remove an offset list, use the no form of this command.

This command is disabled by default.

The offset value is added to the routing metric. An offset list with an interface type and interface number is considered extended and takes precedence over an offset list that is not extended. Therefore, if an entry passes the extended offset list and the normal offset list, the offset of the extended offset list is added to the metric.

Example:

In the following example, the router applies an offset of 10 to the delay component of the router only to access list 21:

Router(config-router)# offset-list 21 out 10

In the following example, the router applies an offset of 10 to routes learned from Ethernet interface 0:

Router(config-router)# offset-list 21 in 10 ethernet  0

Misconceptions:

None

Related Commands:

None


Command:

offset-list (RIP)

Mode:

Router(config-router)#

Syntax:

offset-list {access-list-number | access-list-name} {in | out} offset [interface-type interface-number]
no offset-list {access-list-number | access-list-name} {in | out} offset [interface-type interface-number]

Syntax Description:

access-list-number | access-list-name | Standard access list number or name to be applied. Access list number 0 indicates all access lists. If the offset value is 0, no action is taken. For RIP, the offset is added to the delay component only.
in | Applies the access list to incoming metrics.
out | Applies the access list to outgoing metrics.
offset | Positive offset to be applied to metrics for networks matching the access list. If the offset is 0, no action is taken.
interface-type | (Optional) Interface type to which the offset list is applied.
interface-number | (Optional) Interface number to which the offset list is applied.

Command Description:

To add an offset to incoming and outgoing metrics to routes learned via Routing Information Protocol (RIP), use the offset-list command in router configuration mode. To remove an offset list, use the no form of this command.

This command is disabled by default.

The offset value is added to the routing metric. An offset list with an interface type and interface number is considered extended and takes precedence over an offset list that is not extended. Therefore, if an entry passes the extended offset list and the normal offset list, the offset of the extended offset list is added to the metric.

Example:

In the following example, the router applies an offset of 10 to the delay component of the router only to access list 21:

Router(config-router)# offset-list 21 out 10

In the following example, the router applies an offset of 10 to routes learned from Ethernet interface 0:

Router(config-router)# offset-list 21 in 10 ethernet 0

Misconceptions:

None

Related Commands:

None


Command:

output-delay

Mode:

Router(config-router)#

Syntax:

output-delay delay
no output-delay [delay]

Syntax Description:

delay Delay (in milliseconds) between packets in a multiple-packet RIP update. The range is from 8 to 50 milliseconds. The default is no delay.

Command Description:

To change the interpacket delay for Routing Information Protocol (RIP) updates sent, use the output-delay command in router configuration mode. To remove the delay, use the no form of this command.

The default is 0 milliseconds.

Consider using this command if you have a high-end router sending at high speed to a low-speed router that might not be able to receive at the high speed. Configuring this command will help prevent the routing table from losing information.

Example:

The following example sets the interpacket delay to 10 milliseconds:

Router(config-router)# output-delay 10

Misconceptions:

None

Related Commands:

None


 Command:

router igrp

Mode:

Router(config)#

Syntax:
router igrp autonomous-system

no router igrp autonomous-system

Syntax Description:

autonomous-system

Autonomous system number that identifies the routes to the other IGRP routers. It is also used to tag the routing information.

Command Description:

To configure the Interior Gateway Routing Protocol (IGRP) routing process, use the router igrp global configuration command. To shut down an IGRP routing process, use the no form of this command.

It is not necessary to have a registered autonomous system number to use IGRP. If you do not have a registered number, you are free to create your own. We recommend that if you do have a registered number, you use it to identify the IGRP process.

Example:

The following example configures an IGRP routing process and assign process number 109:

Router(config)#router igrp 109

Misconceptions:

None

Related Commands:
network (RIP, RIPv2, and IGRP)


 Command:

router rip

Mode:

Router(config)#

Syntax:

router rip

no router rip

Syntax Description:

This command has no arguments or keywords.

Command Description:

To configure the Routing Information Protocol (RIP) routing process, use the router rip global configuration command. To turn off the RIP routing process, use the no form of this command.

Example:

The following example shows how to begin the RIP routing process:

Router(config)#router rip

Misconceptions:

None

Related Commands:
network (RIP, RIPv2, and IGRP)


Command:

snapshot client

Mode:

Router(config-if)#

Syntax:

snapshot client active-time quiet-time [suppress-statechange-updates] [dialer]

no snapshot client active-time quiet-time [suppress-statechange-updates] [dialer]

Syntax Description:

active-time | Amount of time, in minutes, that routing updates are regularly exchanged between the client and server routers. This can be an integer in the range 5 to 100. There is no default value. A typical value is 5 minutes.
quiet-time | Amount of time, in minutes, that routing entries are frozen and remain unchanged between active periods. Routes are not aged during the quiet period, so they remain in the routing table as if they were static entries. This argument can be an integer from 8 to 100000. There is no default value. The minimum quiet time is generally the active time plus 3.
suppress-statechange-updates | (Optional) Disables the exchange of routing updates each time the line protocol goes from "down" to "up" or from "dialer spoofing" to "fully up."
dialer | (Optional) Used if the client router has to dial up the remote router in the absence of regular traffic.

Command Description:

To configure a client router for snapshot routing, use the snapshot client interface configuration command. To disable a client router, use the no form of this command.

Example:

The following example configures a client router for snapshot routing:

Router(config)#interface dialer 1
Router(config-if)#snapshot client 5 600 suppress-statechange-updates dialer

Misconceptions:

None.

Related Commands:

snapshot server

© Cisco Systems, Inc. 2001, 2002


Command:

snapshot server

Mode:

Router(config-if)#

Syntax:

snapshot server active-time [dialer]

no snapshot server active-time [dialer]

Syntax Description:

active-time | Amount of time, in minutes, that routing updates are regularly exchanged between the client and server routers. This can be an integer in the range 5 to 100. There is no default value. A typical value is 5 minutes.
dialer | (Optional) Allows the client router to dial up the remote router in the absence of regular traffic.

Command Description:

To configure a server router for snapshot routing, use the snapshot server interface configuration command. To disable a server router, use the no form of this command.

Example:

The following example configures a server router for snapshot routing:

    Router(config)#interface serial 0
    Router(config-if)#snapshot server 5

Misconceptions:

None.

Related Commands:

snapshot client

© Cisco Systems, Inc. 2001, 2002


 Command:

summary-address

Mode:

Router(config-router)#

Syntax:

summary-address address mask {level-1 | level-1-2 | level-2} prefix mask [not-advertise]
[tag tag]

no summary-address address mask {level-1 | level-1-2 | level-2}

Syntax Description:

address

Summary address designated for a range of addresses.

mask

IP subnet mask used for the summary route.

level-1

Only routes redistributed into Level 1 are summarized with the configured address/mask value. This keyword applies to IS-IS only.

level-1-2

The summary router is injected into both a Level 1 area and a Level 2 subdomain. This keyword applies to IS-IS only.

level-2

Routes learned by Level 1 routing will be summarized into the Level 2 backbone with the configured address/mask value. This keyword applies to IS-IS only.

prefix

IP route prefix for the destination.

mask

IP subnet mask used for the summary route.

not-advertise

(Optional) Used to suppress routes that match the prefix/mask pair. This keyword applies to OSPF only.

tag tag

(Optional) Tag value that can be used as a "match" value for controlling redistribution via route maps. This keyword applies to OSPF only.

Command Description:

Use the summary-address router configuration command to create aggregate addresses for OSPF. The no summary-address command restores the default.

Multiple groups of addresses can be summarized for a given level. Routes learned from other routing protocols can also be summarized. The metric used to advertise the summary is the smallest metric of all the more specific routes. This command helps reduce the size of the routing table.

Using this command for OSPF causes an OSPF autonomous system boundary router (ASBR) to advertise one external route as an aggregate for all redistributed routes that are covered by the address. For OSPF, this command summarizes only routes from other routing protocols that are being redistributed into OSPF. Use the area range command for route summarization between OSPF areas.
Example:

In the following example, summary address 10.1.0.0 includes address 10.1.1.0, 10.1.2.0, 10.1.3.0, and so forth. Only the address 10.1.0.0 is advertised in an external link state advertisement.

Router(config-router)#summary-address 10.1.0.0 255.255.0.0
Misconceptions:
None

Related commands:
area
ip ospf authentication-key


 Command:

timers basic

Mode:

Router(config-router)#

Syntax:
timers basic update invalid holddown flush [sleeptime]

no timers basic

Syntax Description:

update

Rate in seconds at which updates are sent. This is the fundamental timing parameter of the routing protocol.

invalid

The passing of an interval of time in seconds which a route is declared invalid. It should be at least three times the value of the update. A route becomes invalid when there is an absence of updates that refresh the route. The route then enters holddown. The route is marked inaccessible and advertised as unreachable. However, the route is still used for forwarding packets.

holddown

Interval in seconds during which routing information regarding better paths is suppressed. It should be at least three times the value of update. A route enters into a holddown state when an update packet is received that indicates the route is unreachable. The route is marked inaccessible and advertised as unreachable. However, the route is still used for forwarding packets. When holddown expires, routes advertised by other sources are accepted and the route is no longer inaccessible.

flush

Amount of time in seconds that must pass before the route is removed from the routing table; the interval specified must be at least the sum of invalid and holddown. If it is less than this sum, the proper holddown interval cannot elapse, which results in a new route being accepted before the holddown interval expires.

sleeptime

(Optional) Interval in milliseconds for postponing routing updates in the event of a flash update. The sleeptime value should be less than the update time. If the sleeptime is greater than the update time, routing tables will become unsynchronized.

Command Description:

To adjust IGRP network timers, use the timers basic router configuration command. To restore the default timers, use the no form of this command.

The basic timing parameters for IGRP are adjustable. Since this routing protocol is executing a distributed, asynchronous routing algorithm, it is important that these timers be the same for all routers and access servers in the network.

Note The current and default timer values can be seen by inspecting the output of the show ip protocols EXEC command. The relationships of the various timers should be preserved as described previously.

Example:

The following example sets updates to be broadcast every 5 seconds. If a router is not heard from in 15 seconds, the route is declared unusable. Further information is suppressed for an additional 15 seconds. At the end of the suppression period, the route is flushed from the routing table.

Router(config)#router igrp 109
Router(config-router)#timers basic 5  15  15  30

Note that by setting a short update period, you run the risk of congesting slow-speed serial lines; however, this is not a big concern on faster-speed Ethernets and T1-rate serial lines. Also, if you have many routes in your updates, you can cause the routers to spend an excessive amount of time processing updates.
Misconceptions:
None

Related commands:

None


Command:

timers active-time

Mode:

Router(config-router)#

Syntax:

timers active-time [time-limit | disabled]
no timers active-time

Syntax Description:

time-limit | EIGRP active-time limit (in minutes). The time range is from 1to 4294967295 minutes.
disabled | Disables the timers and permits the routing wait time to remain active indefinitely.

Command Description:

To adjust routing wait time, use the timers active-time command in router configuration mode. To disable this function, use the no form of the command.

In EIGRP, there are timers that control the time the router waits (after sending a query) before declaring the route to be in the stuck in active (SIA) state.

Example:

In the following example, the routing wait time is 200 minutes on the specified route:

Router(config)#router igrp 5
Router(config-router)#timers active-time 200

In the following example, the routing wait time is indefinite on the specified route:

Router(config)#router igrp 5
Router(config-router)# timers active-time disabled

Misconceptions:

None

Related Commands:

show ip eigrp topology


Command:

validate-update-source

Mode:

Router(config-router)#

Syntax:

validate-update-source
no validate-update-source

Syntax Description:

This command has no arguments or keywords.

Command Description:

To have the Cisco IOS software validate the source IP address of incoming routing updates for Routing Information Protocol (RIP) and Interior Gateway Routing Protocol (IGRP) routing protocols, use the validate-update-source command in router configuration mode. To disable this function, use the no form of this command.

The behavior of this command is enabled by default.

This command is applicable only to RIP and IGRP. The software ensures that the source IP address of incoming routing updates is on the same IP network as one of the addresses defined for the receiving interface.

Disabling split horizon on the incoming interface will also cause the system to perform this validation check.

For unnumbered IP interfaces (interfaces configured as IP unnumbered), no checking is performed.

Example:

The following example configures a router not to perform validation checks on the source IP address of incoming RIP updates:

Router(config)#router rip
Router(config-router)#network 10.105.0.0
Router(config-router)#no validate-update-source

Misconceptions:

None

Related Commands:

None


%command%

Command:

show glbp

Mode:

Router#

Syntax:

show glbp [interface-type interface-number] [group] [state] [brief]

Syntax Description:

interface-type interface-number | (Optional) Interface type and number for which output is displayed.
group | (Optional) GLBP group number in the range from 0 to 1023.
state | (Optional) State of the GLBP router, one of the following: active, disabled, init, listen, speak, or standby.
brief | (Optional) Summarizes each virtual gateway or virtual forwarder with a single line of output.

Command Description:

To display Gateway Load Balancing Protocol (GLBP) information, use the show glbp command in privileged EXEC mode.

Example:

The following is sample output from the show glbp command:

Router# show glbp

FastEthernet0/0 - Group 10

State is Active

2 state changes, last state change 23:50:33

Virtual IP address is 10.21.8.10

Hello time 5 sec, hold time 18 sec

Next hello sent in 4.300 secs

Redirect time 600 sec, forwarder time-out 7200 sec

Authentication text "stringabc"

Preemption enabled, min delay 60 sec

Active is local

Standby is unknown

Priority 254 (configured)

Weighting 105 (configured 110), thresholds: lower 95, upper 105

Track object 2 state Down decrement 5

Load balancing: host-dependent

There is 1 forwarder (1 active)

Forwarder 1

State is Active

1 state change, last state change 23:50:15

MAC address is 0007.b400.0101 (default)

Owner ID is 0005.0050.6c08

Redirection enabled

Preemption enabled, min delay 60 sec

Active is local, weighting 105

The following is sample output from the show glbp command with the brief keyword specified:

Router# show glbp brief

Interface Grp Fwd Pri State Address Active router Standby router

Fa0/0 10 - 254 Active 10.21.8.10 local unknown

Fa0/0 10 1 7 Active 0007.b400.0101 local -

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


 Command:

show ip cache

Mode:

Router>

Syntax:

show ip cache [prefix mask] [type number]

Syntax Description:

prefix

(Optional) Display only the entries in the cache that match the prefix and mask combination.

mask

(Optional) Display only the entries in the cache that match the prefix and mask combination.

type

(Optional) Display only the entries in the cache that match the interface type and number combination.

number

(Optional) Display only the entries in the cache that match the interface type and number combination.

Command Description:

To display the routing table cache used to fast switch IP traffic, use the show ip cache EXEC command. The show ip cache display shows MAC headers up to 92 bytes.

Example:
Router#show ip cache

  IP routing cache version 4490, 141 entries, 20772 bytes, 0 hash overflows
  Minimum invalidation interval 2 seconds, maximum interval 5 seconds,
     quiet interval 3 seconds, threshold 0 requests
  Invalidation rate 0 in last 7 seconds, 0 in last 3 seconds
  Last full cache invalidation occurred 0:06:31 ago

  Prefix/Length
  Age
  Interface       MAC Header
  131.108.1.1/32      0:01:09
  Ethernet0/0     AA000400013400000C0357430800
  131.108.1.7/32      0:04:32
  Ethernet0/0     00000C01281200000C0357430800
  131.108.1.12/32     0:02:53
  Ethernet0/0     00000C029FD000000C0357430800
  131.108.2.13/32     0:06:22
  Fddi2/0
  00000C05A3E000000C035753AAAA030000000800
  131.108.2.160/32    0:06:12
  Fddi2/0
  00000C05A3E000000C035753AAAA030000000800
  131.108.3.0/24      0:00:21
  Ethernet1/2     00000C026BC600000C03574D0800
  131.108.4.0/24      0:02:00
  Ethernet1/2     00000C026BC600000C03574D0800
  131.108.5.0/24      0:00:00
  Ethernet1/2     00000C04520800000C03574D0800
  131.108.10.15/32    0:05:17
  Ethernet0/2     00000C025FF500000C0357450800
  131.108.11.7/32     0:04:08
  Ethernet1/2     00000C010E3A00000C03574D0800
  131.108.11.12/32    0:05:10
  Ethernet0/0     00000C01281200000C0357430800
  131.108.11.57/32    0:06:29
  Ethernet0/0     00000C01281200000C0357430800

Misconceptions:
None

Related commands:
ip route-cache
ip route-cache cef


Command:

show ip rip database

Mode:

Router>

Syntax:

show ip rip database [ip-address {mask}]

Syntax Description:

ip-address

(Optional) Address about which routing information should be displayed.

mask

Argument for the subnet mask. The subnet mask must also be specified if the IP address argument is entered.

Command Description:

To display summary address entries in the Routing Information Protocol (RIP) routing database entries if relevant are routes being summarized based upon a summary address, use the show ip rip database command in EXEC mode.

Summary address entries will appear in the database only if relevant child routes are being summarized. When the last child route for a summary address becomes invalid, the summary address is also removed from the routing table.

The RIP private database is populated only if triggered extensions to RIP are enabled with the ip rip triggered command.

Example:

The following output shows a summary address entry for route 10.11.0.0/16, with three child routes active:

Router#show ip rip database

10.0.0.0/8 auto-summary

10.11.11.0/24 directly connected, Ethernet2

10.1.0.0/8 auto-summary

10.11.0.0/16 int-summary

10.11.10.0/24 directly connected, Ethernet3

10.11.11.0/24 directly connected, Ethernet4

10.11.12.0/24 directly connected, Ethernet5

The following is sample output from the show ip rip database command with a prefix and mask:

Router#show ip rip database 172.19.86.0 255.255.255.0

172.19.86.0/24

[1] via 172.19.67.38, 00:00:25, Serial0

[2] via 172.19.70.36, 00:00:14, Serial1

Table 3 describes the fields in the displays.

Table 3 show ip rip database Field Descriptions

Field

Description

10.0.0.0/16 auto-summary

Summary address entry.

10.11.11.0/24 directly connected, Ethernet0

Directly connected entry for Ethernet 0.

172.19.65.0/24

[1] via 172.19.70.36, 00:00:17, Serial0

[2] via 172.19.67.38, 00:00:25, Serial1

The destination 172.19.65.0/24 is learned via RIP. There are two sources advertising it. One is 172.19.70.36 via Serial interface0, and it was updated 17 seconds ago. The other source is 172.19.67.38 via Serial interface 1, and it was updated 25 seconds ago.

Misconceptions:

None.

Related Commands:

ip rip triggered

ip summary-address rip

show ip protocols


Command:

show ip route summary

Mode:

Router>

Syntax:

show ip route summary

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display the current state of the routing table, use the show ip route summary command in EXEC mode.

Example:

The following is sample output from the show ip route summary command:

Router#show ip route summary
Route Source Networks Subnets Overhead Memory (bytes)
connected 0 3 126 360
static 1 2 126 360
igrp 109 747 12 31878 91080
internal 3 360
Total 751 17 32130 92160

Misconceptions:

None.

Related Commands:

show ip route

© Cisco Systems, Inc. 2001, 2002


Command:

show ip route supernets-only

Mode:

Router>

Syntax:

show ip route supernets-only

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information about supernets, use the show ip route supernets-only privileged command in EXEC mode.

Example:

The following is sample output from the show ip route supernets-only command. This display shows supernets only; it does not show subnets.

Router#show ip route supernets-only
Codes: I - IGRP derived, R - RIP derived, O - OSPF derived
C - connected, S - static, E - EGP derived, B - BGP derived
i - IS-IS derived, D - EIGRP derived
* - candidate default route, IA - OSPF inter area route
E1 - OSPF external type 1 route, E2 - OSPF external type 2 route
L1 - IS-IS level-1 route, L2 - IS-IS level-2 route
EX - EIGRP external route
Gateway of last resort is not set
B 172.160.0.0 (mask is 255.255.0.0) [20/0] via 172.160.72.30, 0:00:50
B 192.0.0.0 (mask is 255.0.0.0) [20/0] via 172.160.72.24, 0:02:50

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show debugging

Mode:

Router#

Syntax:

show debugging

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display information about the types of debugging that are enabled for your router, use the show debugging privileged EXEC command.

Example:

The following is sample output from the show debugging command. In this example, three types of CDP debugging are enabled.

Router# show debugging

CDP:

  CDP packet info debugging is on

  CDP events debugging is on

  CDP neighbor info debugging is on

Misconceptions:

None.

Related Commands:

debug


Command:

show etherchannel

Mode:

Switch#
Switch>

Syntax:

show etherchannel [channel-group-number] {brief | detail | load-balance | port | port-channel | summary} [ | {begin | exclude | include} expression]

Syntax Description:

channel-group-number | (Optional) Number of the channel group. Valid numbers range from 1 to 6.
brief | Display a summary of EtherChannel information.
detail | Display detailed EtherChannel information.
load-balance | Display the load-balance or frame-distribution scheme among ports in the port channel.
port | Display EtherChannel port information.
port-channel | Display port-channel information.
summary | Display a one-line summary per channel-group.
begin | (Optional) Display begins with the line that matches the expression.
exclude | (Optional) Display excludes lines that match the expression.
include | (Optional) Display includes lines that match the specified expression.
expression | Expression in the output to use as a reference point.

Command Description:

Use the show etherchannel user EXEC command to display EtherChannel information for a channel.

If you do not specify a channel-group, all channel groups appear.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Example:

This is an example of output from the show etherchannel 1 detail command:

Switch> show etherchannel 1 detail
Group state = L2
Ports: 1 Maxports = 8
Port-channels: 1 Max Port-channels = 1
Ports in the group:
-------------------
Port: Fa0/3
------------
Port state = Down Not-in-Bndl
Channel group = 1 Mode = Automatic-Sl Gcchange = 0
Port-channel = null GC = 0x00000000 Pseudo port-channel = Po1
Port index = 0 Load = 0x00
Flags: S - Device is sending Slow hello. C - Device is in Consistent state.
A - Device is in Auto mode. P - Device learns on physical port.
d - PAgP is down.
Timers: H - Hello timer is running. Q - Quit timer is running.
S - Switching timer is running. I - Interface timer is running.
Local information:
Hello Partner PAgP Learning Group
Port Flags State Timers Interval Count Priority Method Ifindex
Fa0/3 dA U1/S1 1s 0 200 Any 0
Age of the port in the current state: 10d:23h:07m:37s
Port-channels in the group:
----------------------
Port-channel: Po1
------------
Age of the Port-channel = 03d:02h:22m:43s
Logical slot/port = 1/0 Number of ports = 0
GC = 0x00000000 HotStandBy port = null
Port state = Port-channel Ag-Not-Inuse

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


 Command:

show interfaces fair-queue

Mode:

Router#

Syntax:

show interfaces [interface-type interface-number] fair-queue

Syntax Description:

interface-type

(Optional) The name of the interface.

interface-number

(Optional) The number of the interface.

Command Description:

To display information and all statistics about weighted fair queueing for a VIP-based interface, use the show interfaces fair-queue EXEC command.

Example:

The following is a sample of output from the show interfaces fair-queue command:

Router#show interfaces fair-queue

Hssi0/0/0 queue size 0
        packets output 1417079, drops 2
 WFQ: aggregate queue limit 54, individual queue limit 27
    max available buffers 54

     Class 0: weight 10 limit 27 qsize 0 packets output 1150 drops 0
     Class 1: weight 20 limit 27 qsize 0 packets output 0 drops 0
     Class 2: weight 30 limit 27 qsize 0 packets output 775482 drops 1
     Class 3: weight 40 limit 27 qsize 0 packets output 0 drops 0

The table describes the fields and statistics shown in this display.

Table: show interfaces fair-queue Field Descriptions
Field Description

queue size

Current output queue size for this interface

packets output

Number of packets transmitted out this interface, or, number of packets in this class transmitted out the interface.

drops

Number of packets dropped, or, number of packets in this class dropped

aggregate queue limit

Aggregate limit, in number of packets

individual queue limit

Individual limit, in number of packets

max available buffers

Available buffer space allocated to aggregate queue limit, in number of packets

Class

QoS group or ToS class

weight

Percent of bandwidth allocated to this class during periods of congestion

limit

Queue limit for this class, in number of packets

qsize

Current size of the queue for this class

Misconceptions:
None

Related commands:
show interfaces


Command:

show ip extcommunity-list

Mode:

Router>

Syntax:

show ip extcommunity-list [community-list-number]

Syntax Description:

community-list-number (Optional) Community list number in the range from 1 to 199. A standard extended list is from 1 to 99. An expanded extended list is from 100 to 199.

Command Description:

To display routes that are permitted by an extended community list, use the show ip extcommunity-list command in EXEC mode.

If a specific extended community list number is not specified when the show ip extcommunity-list command is entered, all locally configured extended community lists will be displayed by default.

Example:

The following is sample output from the show ip extcommunity-list command in EXEC mode:

Router#show ip extcommunity-list
Extended community standard list 1
permit RT:901:10
permit SoO:802:20
deny RT:703:30 SoO:604:40
Extended community standard list 99
permit RT:604:40 SoO:505:50
deny RT:406:60 SoO:307:70

Misconceptions:

None.

Related Commands:

show route-map

© Cisco Systems, Inc. 2001, 2002


show ip interface brief

Command:

show ip interface brief

Mode:

Router>

Syntax:

show ip interface brief

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display a brief summary of the information and status for an IP address, use the show ip interface brief command in EXEC mode.

Example:

The following is a sample of output from the show ip interface brief command:

Router#show ip interface brief

Interface    IP-Address      OK?  Method     Status                 Protocol
Ethernet0    172.30.160.22   YES  NVRAM      up                     up

Note: Any interface listed with OK? value "NO" does not have a valid configuration

Misconceptions:

None

Related commands:

show ip interface


 Command:

show modemcap

Mode:

Router>

Syntax:

show modemcap [modem-name]

Syntax Description:
modem-name (Optional) The name of the modem (such as Codex_3260).

Command Description:

To display the values set for the current modem, use the show modemcap EXEC command. This display lists the modems for which the router has entries. To display the attributes associated with a specific modem, use the show modemcap EXEC command with the optional modem name argument.

Example:

Router#show modemcap
default
codex_3260
usr_courier
usr_sportster
hayes_optima
global_village
viva
telebit_t3000
microcom_hdms
microcom_server
nec_v34
nec_v110
nec_piafs
cisco_v110
mica

Misconceptions:

None

Related commands:
modemcap entry
modem autoconfigure type
modemcap edit


%command%

Command:

show policy-map interface

Mode:

Router>

Syntax:

show policy-map interface interface-name [vc [vpi/] vci][dlci dlci] [input | output]

Syntax Description:

interface-name

Name of the interface or subinterface whose policy configuration is to be displayed.

vc

(Optional) For ATM interfaces only, shows the policy configuration for a specified PVC. The name can be up to 16 characters long.

vpi/

(Optional) ATM network virtual path identifier (VPI) for this PVC. On the Cisco 7200 and 7500 series routers, this value ranges from 0 to 255.

The vpi and vci arguments cannot both be set to 0; if one is 0, the other cannot be 0.

vci

(Optional) ATM network virtual channel identifier (VCI) for this PVC. This value ranges from 0 to 1 less than the maximum value set for this interface by the atm vc-per-vp command. Typically, the lower values 0 to 31 are reserved for specific traffic (F4 Operation, Administration, and Maintenance (OAM), switched virtual circuit (SVC) signaling, Integrated Local Management Interface (ILMI), and so on) and should not be used.

The VCI is a 16-bit field in the header of the ATM cell. The VCI value is unique only on a single link, not throughout the ATM network, because it has local significance only.

The vpi and vci arguments cannot both be set to 0; if one is 0, the other cannot be 0.

dlci

(Optional) Indicates that a specific PVC for which policy configuration will be displayed.

dlci

(Optional) A specific data-link connection identifier (DLCI) number used on the interface. Policy configuration for the corresponding PVC will be displayed when a DLCI is specified.

input

(Optional) Indicates that the statistics for the attached input policy will be displayed.

output

(Optional) Indicates that the statistics for the attached output policy will be displayed.

Command Description:

To display the packet statistics of all classes that are configured for all service policies either on the specified interface or subinterface or on a specific permanent virtual circuit (PVC) on the interface, use the show policy-map interface command in EXEC mode.

Example:

The following sample output from the show policy-map interface command illustrates properly calculated and synchronized values for offered rate and drop rate as well as conformed and exceed bps rates.

router#show policy-map interface ethernet 3/0
  Ethernet3/0

   Service-policy input: p2

     Class-map: rtp1 (match-all)
       88325 packets, 11040625 bytes
       30 second offered rate 400000 bps, drop rate 150000 bps
       Match: ip rtp 2000 10
       police:
         250000 bps, 7750 limit, 7750 extended limit
         conformed 55204 packets, 6900500 bytes; action: transmit
         exceeded 33122 packets, 4140250 bytes; action: drop
         conformed 250000 bps, exceed 150000 bps violate 0 bps

       Service-policy : p3b

         Class-map: rtp1 (match-all)
           88325 packets, 11040625 bytes
           30 second offered rate 400000 bps, drop rate 50000 bps
           Match: ip rtp 2000 10
           police:
             200000 bps, 6250 limit, 6250 extended limit
             conformed 44163 packets, 5520375 bytes; action: transmit
             exceeded 11041 packets, 1380125 bytes; action: drop
             conformed 200000 bps, exceed 50000 bps violate 0 bps

         Class-map: class-default (match-any)
           0 packets, 0 bytes
           30 second offered rate 0 bps, drop rate 0 bps
           Match: any

Misconceptions:

None

Related commands:

show policy-map

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

show policy-map

Mode:

Router>

Syntax:

show policy-map [policy-map]

Syntax Description:

policy-map

(Optional) The name of the service policy map whose complete configuration is to be displayed.

Command Description:

To display the configuration of all classes for a specified service policy map or all classes for all existing policy maps, use the show policy-map command in EXEC mode.

Example:

The following example displays the contents of the service policy map called po1:

Router#show policy-map po1

Policy Map po1
Weighted Fair Queueing
Class class1
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class2
Bandwidth 937 (kbps) Max thresh 64 (packets)

Class class3
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class4
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class5
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class6
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class7
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class8
Bandwidth 937 (kbps) Max thresh 64 (packets)

The following example displays the contents of all policy maps on the router:

Router#show policy-map

Policy Map poH1
Weighted Fair Queueing
Class class1
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class2
Bandwidth 937 (kbps) Max thresh 64 (packets)

Class class3
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class4
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class5
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class6
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class7
Bandwidth 937 (kbps) Max thresh 64 (packets)
Class class8
Bandwidth 937 (kbps) Max thresh 64 (packets)

Policy Map policy2
Weighted Fair Queueing
Class class1
Bandwidth 300 (kbps) Max thresh 64 (packets)
Class class2
Bandwidth 300 (kbps) Max thresh 64 (packets)

Class class3
Bandwidth 300 (kbps) Max thresh 64 (packets)
Class class4
Bandwidth 300 (kbps) Max thresh 64 (packets)
Class class5
Bandwidth 300 (kbps) Max thresh 64 (packets)
Class class6
Bandwidth 300 (kbps) Max thresh 64 (packets)

Misconceptions:

None

Related commands:

show policy-map interface

© Cisco Systems, Inc. 2001, 2002


 Command:

show processes

Mode:

Router>

Syntax:

show processes [cpu]

Syntax Description:

cpu

(Optional) Displays detailed CPU utilization statistics.

Command Description:

Use the show processes EXEC command to display information about the active processes.

Examples:

The following is a sample of output from the show processes command:

Router#show processes

CPU utilization for five seconds: 21%/0%; one minute: 2%; five minutes: 2%
PID QTy	      PC Runtime (ms)   Invoked   uSecs     Stacks    TTY  Process
  1 Mwe  2FEA4E         1808	    464    3896     1796/3000   0  IP-EIGRP Router
  2 Lst  11682	       10236	    109   93908     1828/2000   0  Check heaps
  3 Mst  3AE9C             0	    280       0     1768/2000   0  Timers
  4 Lwe  74AD2             0         12	      0     1492/2000   0  ARP Input
  5.ME   912E4	           0	      2       0     1892/2000   0  IPC Zone Manager
  6.ME   91264	           0	      1       0     1936/2000   0  IPC Realm Manager
  7.ME   91066             0         30	      0     1784/2000   0  IPC Seat Manager
  8.ME  133368             0	      1	      0     1928/2000   0  CXBus hot stall
  9.ME  1462EE	           0	      1       0     1940/2000   0  Microcode load
 10 Msi 127538             4         76      52     1608/2000   0  Env Mon
 11.ME  160CF4             0          1       0     1932/2000   0  MIP Mailbox
 12 Mwe 125D7C	           4	    280	     14     1588/2000   0  SMT input
 13 Lwe AFD0E	           0	      1       0     1772/2000   0  Probe Input
 14 Mwe AF662	           0          1	      0     1784/2000   0  RARP Input
 15 Hwe A1F9A	         228	    549	    415     3240/4000   0  IP Input
 16 Msa C86A0	           0        114	      0     1864/2000   0  TCP Timer
 17 Lwe CA700              0	      1       0     1756/2000   0  TCP Protocols
 18.ME  CCE7C	           0          1	      0     1940/2000   0  TCP Listener
 19 Mwe AC49E	           0          1	      0     1592/2000   0  BOOTP Server
 20 Mwe 10CD84	          24         77	    311     1652/2000   0  CDP Protocol
 21 Mwe 27BF82             0	      2	      0     1776/2000   0  ATMSIG Input

The following is a sample of output from the show processes cpu command:

Router#show processes cpu

CPU utilization for five seconds: 5%/2%; one minute: 3%; five minutes: 2%
  PID  Runtime (ms)    Invoked   uSecs   5Sec  1Min  5Min  TTY Process
    1          1736         58   29931     0%    0%    0%  Check heaps
    2            68        585     116  1.00% 1.00%    0%  IP Input
    3             0        744       0     0%    0%    0%  TCP Timer
    4             0          2       0     0%    0%    0%  TCP Protocols
    5             0          1       0     0%    0%    0%  BOOTP Server
    6            16        130     123     0%    0%    0%   ARP Input
    7             0          1       0     0%    0%    0%  Probe Input
    8             0          7       0     0%    0%    0%  MOP Protocols
    9             0          2       0     0%    0%    0%  Timers
   10           692         64   10812     0%    0%    0%  Net Background
   11             0          5       0     0%    0%    0%  Logger
   12             0         38       0     0%    0%    0%  BGP Open
   13             0          1       0     0%    0%    0%  Net Input
   14           540       3466     155     0%    0%    0%  TTY Background
   15             0          1       0     0%    0%    0%  BGP I/O
   16          5100       1367    3730     0%    0%    0%  IGRP Router
   17            88       4232      20  0.20% 1.00%    0%  BGP Router
   18           152      14650      10     0%    0%    0%  BGP Scanner
   19           224         99    2262     0%    0% 1.00%  Exec

The table below describes significant fields shown in the two displays.

Table: show processes Field Descriptions
Field Description

CPU utilization for five seconds

CPU utilization for the last 5 seconds. The second number indicates the percent of CPU time spent at the interrupt level.

one minute

CPU utilization for the last minute

five minutes

CPU utilization for the last 5 minutes

PID

Process ID

Q

Process queue priority. Possible values: H (high), M (medium), L (low).

Ty

Scheduler test. Possible values: * (currently running), E (waiting for an event), S (ready to run, voluntarily relinquished processor), rd (ready to run, wakeup conditions have occurred), we (waiting for an event), sa (sleeping until an absolute time), si (sleeping for a time interval), sp (sleeping for a time interval (alternate call), st (sleeping until a timer expires), hg (hung; the process will never execute again), xx dead. (The process has terminated, but not yet been deleted).

PC

Current program counter

Runtime (ms)

CPU time the process has used, in milliseconds

Invoked

Number of times the process has been invoked

uSecs

Microseconds of CPU time for each process invocation

Stacks

Low water mark/Total stack space available, shown in bytes

TTY

Terminal that controls the process

Process

Name of process

5Sec

CPU utilization by task in the last 5 seconds

1Min

CPU utilization by task in the last minute

5Min

CPU utilization by task in the last 5 minutes

Note Because the network server has a 4-millisecond clock resolution, run times are considered reliable only after a large number of invocations or a reasonable, measured run time.

Misconceptions:
None

Related commands:
show memory


 Command:

show authentication

Mode:

Switch> (enable)

Syntax:

show authentication

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the show authentication command to display authentication information.

Example:

This example shows how to display authentication information:

Console>show authentication

                       Console Session   Telnet Session   Http Session

Login Authentication:

---------------------  ----------------  ---------------  -----------

tacacs                 disabled          disabled          disabled
radius                 disabled          disabled          disabled
kerberos               disabled          disabled          disabled
local                  enabled(primary)  enabled(primary)  enabled(primary)
attempt limit          3                 3                 -
lockout timeout (sec)  230 seconds       120 seconds       120 seconds

Enable Authentication: Console Session   Telnet Session    Http Session
---------------------- ----------------- ----------------  ----------------
tacacs                 disabled          disabled          disabled
radius                 disabled          disabled          disabled
kerberos               disabled          disabled          disabled
local                  enabled(primary)  enabled(primary)  enabled(primary)
attempt limit          3                 3                 -
lockout timeout (sec)  disabled          600 seconds       600 seconds
(*) primary
Console>

Misconceptions:
None

Related Commands:
set authentication login


 Command:

show cam

Mode:

Switch> (enable)

Syntax:

show cam count {dynamic | static | permanent | system} [vlan]

show cam {dynamic | static | permanent} mod_num/port_num

show cam mac_addr [vlan]

Syntax Description:

count

Keyword that displays only the number of CAM entries.

dynamic

Keyword that displays dynamic CAM entries.

static

Keyword that displays static CAM entries.

permanent

Keyword that displays permanent CAM entries.

system

Keyword that displays system CAM entries.

vlan

(Optional) Variable that specifies the number of the VLAN. If a VLAN is not specified, all VLANs are displayed.

mod_num

Variable that specifies the number of the module.

port_num

Variable that specifies the number of the port.

mac_addr

MAC address.

Command Description:

Use the show cam command to display the CAM table.

If you display the output associated with the MAC address of an ATM dual PHY OC-12 module, additional information is displayed, including the VCD, VPI, VCI, and VC type.

If you enter the show cam command on the Catalyst 4000 family switches, the ASE CAM table entries are displayed.

Example:

This example shows how to display dynamic CAM entries for all VLANs:

Console>show cam dynamic

* = Static Entry. + = Permanent Entry. # = System Entry. R = Router Entry.

VLAN  Dest MAC/Route Des    Destination Ports or VCs / [Protocol Type]
----  ------------------    ----------------------------------------------------
1     00-60-5c-86-5b-81     4/1 [ALL]
v1     00-60-2f-35-48-17     4/1 [ALL]
1     00-80-24-f3-47-20     1/2 [ALL]
1     00-60-09-78-96-fb     4/1 [ALL]
1     00-80-24-1d-d9-ed     1/2 [ALL]
1     00-80-24-1d-da-01     1/2 [ALL]
1     08-00-20-7a-63-01     4/1 [ALL]

Total Matching CAM Entries Displayed = 7
Console>

This example shows the output associated with the MAC address of an ATM dual PHY OC-12 module, which includes the dynamic CAM entries for all VLANs:

Console>show cam dynamic

VLAN  Dest MAC/Route Des  Destination Ports or VCs
----  ------------------  ----------------------------------------------------
12    00-14-14-14-14-1c   6/1
12    00-14-14-14-14-1d   6/1
12    00-14-14-14-14-1a   6/1
12    00-14-14-14-14-1b   6/1
12    00-14-14-14-14-18   6/1
12    00-14-14-14-14-19   6/1
12    00-14-14-14-14-16   6/1
12    00-14-14-14-14-17   6/1
12    00-14-14-14-14-14   6/1
12    00-14-14-14-14-15   6/1
6     00-14-14-14-14-16   4/1 VCD:98  VPI:0 VCI:127  Type: LANE Data Direct
6     00-14-14-14-14-17   4/1 VCD:98  VPI:0 VCI:127  Type: LANE Data Direct
6     00-14-14-14-14-14   4/1 VCD:98  VPI:0 VCI:127  Type: LANE Data Direct
6     00-14-14-14-14-15   4/1 VCD:98  VPI:0 VCI:127  Type: LANE Data Direct
6     00-14-14-14-14-1a   4/1 VCD:98  VPI:0 VCI:127  Type: LANE Data Direct
6     00-14-14-14-14-1b   4/1 VCD:98  VPI:0 VCI:127  Type: LANE Data Direct
6     00-14-14-14-14-18   4/1 VCD:98  VPI:0 VCI:127  Type: LANE Data Direct
6     00-14-14-14-14-19   4/1 VCD:98  VPI:0 VCI:127  Type: LANE Data Direct
6     00-14-14-14-14-1c   4/1 VCD:98  VPI:0 VCI:127  Type: LANE Data Direct
6     00-14-14-14-14-1d   4/1 VCD:98  VPI:0 VCI:127  Type: LANE Data Direct
3     00-14-14-14-14-14   4/1 VCD:101 VPI:0 VCI:130  Type: LANE Data Direct
3     00-14-14-14-14-15   4/1 VCD:101 VPI:0 VCI:130  Type: LANE Data Direct
Do you wish to continue y/n [n]? n

Total Matching CAM Entries Displayed = 21
Console>

The table below describes the fields in the ATM dual PHY OC-12 module show cam dynamic output.

Table: show cam dynamic Command Output Fields
Field Description

VCD

VCD of the VC

VPI

VPI of the VC

VCI

VCI of the VC

Type

Type of virtual circuit (LANE Data Direct, LANE bus, or AAL5SNAP PVC)

This example shows routers listed as the CAM entries. If the MAC address belongs to a router, it is shown by appending an "R" to the MAC address. If a VLAN is specified, then only those CAM entries matching the VLAN number are displayed.

Console>show cam 00-00-81-01-23-45

* = Static Entry. + = Permanent Entry. # = System Entry. R = Router Entry

Router Watergate with IP address 172.25.55.1 has CAM entries:
VLAN  Dest MAC/Route Des    Destination Ports or VCs
----  ------------------    ----------------------------------------------------
1     00-00-81-01-23-45R    2/9 [IP]
2     00-00-81-01-23-45R    2/10 [IP]
Total Matching CAM Entries = 2
Console>

Misconceptions:
None

Related Commands:
None


 Command:

show cgmp leave

Mode:

Switch> (enable)

Syntax:

show cgmp leave

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the show cgmp leave command to display the status of the CGMP leave feature.

Example:

This example shows how to display the status of the CGMP leave feature:

Console>show cgmp leave

CGMP:           enabled
CGMP leave:     enabled
CGMP FastLeave: enabled
Console>

Misconceptions:

None

Related Commands:
set cgmp
set cgmp leave


 Command:

show cgmp statistics

Mode:

Switch>

Syntax:

show cgmp statistics [vlan_id]

Syntax Description:

vlan_id

(Optional) Variable that specifies the VLAN number for which to display CGMP statistics.

Command Description:

Use the show cgmp statistics command to display CGMP statistics.

Example:

This example shows how to display CGMP statistics for VLAN 1:

Console> show cgmp statistics 1

CGMP enabled

CGMP statistics for vlan 1:
valid rx pkts received           211915
invalid rx pkts received         0
valid cgmp joins received        211729
valid cgmp leaves received       186
valid igmp leaves received       0
valid igmp queries received      3122
igmp gs queries transmitted      0
igmp leaves transmitted          0
failures to add GDA to EARL      0
topology notifications received  80
number of CGMP packets dropped   2032227
Console>

The following table describes the fields in the show cgmp statistics output:

Table: show cgmp statistics Command Output Fields
Field Description

Valid rx pkts received

Number of valid CGMP packets received

Invalid rx pkts received

Number of invalid CGMP packets received

valid cgmp joins received

Number of CGMP group-specific queries received

valid cgmp leaves received

Number of CGMP leaves received

valid igmp leaves received

Number of IGMP leaves received

valid igmp queries received

Number of IGMP reports received

igmp gs queries transmitted

Number of IGMP group specific-equivalent queries transmitted by the switch

igmp leaves transmitted

Number of IGMP leaves transmitted by the switch

failures to add GDA to EARL

Number of times that the switch failed to add a multicast entry (GDA) to the EARL table

topology notifications received

Number of topology change notifications received by the switch

number of CGMP packets dropped

Number of IGMP packets dropped by the switch

Misconceptions:

None

Related Commands:
set cgmp


 Command:

show config

Mode:

Switch> (enable)

Syntax:

show config {system | mod_num} [all]

Syntax Description:

system

Keyword that specifies to display system configuration.

mod_num

Variable that specifies the number of the module.

all

(Optional) Keyword that specifies all modules and system configuration information, including the IP address.

Command Description:

Use the show config command to display the non-default system configuration.

Examples:

This example shows how to display the nondefault system and module configuration:

Console> (enable) show config

This command shows non-default configurations only.
Use 'show config all' to show both default and non-default configurations.
..........

begin
!
# ***** NON-DEFAULT CONFIGURATION *****
!
!
#Time: Thu Dec 23 1999, 21:56:01
!
#version 5.4(0.52)MIA7-Eng
#System Web Interface Version 5.0(0.25)
!
set editing disable
!
#frame distribution method
set port channel all distribution mac unknown
!
#snmp
set snmp trap 0.0.0.0
set snmp trap 0.0.0.0
!
#kerberos
set kerberos server  0.0.0.0
set kerberos server  0.0.0.0
set kerberos realm
set kerberos realm
!
#vtp
set vtp domain Lab_Network
set vtp v2 enable
set vtp pruning enable
set vlan 1 name default type ethernet mtu 1500 said 100001 state active
set vlan 2 name VLAN0002 type ethernet mtu 1500 said 100002 state active
set vlan 6 name VLAN0006 type ethernet mtu 1500 said 100006 state active
set vlan 10 name VLAN0010 type ethernet mtu 1500 said 100010 state active
set vlan 20 name VLAN0020 type ethernet mtu 1500 said 100020 state active
set vlan 50 name VLAN0050 type ethernet mtu 1500 said 100050 state active
set vlan 100 name VLAN0100 type ethernet mtu 1500 said 100100 state active
set vlan 152 name VLAN0152 type ethernet mtu 1500 said 100152 state active
set vlan 200 name VLAN0200 type ethernet mtu 1500 said 100200 state active
set vlan 300 name VLAN0300 type ethernet mtu 1500 said 100300 state active
set vlan 303 name VLAN0303 type fddi mtu 1500 said 100303 state active
set vlan 400 name VLAN0400 type ethernet mtu 1500 said 100400 state active
set vlan 500 name VLAN0500 type ethernet mtu 1500 said 100500 state active
set vlan 521 name VLAN0521 type ethernet mtu 1500 said 100521 state active
set vlan 524 name VLAN0524 type ethernet mtu 1500 said 100524 state active
set vlan 570 name VLAN0570 type ethernet mtu 1500 said 100570 state active
set vlan 801 name VLAN0801 type trbrf mtu 4472 said 100801 state active bridge
set vlan 850 name VLAN0850 type ethernet mtu 1500 said 100850 state active
set vlan 917 name VLAN0917 type ethernet mtu 1500 said 100917 state active
set vlan 999 name VLAN0999 type ethernet mtu 1500 said 100999 state active
set vlan 1002 name fddi-default type fddi mtu 1500 said 101002 state active
set vlan 1004 name fddinet-default type fddinet mtu 1500 said 101004 state acti
set vlan 1005 name trbrf-default type trbrf mtu 4472 said 101005 state active b
set vlan 802 name VLAN0802 type trcrf mtu 4472 said 100802 state active parent
set vlan 1003 name trcrf-default type trcrf mtu 4472 said 101003 state active p
set vlan 3 translation 303 translation 0
set vlan 4 translation 304 translation 0
set vlan 5 translation 305 translation 0
set vlan 303 translation 3 translation 0
set vlan 304 translation 4 translation 0
set vlan 305 translation 5 translation 0
set vlan 351 translation 524 translation 0
set vlan 524 translation 351 translation 0
!
#ip
set interface sc0 1 1.10.11.212/255.255.255.0 1.10.11.255

set ip route 0.0.0.0/0.0.0.0         172.20.52.126
set ip route 0.0.0.0/0.0.0.0         172.20.52.125
set ip route 0.0.0.0/0.0.0.0         172.20.52.121
!
#rcp
set rcp username 1
!
#dns
set ip dns server 171.68.10.70 primary
set ip dns server 171.68.10.140
set ip dns enable
set ip dns domain cisco.com
!
#spantree

set spantree fwddelay 4     801
set spantree maxage   10    801
#portfast

set spantree portfast bpdu-guard enable

#vlan 802
set spantree fwddelay 4     802
set spantree maxage   10    802
set spantree portstate 802 block 801
#vlan 1003
set spantree fwddelay 4     1003
set spantree maxage   10    1003
set spantree portstate 1003 block 1005
!
#syslog
set logging server 172.20.101.182
!
#set boot command

set boot config-register 0x100

set boot system flash bootflash:cat6000-sup.5-4-0-52.bin

!
#HTTP commands
set ip http server enable
set ip http port 1922
!

# default port status is disable

!
#mls
set mls nde disable
!
#qos
set qos enable
set qos map 1q4t 1 1 cos 2
set qos map 1q4t 1 1 cos 3
set qos map 1q4t 1 1 cos 4
set qos map 1q4t 1 1 cos 5
set qos map 1q4t 1 1 cos 6
set qos map 1q4t 1 1 cos 7
!
#Accounting
set accounting commands enable config stop-only tacacs+
!

# default port status is enable

!

#module 1 : 2-port 1000BaseX Supervisor
!
#module 2 empty
!
#module 3 : 48-port 10/100BaseTX (RJ-45)
set spantree portfast   3/8 enable
!
#module 4 empty
!
#module 5 : 48-port 10/100BaseTX (RJ-45)
!
#module 6 empty
!
set vlan 100  6/1
set spantree portcost    6/1  200
!
#module 7 : 24-port 10/100BaseTX Ethernet
set vlan 5    7/5
set vlan 100  7/23
set vlan 200  7/9
set port disable    7/5

set port name       7/9  1528 Hub
set port security 7/10 enable
set port security 7/10 maximum 200
set port security 7/10 00-11-22-33-44-55
set port security 7/10 00-11-22-33-44-66
set port security 7/10 00-11-22-33-44-77
set port security 7/10 violation restrict
set port security 7/10 age 30
set trunk 7/1  desirable isl 1-1005
set trunk 7/2  desirable isl 1-1005
set trunk 7/3  desirable isl 1-1005
set trunk 7/4  desirable isl 1-1005
set trunk 7/10 off negotiate 1-1005
set trunk 7/23 on isl 1-1005
set spantree portcost    7/23  150
set spantree portvlancost 7/23 cost 50 100
!
#module 8 empty
!
#module 9 empty
!
#module 15 empty
!
#module 16 empty
end
Console>

This example shows how to display default and nondefault configuration information:

Console> show config all

begin
!
# ***** ALL (DEFAULT and NON-DEFAULT) CONFIGURATION *****
!
#Current Time: Thu Dec 23 1999, 14:01:24
!
#version 5.4(0.52)
!
set password $1$FMFQ$HfZR5DUszVHIRhrz4h6V70
set enablepass $1$FMFQ$HfZR5DUszVHIRhrz4h6V70
set prompt Console>
set length 24 default
set logout 20
set banner motd ^C^C
!
#system
set system baud  9600
set system modem disable
set system name
set system location
set system contact
!
... <truncated display>
#gvrp
set gvrp dynamic-vlan-creation disable
set gvrp disable
end
console>

This example shows how to display nondefault system configuration information:

Console> show config system

begin
!
# ***** NON-DEFAULT CONFIGURATION *****
!
#Current Time: Thu Dec 23 1999, 14:01:24
!
#version 5.4(0.52)
!
!
#set boot command
set boot config-register 0x2
set boot system flash bootflash:kk1
end
Console>

This example shows how to display all system default and nondefault configuration information:

Console> show config system all

begin
!
#system
set system baud  9600
set system modem disable
set system name
set system location
set system contact
!
end
Console>

This example shows how to display nondefault configuration information for module 1:

Console> show config 1

..............
begin
!
# ***** NON-DEFAULT CONFIGURATION *****
!
!
#Current Time: Thu Dec 23 1999, 14:01:24
!
#version 5.4(0.52)
!
!
#module 1 : 4-port 10/100BaseTX Supervisor
!
end
Console>

This example shows how to display default and nondefault configuration information for module 1:

Console> show config 1 all

begin
!
#module 1 : 4-port 10/100BaseTX Supervisor
set module name    1
set vlan 1    1/1-4
set port channel 1/1-4 off
... <truncated display>
set port flowcontrol    1/1-4 receive on
set cdp enable   1/1-4
set trunk 1/1  auto negotiate 1-1005
... <truncated display>
set trunk 1/4  auto negotiate 1-1005
set spantree portfast    1/1-4 disable
... <truncated display>
set spantree portvlancost 1/4  cost 99
set port gvrp     1/1-4  disable
set gvrp registration normal   1/1-4
set gvrp applicant normal   1/1-4
set port gmrp   1/1-4  enable
set gmrp registration normal   1/1-4
set gmrp fwdall disable    1/1-4
!
end
Console>

Misconceptions:

By default, this command shows only nondefault configurations. To view the
entire configuration, use the keyword all.

Related Commands:
None


 Command:

show mls

Mode:

Switch> (enable)

Syntax:

show mls
show mls rp {ip_addr} [noalias]
show mls entry {[destination {ip_addr_spec}] [source {ip_addr_spec}] | [flow {protocol} {src_port [port_num]} {dst_port}]} [rp {ip_addr}]
show mls include
show mls nde

Syntax Description:

rp

Keyword used to specify a route processor the MLS entry will be displayed.

ip_addr

Route-processor IP address, or route-processor name if DNS is used.

noalias

(Optional) Keyword used to specify all route processors are present in IP format, rather than their names.

entry

Keyword used to specify the MLS packet entry.

destination

(Optional) Keyword used to specify the destination IP address.

ip_addr_spec

(Optional) Full IP address or a subnet address in the following formats: ip_subnet_addr,ip_addr/subnet_mask, ip_addr/#subnet_mask_bits.

source

(Optional) Keyword used to specify the source IP address.

flow

(Optional) Keyword used to specify additional flow information (protocol family and protocol port pair) to be matched.

protocol

(Optional) Keyword used to specify flow information; valid values include:tcp, udp, icmp, or a decimal number for other protocol families.

src_port

(Optional) Source port IP address; used with port_num to specify the port pair if protocol is tcp or udp.

port_num

(Optional) TCP/UDP port number (decimal); used with src_num to specify the port pair if protocol is tcp or udp.

dst_port

(Optional) Destination port IP address.

include

Keyword used to display all route processors currently included to run multilayer switching.

nde

Keyword used to display NDE information.

Command Description:

Use the show mls command set to display Multilayer Switching Layer 3 packet information in the multilayer switching-based Catalyst 5000 series switch.

If you are entering any of the show mls commands on a Catalyst 5000 series switch without MLS, the following warning message is displayed:

MLS not supported on feature card.

If you enter the show mls commands with no arguments, general MLS information and all MLS-RP information is displayed.

If DNS is disabled, no name can be specified or shown. If noalias is specified, all route-processors are present in IP format, rather than their names if DNS is enabled.

A value 0 for src_port and dst_port means "don't care."

Use the following syntax to specify an IP subnet address:

  • ip_subnet_addr—This is the short subnet address format. The trailing decimal number 00 in an IP address YY.YY.YY.00 specifies the boundary for an IP subnet address. For example, 172.22.36.00 indicates a 24-bit subnet address (subnet mask 172.22.36.00/255.255.255.0), and 173.24.00.00 indicates a 16-bit subnet address (subnet mask 173.24.00.00/255.255.0.0). However, this format can only identify a subnet address with a length of 8, 16, or 24 bits.
  • ip_addr/subnet_mask—This is the long subnet address format. For example, 172.22.252.00/255.255.252.00 indicates a 22-bit subnet address. This format can specify a subnet address of any bit number. To provide more flexibility, the ip_addr is allowed to be a full host address, such as 172.22.253.1/255.255.252.00.
  • ip_addr/maskbits—This is the simplified long subnet address format. The mask bits specifies the number of bits of the network masks. For example, 172.22.252.00/22 indicates a 22-bit subnet address. The ip_addr is allowed to be a full host address, such as 172.22.254.1/22, which has the same subnet address as 172.22.252.00/22.

When you enter the show mls entry command, the keyword destination option specifies the entries matching this destination IP address specification. The keyword source option specifies the entries matching this source IP address specification. An ip_addr_spec can be a full IP address or a subnet address. If you do not specify a keyword, it is treated as a wildcard, and all entries are displayed.

Examples:

These examples show how to use the show mls command set:

Console>(enable) show mls
Multilayer switching enabled
Multilayer switching aging time = 1800 seconds
Multilayer switching fast aging time = 0 seconds, packet threshold = 1
Destination flow
Total packets switched = 101892
Active entries = 2153
Netflow data export enabled
Netflow data export configured for port 8010 on host 10.0.2.15
Total packets exported = 20

MLS-RP IP       MLS-RP ID            Xtag    MLS-RP MAC-Vlans
--------------  -------------------  ------  -------------------------------
172.20.25.2     0000808cece0         2       00-00-80-8c-ec-e0  1-20
                                             00-00-80-8c-ec-e1  21-30
                                             00-00-80-8c-ec-e2  31-40
                                             00-00-80-8c-ec-e3  41-50
                                             00-00-80-8c-ec-e4  51-60

172.20.27.1     0000808c1214         3       00-00-80-8c-12-14  1-20,31-40
                                             00-00-80-8c-12-15  21-30
                                             00-00-80-8c-12-16  41-50
Console>(enable)

Console>(enable) show mls entry rp 172.20.27.1

  Destination IP   Source IP     Pr    DstPt    SrcPt   Destination Mac         Vlan  Port
  --------------   ------------  ----  -------  ------  ----------------------  ----  ----
MLS-RP 172.20.27.1:
172.20.22.16       172.20.27.139 TCP   DNS      DNS     00-60-70-6c-fc-24       4     2/3
172.20.21.17       172.20.27.138 TCP   7001     7003    00-60-70-6c-fc-25       3     2/4
Console>

Console> show mls entry

Destination IP   Source IP     Pr    DstPt    SrcPt   Destination Mac         Vlan  Port
--------------   ------------  ----  -------  ------  ----------------------  ----  ----
MLS-RP 172.20.25.1:
172.20.22.14     172.20.25.10  UDP   80       50648   00-60-70-6c-fc-22       4     2/1
MLS-RP 172.20.26.1:
172.20.20.15     172.20.25.148 UDP   50650    80      00-60-70-6c-fc-23       2     2/2
MLS-RP 172.20.27.1:
172.20.22.16     172.20.27.139 TCP   DNS      DNS     00-60-70-6c-fc-24       4     2/3
172.20.21.17     172.20.27.138 TCP   7001     7003    00-60-70-6c-fc-25       3     2/4
Console>

Console>(enable) show mls entry destination 172.20.22.14/24

Destination IP   Source IP     Pr    DstPt    SrcPt   Destination Mac         Vlan  Port
--------------   ------------  ----  -------  ------  ----------------------  ----  ----
MLS-RP 172.20.25.1:
172.20.22.14       172.20.25.10  UDP   80       50648   00-60-70-6c-fc-22       4     2/1
MLS-RP 172.20.27.1:
172.20.22.16       172.20.27.139 TCP   DNS      DNS     00-60-70-6c-fc-24       4     2/3
Console>

Console>(enable) show mls entry rp 172.20.27.1

Destination IP   Source IP     Pr    DstPt    SrcPt   Destination Mac         Vlan  Port
--------------   ------------  ----  -------  ------  ----------------------  ----  ----
MLS-RP 172.20.27.1:
172.20.22.16     172.20.27.139 TCP   DNS      NS      00-60-70-6c-fc-24       4     2/3
172.20.21.17     172.20.27.138 TCP   7001     7003    00-60-70-6c-fc-25       3     2/4
Console>

Console>(enable) show mls include

Included MLS-RP
---------------------------------------
170.67.2.13
170.67.2.12
Console>(enable)

Console>(enable) show mls nde

Netflow data export enabled.
Netflow data export configured for UDP port 1098 on host 172.20.15.1
Source filter is 171.69.194.140/255.255.255.0
Destination port filter is 23
Total Netflow Data Export packets = 26784
Console>(enable)

Misconceptions:

None

Related commands:
set mls
clear mls


 Command:

show module

Mode:

Switch> (enable)

Syntax:

show module [mod_num]

Syntax Description:

mod_num

(Optional) Variable that specifies the number of the module. If a module number is not specified, all modules are displayed.

Command Description:

Use the show module command to display module status and information.

If you remove a module and replace it with a different type module, a message appears in the show module display that states that the module configuration is inconsistent with the current module type. To clear the message, you can either enter the clear config mod_num command for the module or set different parameters for the new module.

For Catalyst 4000 family switches, the show module command displays the supervisor engine as having "1" slot.

For Catalyst 4000 family switches, in the show module command display, the combination of the 32-port module (WS-X4502) and 4-port 100FX card results in an entry that reads 36 ports. If the uplink card is not installed, only ports 1 to 32 are listed.

Although me1 resides on the supervisor engine module for the Catalyst 4000 family switches, me1 port information is not displayed by the show module or show port commands.

Examples:

This example shows how to display status and information for module 3:

Console> show module 3

Mod Slot Ports Module-Type               Model               Sub Status
--- ---- ----- ------------------------- ------------------- --- --------
3   3    9     Gigabit Ethernet          WS-X5410            no  ok

Mod Module-Name         Serial-Num

--- ------------------- --------------------

3                       00007285650

Mod MAC-Address(es)                        Hw     Fw         Sw

--- -------------------------------------- ------ ---------- -----------------

3   00-e0-1e-38-48-cc to 00-e0-1e-38-48-d7 0.2    4.1(0.53-E 5.1(0.59))

Console>

This example shows how to display status and information for the Catalyst 4000 family switch:

Console> show module
Mod Slot Ports Module-Type Model Sub Status
--- ---- ----- ------------------------- ------------------- --- --------
1 1 0 Switching Supervisor WS-X4012 yes ok
2 2 6 1000BaseX Ethernet Ext WS-X4306
3 3 6 1000BaseX Ethernet WS-X4306 no ok

Mod Module-Name         Serial-Num
--- ------------------- --------------------
1                       JAB023806JR
2                       JAB0240004D
3                       JAB024000YY

Mod MAC-Address(es)                        Hw     Fw         Sw
--- -------------------------------------- ------ ---------- -----------------
1   00-10-7b-f8-03-00 to 00-10-7b-f8-06-ff 0.1    4.4(0.14)  5.1(0.57)
2   00-10-7b-f6-b1-a8 to 00-10-7b-f6-b1-ad 0.2
3   00-10-7b-f6-b2-1a to 00-10-7b-f6-b2-1f 0.2
Console>

The table below describes the possible fields in the show module command output.

Table: show module Command Output Fields
Field Description

Mod

Module number

Slot

Slot number

Module-Name

Name of the module (if configured)

Ports

Number of ports on the module

Module-Type

Module type (such as 10BASE-T Ethernet or Token Ring)

Model

Model number of the module

Serial-Num

Serial number of the module

Status

Status of the module. Possible status strings are ok, disable, faulty, other, standby, and error.

MAC-Address(es)

MAC address or MAC address range for the module. Token Ring module MAC addresses appear in noncanonical format.

Hw

Hardware version of the module1

Fw

Firmware version of the module2

Sw

Software version on the module

SMT User-Data

User-data string defined for the FDDI module

T-Notify

T-Notify timer value configured for the FDDI module

CF-St

Configuration management state of the FDDI module

ECM-St

Entity Coordination Management state of the FDDI module

Bypass

Status of whether an optical bypass switch is present

Sub-Type3

Submodule type

Sub-Model3

Model number of the submodule

Sub-Serial3

Serial number of the submodule

Sub-Hw3

Hardware version of the submodule

1Hw for the supervisor engine module displays the supervisor engine module's EARL hardware version.
2Fw for the supervisor engine module displays the supervisor engine module's boot version.
3This field displays EARL information; this field is dd on the Catalyst 4000 family and Catalyst 2948G switches.

Misconceptions:
None

Related Commands:

None


 Command:

show multicast group

Mode:

Switch> (enable)

Syntax:

show multicast group [mac_addr] [vlan_id]

Syntax Description:

mac_addr

(Optional) Destination MAC address.

vlan_id

(Optional) Variable that specifies the number of the VLAN.

Command Description:

Use the show multicast group command to display the multicast group configuration.

Examples:

This example shows how to display the multicast group configuration for VLAN 1:

Console> show multicast group 1

VLAN  Dest MAC/Route Des    [CoS]   Destination Ports or VCs / [Protocol Type]
---- ----------------- ----- ----------------------------------
1    01-00-5e-00-01-28*      3/1,12/9
1    01-00-5e-63-7f-6f*      3/1,12/5,12/9
Total Number of Entries = 2
Console>

This example shows how to display the multicast group configuration for a specific MAC address on VLAN 5:

Console> show multicast group 01-00-5E-00-00-5C 5

VLAN  Dest MAC/Route Des    [CoS]   Destination Ports or VCs / [Protocol Type]
---- ----------------- ----- ----------------------------------
5    01-00-5E-00-00-5C       3/1, 3/9
Total Number of Entries = 1
Console>

The table below describes the fields in the show multicast group command output.

Table:show multicast group Command Output Fields
Field Description

VLAN

VLAN number

Dest MAC/Route Des

Group destination MAC address

*

Status of whether the port was configured manually as a multicast router port

CoS

CoS value

Destination Ports or VCs

List of all the ports that belong to this multicast group. Traffic destined to this group address will be forwarded on all these ports.

Total Number of Entries

Total number of entries in the multicast group table that match the criteria specified by the command.

Misconceptions:

None

Related commands:

None


 Command:

show port

Mode:

Switch> (enable)

Syntax:

show port [mod[/port]]

Syntax Description:

mod

(Optional) Variable that specifies the number of the module.

port

(Optional) Variable that specifies the number of the port on the module.

Command Description:

Use the show port command to display port status and counters.

If you do not specify a mod, the ports on all modules are shown.

If you do not specify a port, all the ports on the module are shown.

In the Status field for the switch ports, the following applies:

  • connected indicates the port is operational.
      Note connected is also displayed for the status of a port that is receiving remote fault indications. Remote fault indications are not sent until the link comes up and both ends can hear each other. This means that the link is up and working correctly. According to the 802.3z Gigabit Ethernet Specification, a link partner is not allowed to send remote fault indications until after the link comes up successfully.
  • notconnect indicates the port is off or there is no GBIC in port.
  • faulty indicates the port failed diagnostics tests.
  • remfault indicates the far end station cannot synchronize with its receive signal.
  • disable indicates the port has been manually disabled.
  • remdisable indicates the far end port has been manually disabled.
  • configerr indicates that this port is not satisfied with the output of flow control and or duplex negotiation.
  • remcfgerr indicates that the far end port is not satisfied with the output of flow control and or duplex negotiation.
  • disagree indicates that the two ports have failed to agree on a duplex condition or that autonegotiation has failed.

In the show port command display, the combination of the 32-port module (WS-X4502) and 4-port 100FX card results in an entry that lists 36 ports. If the uplink card is not installed, only ports 1 through 32 are listed.

Although me1 resides on the supervisor engine module for the Catalyst 4000 family switches, me1 port information is not displayed by the show module or show port CLI commands.

Example:

This example shows how to display the status and counters for ports on module2:

Console> show port 2

Port  Name               Status     Vlan       Level  Duplex Speed Type

----- ------------------ ---------- ---------- ------ ------ ----- ------------

 2/1                     connected  1          normal   full  1000 1000BaseSX

 2/2                     connected  1          normal   full  1000 1000BaseSX

 2/3                     notconnect 1          normal   full  1000 No GBIC

 2/4                     notconnect 1          normal   full  1000 No GBIC

 2/5                     notconnect 1          normal   full  1000 No GBIC

2/34                    reflector  rspan-2    normal a-full a-100 10/100BaseTX

Port  Security Secure-Src-Addr   Last-Src-Addr     Shutdown Trap     IfIndex

----- -------- ----------------- ----------------- -------- -------- -------

 2/1  disabled                                     No       disabled 90

 2/2  disabled                                     No       disabled 91

 2/3  disabled                                     No       disabled 92

 2/4  disabled                                     No       disabled 93

 2/5  disabled                                     No       disabled 94

 2/6  disabled                                     No       disabled 95

Port   Send FlowControl    Receive FlowControl   RxPause TxPause Unsupported

       admin    oper       admin    oper                         opcodes

-----  -------- --------   -------- --------     ------- ------- -----------

 2/1   desired  off        off      off          0       0       0

 2/2   desired  off        off      off          0       0       0

 2/3   desired  off        off      off          0       0       0

 2/4   desired  off        off      off          0       0       0

 2/5   desired  off        off      off          0       0       0

 2/6   desired  off        off      off          0       0       0

Port  Align-Err  FCS-Err    Xmit-Err   Rcv-Err    UnderSize

----- ---------- ---------- ---------- ---------- ---------

 2/1           -          0          1          0         0

 2/2           -          8          2          8         0

 2/3           -          0          0          0         0

 2/4           -          0          0          0         0

 2/5           -          0          0          0         0

 2/6           -          0          0          0         0

Port  Single-Col Multi-Coll Late-Coll  Excess-Col Carri-Sen Runts     Giants

----- ---------- ---------- ---------- ---------- --------- --------- ---------

 2/1           0          0          0          0         1         0         0

 2/2           0          0          0          0         1         0         0

 2/3           0          0          0          0         0         0         0

 2/4           0          0          0          0         0         0         0

 2/5           0          0          0          0         0         0         0

 2/6           0          0          0          0         0         0         0

Last-Time-Cleared

--------------------------

Fri Apr 9 1999, 18:54:17

Console>

The table below describes the possible fields (depending on the port type queried) in
the show port command output.

Table: show port Command
Output Fields
Field Description

Port

Module and port number.

Name

Name (if configured) of the port.

Status

Status of the port. For the Catalyst 4000 family and Catalyst 2948G switches, possible displays are connected, notconnect, faulty, remfault, disable, remdisable, configerr, remcfgerr, reflector, and disagree.

Vlan

VLANs to which the port belongs.

Duplex

Duplex setting for the port (auto, full, fdx, half, hdx, a-half, a-hdx, a-full, or a-fdx).

Speed

Speed setting for the port Valid values are auto, 10,100, 155, a-10, a-100,4, 16, a-14,or a-16.

Type1

Port type, for example, 100BASE-FX MM, 100BASE-FX SM, 10/100BASE-TX.

Security

Status of whether port security is enabled or disabled.

Secure-Src-Addr

Secure MAC address for the security enabled port.

Last-Src-Addr

Source MAC address of the last packet received by the port.

Shutdown

Status of whether the port was shut down because of security.

Trap

Status of whether port trap is enabled or disabled.

IfIndex

Number of the ifIndex.

Broadcast-Limit

Broadcast threshold configured for the port.

Broadcast-Drop

Number of broadcast/multicast packets dropped because the broadcast limit for the port was exceeded.

Send admin

Flow-control administration. Possible settings: on indicates the local port sends flow control to the far end; off indicates the local port does not send flow control to the far end; desired indicates the local end sends flow control to the far end if the far end supports it.

FlowControl oper

Flow-control operation. Possible setting: disagree indicates the two ports could not agree on a link protocol.

Receive admin

Flow-control administration. Possible settings: on indicates the local port requires the far end to send flow control; off indicates the local port does not allow the far end to send flow control; desired indicates the local end allows the far end to send flow control.

FlowControl oper

Flow-control operation. Possible setting: disagree indicates the two ports could not agree on a link protocol.

RxPause

Number of Pause frames received.

TxPause

Number of Pause frames transmitted.

Unsupported Opcodes

Number of unsupported operating codes.

Align-Err

Number of frames with alignment errors (frames that do not end with an even number of octets and have a bad CRC) received on the port.

FCS-Err

The number of valid size frames with FCS errors but no framing errors

Xmit-Err

Number of transmit errors that occurred on the port (indicating that the internal transmit buffer is full)

Rcv-Err

Number of receive errors that occurred on the port (indicating that the internal receive buffer is full)

UnderSize

Number of received frames less than 64 octets long (but are otherwise well-formed)

Single-Col

Number of times one collision occurred before the port transmitted a frame to the media successfully

Multi-Coll

Number of times multiple collisions occurred before the port transmitted a frame to the media successfully

Late-Coll

Number of late collisions (collisions outside the collision domain)

Excess-Col

Number of excessive collisions that occurred on the port (indicating that a frame encountered 16 collisions and was discarded)

Carri-Sen

Number of times the port sensed a carrier (to determine whether the cable is currently being used)

Runts

Number of received runt frames (frames that are smaller than the minimum IEEE 802.3 frame size) on the port

Giants

Number of received giant frames (frames that exceed the maximum IEEE 802.3 frame size) on the port

Last-Time-Cleared

Last time the port counters were cleared

Auto-Part

The number of times the port entered the auto-partition state due to excessive consecutive collisions

Data-rate mismatch

The number of valid size frames experienced overrun or underrun

Src-addr change

The number of times the last source address changed

Good-bytes

The total number of octets in frames with no error

Short-event

The number of times activity with a duration less than the ShortEventMax Time (74 to 82 bit times) is detected

1These fields will change according to the system configuration.

Misconceptions:

None

Related commands:
None


 Command:

show port capabilities

Mode:

Switch> (enable)

Syntax:

show port capabilities [mod_num[/port_num]]

Syntax Description:

mod_num

(Optional) Variable that specifies the number of the module.

/port_num

(Optional) Variable that specifies the number of the port on the module.

Command Description:

Use the show port capabilities command to display the capabilities of the modules and ports in a switch.

Example:

This example shows how to show the port capabilities for module 1, port 1:

Console> (enable) show port capabilities 1/1

Model                    WS-X5530
Port                     1/1
Type                     10/100BaseTX
Speed                    auto,10,100
Duplex                   half,full
Trunk encap type         802.1Q,ISL
Trunk mode               on,off,desirable,auto,nonegotiate
Channel                  1/1-2,1/1-4
Broadcast suppression    percentage(0-100)
Flow control             receive-(off,on),send-(off,on)
Security                 yes
Membership               static,dynamic
Fast start               yes
QOS scheduling           rx-(none),tx-(none)
CoS rewrite              yes
ToS rewrite              IP-Precedence
Rewrite                  yes
UDLD                     Capable
Voice vlan               no

Table below describes the possible fields (depending on the type of port queried) and the values in the show port capabilities command output.

Table: show port capabilities Command Output Fields
Field Description

Model

Module model number

Port

Module number and port number

Type1

Port type (for example, 100BASE-FX MM, 100BASE-FX SM, or 10/100BASE-TX)

Speed1

Port speed setting (for example, auto, 100, or 1000)

Duplex

Duplex mode (half, full, auto, fdx, hdx, or no)

Trunk encap type

Trunk encapsulation type (ISL, 802.1Q, 802.10, or no)

Trunk mode

Trunk administrative status of the port (on, off, auto, desirable, nonegotiate, or no)

Channel

Status of which ports can form a channel group. The ports are shown in mod_num/port_num format. For example, 3/1-2 indicates module 3, ports 1 and 2. In addition, any ports in range [mod/1-mod/high_port] or no ports may be indicated.

Broadcast suppression

Number of packets-per-second (pps) of broadcast/multicast traffic allowed on the port (0 to 150000) or the percentage of total available bandwidth that can be used by broadcast/multicast traffic (0 to 100).

Flow control

Flow-control options that can be set (receive-[off, on, desired], send-[off, on, desired], or no)

Security

Status of whether port security is enabled (yes or no)

Membership

Method of membership assignment of a port or range of ports to a VLAN (static or dynamic)

Fast Start

Status of whether the spanning tree port fast-start feature on the port is enabled (yes or no)

QoS Scheduling

(rx-(none),tx-(none))

CoS Rewrite

Status of whether the port supports COS rewrite (yes or no)

ToS Rewrite

Status of whether the port supports TOS rewrite (IP-Precedence)

Rewrite

Status of whether the port supports inline rewrite (yes or no)

UDLD

Status of whether the port supports UDLD (Capable, Not capable)

Voice Vlan

Status of whether the port supports voice or VLAN (yes or no)

1These fields will change depending on the system configuration.

Misconceptions:

If you do not specify a mod_num, the ports on all modules are shown.

If you do not specify a /port_num, all the ports on the module are
shown.

Related Commands:

None


 Command:

show spantree

Mode:

Switch> (enable)

Syntax:

show spantree [vlan | mod/port] [active]

Syntax Description:

vlan

(Optional) Variable that specifies the number of the VLAN.

mod/port

(Optional) Variable that specifies the number of the module and the port on the module.

active

(Optional) Keyword that displays only the active ports.

Command Description:

Use the show spantree command to display spanning tree information for a VLAN. If the VLAN number is not specified, the default is VLAN 1.

Examples:

This example shows how to display the spanning tree configuration for VLAN 64:

Console> show spantree 64

VLAN 64

Spanning tree enabled

Designated Root             00-10-79-57-88-00
Designated Root Priority    8191
Designated Root Cost        3061
Designated Root Port        6/48
Root Max Age   20 sec    Hello Time 2  sec   Forward Delay 15 sec

Bridge ID MAC ADDR          00-50-3e-8f-8c-00
Bridge ID Priority          4160 (bridge priority: 4096, sys ID ext: 64)
Bridge Max Age 6  sec    Hello Time 2  sec   Forward Delay 4  sec

Port,Vlan Vlan  Port-State     Cost   Priority  Fast-Start  Group-method
--------- ----  -------------  -----  --------  ----------  ------------
 1003     1005  inactive          80        32   disabled
Console>

This example shows how to display only the active ports:

Console> show spantree active

VLAN 1
Spanning tree enabled
Spanning tree type          ieee

Designated Root             00-60-70-4c-70-00
Designated Root Priority    32768
Designated Root Cost        19
Designated Root Port        1/1
Root Max Age   20 sec    Hello Time 2  sec   Forward Delay 15 sec

Bridge ID MAC ADDR          00-e0-1e-9b-2e-00
Bridge ID Priority          32768
Bridge Max Age 20 sec    Hello Time 2  sec   Forward Delay 15 sec

Port      Vlan  Port-State     Cost   Priority  Fast-Start  Group-Method
--------- ----  -------------  -----  --------  ----------  ------------
 1/1      1     forwarding        19        32   disabled
 3/1-2    1     forwarding        19        32   disabled    redundancy

The table below describes the possible fields in the show spantree command output.

Table: show spantree Command Output Fields
Field Description

VLAN

VLAN for which spanning tree information is shown

Spanning tree

Status of whether Spanning Tree Protocol is enabled or disabled

Designated Root

MAC address of the designated spanning tree root bridge

Designated Root Priority

Priority of the designated root bridge

Designated Root Cost

Total path cost to reach the root

Designated Root Port

Port through which the root bridge can be reached (shown only on nonroot bridges)

Root Max Age

Amount of time a BPDU packet should be considered valid

Hello Time

Number of times the root bridge sends BPDUs

Forward Delay

Amount of time the port spends in listening or learning mode

Bridge ID MAC ADDR

Bridge MAC address

Bridge ID Priority

Bridge priority

Bridge Max Age

Bridge maximum age

Hello Time

Amount of time the bridge sends BPDUs

Forward Delay

Amount of time the bridge spends in listening or learning mode

Port

Port number

Vlan

VLAN to which the port belongs

Port-State

Spanning tree port state (disabled, inactive, not-connected, blocking, listening, learning, forwarding, bridging, or type-pvid-inconsistent)

Cost

Cost associated with the port

Priority

Priority associated with the port

Fast-Start

Status of whether the port is configured to use the fast-start feature

Group-Method

How the multiple ports are treated (redundancy=dual PHY and FDDI; repeater=RSM; channel=Fast EtherChannel)

Misconceptions:

None

Related commands:
set spantree backbonefast
set spantree disable
set spantree enable
set spantree fwddelay
set spantree hello
set spantree maxage
set spantree portcost
set spantree portfast
set spantree portpri
set spantree portvlancost
set spantree portvlanpri
set spantree root
set spantree uplinkfast
show spantree backbonefast


 Command:

show spantree backbonefast

Mode:

Switch> (enable)

Syntax:

show spantree backbonefast

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the show spantree backbonefast command to display whether the spanning tree Backbone Fast Convergence feature is enabled.

Example:

This example shows how to display whether the spanning tree Backbone Fast Convergence feature is enabled:

Console> show spantree backbonefast

Backbonefast is enabled.
Console>

Misconceptions:
None

Related commands:
set spantree backbonefast


 Command:

show trunk

Mode:

Switch> (enable)

Syntax:

show trunk [mod_num[/port_num]] [detail]

Syntax Description:

mod_num

(Optional) Variable that specifies the number of the module.

/port_num

(Optional) Variable that specifies the number of the port.

detail

(Optional) Keyword that displays detailed information about the specified trunk port.

Command Description:

Use the show trunk command to display trunking information for the switch.

Using the show trunk command without a module or port number displays the actively trunking ports.

To display the trunking configuration for a port that is not actively trunking, specify the

module and port number of the port you want to display.

Examples:

This example shows how to display trunking information for the switch:

Console> (enable) show trunk
* - indicates vtp domain mismatch
Port      Mode         Encapsulation  Status        Native vlan
--------  -----------  -------------  ------------  -----------
 2/1      auto         dot1q          trunking      1
 4/9      auto         isl            trunking      1
 4/10     desirable    isl            trunking      1

Port      Vlans allowed on trunk
--------  ---------------------------------------------------------------------
 2/1      1-1005

 4/9      1-1005
 4/10     1-1005
Port      Vlans allowed and active in management domain
--------  ---------------------------------------------------------------------
 2/1      1-5,10,50,152,500,521-524,570
 4/9      1,4-5,1003,1005
 4/10     1,4-5,1003,1005

Port      Vlans in spanning tree forwarding state and not pruned
--------  ---------------------------------------------------------------------
 2/1      1-5,10,50,152,500,521-524,570
 4/9      1005
 4/10     1005
Console> (enable)

This example shows how to display trunking information for a specific port:

Console> (enable) show trunk 4/5

* - indicates vtp domain mismatch

Port      Mode         Encapsulation  Status        Native vlan
--------  -----------  -------------  ------------  -----------
 4/5      nonegotiate  dot1q          trunking      1

Port      Vlans allowed on trunk
--------  ---------------------------------------------------------------------
 4/5      1-1005

Port      Vlans allowed and active in management domain
--------  ---------------------------------------------------------------------
 4/5      1-3,1003,1005

Port      Vlans in spanning tree forwarding state and not pruned
--------  ---------------------------------------------------------------------
 4/5      1005
Console> (enable)

The table below describes the fields in the show trunk command output.

Table: show trunk Command Output Fields
Field Description

Port

Module and port numbers

Mode

Trunk administrative status of the port (on, off, auto, or desirable)

Encapsulation

Trunking type configured by administration

Status

Status of whether the port is trunking or nontrunking

Native VLAN

Number of the native VLAN for the trunk link (for 802.1Q trunks, the VLAN for which untagged traffic can be transmitted and received over the trunk; for ISL trunks, packets are tagged on all VLANs, including the native VLAN).

Vlans allowed on trunk

Range of VLANs allowed to go on the trunk (default is 1 to 1000)

Vlans allowed and active in management domain

Range of active VLANs within the allowed range

Vlans in spanning tree forwarding state and not pruned

Range of VLANs that actually go on the trunk with Spanning Tree Protocol forwarding state

Misconceptions:
None

Related commands:
set trunk
clear trunk


 Command:

show vlan

Mode:

Switch> (enable)

Syntax:

show vlan [trunk]

show vlan vlan [notrunk]

show vlan mapping

show vlan type

Syntax Description:

trunk

(Optional) Keyword that specifies to force the display to show information only on trunk ports.

vlan

Variable that specifies the number of the VLAN. If the VLAN number is not specified, all VLANs are displayed.

notrunk

(Optional) Keyword that specifies to force the display to show information only on nontrunk ports.

mapping

Keyword to display VLAN mapping table information.

type

Variable that specifies the type of VLAN. Valid values are Ethernet, FDDI, and FDDInet.

Command Description:
Use the show vlan command to display VLAN information. Each Ethernet switch port and Ethernet repeater group belong to only one VLAN. Trunk, FDDI/CDDI, and ATM ports can exist on multiple VLANs.

Examples:

This example shows how to display information for all VLANs:

Console> show vlan

VLAN Name                             Status    IfIndex Mod/Ports, Vlans
---- -------------------------------- --------- ------- ------------------------
1    default                          active    5       1/2
                                                        6/1-48
                                                        7/2-24
2    VLAN0002                         active    339
5    VLAN0005                         active    342
50   VLAN0050                         active    346
100  VLAN0100                         active    347
152  VLAN0152                         active    348
200  VLAN0200                         active    349
300  VLAN0300                         active    350
305  VLAN0305                         active    354
801  VLAN0801                         active    338     338     802
VLAN Type  SAID       MTU   Parent RingNo BrdgNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------
1    enet  100001     1500  -      -      -      -    -        0      0
10   enet  100010     1500  -      -      -      -    -        0      0
901  enet  100901     1500  -      -      -      -    -        0      0
999  trbrf 100999     4472  -      -      0xe    ieee -        0      0
1002 fddi  101002     1500  -      0x0    -      -    -        0      0
1003 trcrf 101003     1500  0      0x0    -      -    -        0      0
1004 fdnet 101004     1500  -      -      0x0    ieee -        0      0
1005 trbrf 101005     1500  -      -      0x0    ibm  -        0      0

VLAN AREHops STEHops Backup CRF
---- ------- ------- ----------
1003 7       7       off
Console>

This example shows how to display information for all VLAN trunks:

Console> show vlan trunk

VLAN Name                             Status    IfIndex Mod/Ports, Vlans
---- -------------------------------- --------- ------- ------------------------
1    default                          active    5       2/1-2
                                                        6/4-8
10   VLAN0010                         active    18      6/1,6/3
11   VLAN0011                         active    19      6/2
20   VLAN0020                         active    20
21   VLAN0021                         active    21
30   VLAN0030                         active    22
31   VLAN0031                         active    23
1002 fddi-default                     active    6
1003 token-ring-default               active    9
1004 fddinet-default                  active    7
1005 trnet-default                    active    8       8

VLAN Type  SAID       MTU   Parent RingNo BrdgNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------
1    enet  100001     1500  -      -      -      -    -        0      0
10   enet  100010     1500  -      -      -      -    -        0      0
11   enet  100011     1500  -      -      -      -    -        0      0
20   enet  100020     1500  -      -      -      -    -        0      0
21   enet  100021     1500  -      -      -      -    -        0      0
30   enet  100030     1500  -      -      -      -    -        0      0
31   enet  100031     1500  -      -      -      -    -        0      0
1002 fddi  101002     1500  -      -      -      -    -        0      0
1003 trcrf 101003     1500  0      0x0    -      -    -        0      0
1004 fdnet 101004     1500  -      -      0x0    ieee -        0      0
1005 trbrf 101005     1500  -      -      0x0    ibm  -        0      0

VLAN Inst DynCreated  RSPAN
---- ---- ---------- --------
1    1    static     disabled
10        static     disabled
11        static     disabled
20        static     disabled
21        static     disabled
30        static     disabled
31        static     disabled
1002 -    static     disabled
1003 1    static     disabled
1004 2    static     disabled
1005 -    static     disabled

VLAN AREHops STEHops Backup CRF 1q VLAN
---- ------- ------- ---------- -------
1003 7       7       off

Primary Secondary Secondary-Type Ports
------- --------- -------------- ------------
10      20        isolated       6/1,6/3
11      21        isolated       6/2
30      -         -
-       31        isolated

This example shows how to display the VLAN mapping table information:

Console> show vlan mapping

802.1q vlan     ISL vlan        Effective

------------------------------------------

3000            300             true

Console>

This example shows how to display information for a specific VLAN and type:

Console> show vlan 2 fddi

VLAN Name                             Status    IfIndex Mod/Ports, Vlans
---- -------------------------------- --------- ------- ------------------------
1002 fddi-default                     active    6

VLAN Type  SAID       MTU   Parent RingNo BrdgNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------
2    fddi  101002     1500  -      -      -      -    -        0      0

VLAN Inst DynCreated  RSPAN
---- ---- ---------- --------
2    -    static     disabled
Console>

This example shows how to display information for nontrunk ports only on a specific VLAN:

Console> (enable) show vlan 2 notrunk

VLAN Name                             Status    IfIndex Mod/Ports, Vlans
---- -------------------------------- --------- ------- ------------------------
2    VLAN0002                         active    60

VLAN Type  SAID       MTU   Parent RingNo BrdgNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------
2    enet  100002     1500  -      -      -      -    -        0      0

VLAN Inst DynCreated  RSPAN
---- ---- ---------- --------
2    -    static     disabled

VLAN AREHops STEHops Backup CRF 1q VLAN
---- ------- ------- ---------- -------

Console>

The table below describes the fields in the show vlan command output.

Table: show vlan Command Output Fields
Field Description

VLAN

VLAN number

Name

Name, if configured, of the VLAN

Status

Status of the VLAN (active or suspend)

IfIndex

Interface Index, assigned by SNMP

Mod/Ports, VLANs

Ports that belong to the VLAN

Type

Media type of the VLAN

SAID

Security association ID value for the VLAN

MTU

Maximum transmission unit size for the VLAN

Parent

Parent VLAN, if one exists

RingNo

Ring number for the VLAN, if applicable

BrdgNo

Bridge number for the VLAN, if applicable

Stp

Spanning-Tree Protocol type used on the VLAN

BrdgMode

Bridging mode for this VLAN. Possible values are SRB and SRT; the default is SRB.

Trans1

First translational VLAN used to translate FDDI or Token Ring to Ethernet

Trans2

Second translational VLAN used to translate FDDI or Token Ring to Ethernet

AREHops

Maximum number of hops for All-Routes Explorer frames. Possible values are from 1 through 13; the default is 7.

STEHops

Maximum number of hops for Spanning-Tree Explorer frames. Possible values are from 1 through 13; the default is 7.

Backup CRF

Status of whether the TrCRF is a backup path for traffic

Misconceptions:
None

Related commands:
set trunk
set vlan
show trunk


 Command:

show vtp domain

Mode:

Switch> (enable)

Syntax:

show vtp domain

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the show vtp domain command to display VLAN Trunk Protocol (VTP) domain information.

Example:

This example shows how to display VTP domain information:

Console> show vtp domain

Domain Name                      Domain Index VTP Version Local Mode  Password
-------------------------------- ------------ ----------- ----------- ----------
                                 1            2           server      -

Vlan-count Max-vlan-storage Config Revision Notifications
---------- ---------------- --------------- -------------
15         1023             5               disabled

Last Updater    V2 Mode Pruning  PruneEligible on Vlans
--------------- ------- -------- -------------------------
172.20.44.30    enabled disabled 2-1000
Console>

The table below describes the fields in the show vtp domain command output.

Table: show vtp domain Command Output Fields
Field Description

Domain Name

Name of the VTP domain

Domain Index

Domain index number of the domain

VTP Version

VTP version number

Local Mode

VTP mode (server, client, or transparent)

Password

Password required or not

Vlan-count

Total number of VLANs in the domain

Max-vlan-storage

Maximum number of VLANs allowed on the device

Config Revision

VTP revision number used to exchange VLAN information

Notifications

Notifications to SNMP (enabled or disabled)

Last Updater

IP address through which VTP was last updated

V2 Mode

Status of VTP V2 mode is enabled or disabled

Pruning

Status of VTP pruning is enabled or disabled

PruneEligible on Vlans

VLANs on which pruning is allowed

Misconceptions:
None

Related commands:
set vtp


 Command:

show vtp statistics

Mode:

Switch> (enable)

Syntax:

show vtp statistics

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the show vtp statistics command to display VLAN Trunk Protocol (VTP) statistics.

Example:

This example shows how to display VTP statistics:

Console> show vtp statistics

VTP statistics:
summary advts received          0
subset  advts received          0
request advts received          0
summary advts transmitted       1
subset  advts transmitted       1
request advts transmitted       0
No of config revision errors    0
No of config digest errors      0

VTP pruning statistics:

Trunk     Join Transmitted  Join Received  Summary advts received from
                                          non-pruning-capable device
--------  ---------------  -------------  ---------------------------
 5/1-2
Console>

The table below describes the fields in the show vtp statistics command output.

Table: show vtp statistics Command Output Fields
Field Description

summary advts received

Total number of summary advt received

subset advts received

Total number of subset advt received

request advts received

Total number of request advts received

summary advts transmitted

Total number of summary advts transmitted

subset advts transmitted

Total number of subset advts transmitted

request advts transmitted

Total number of request advts transmitted

No of config revision errors

Number of config revision errors that have occurred

No of config digest errors

Number of config revision digest errors that have occurred

Trunk

Trunk port participating in VTP pruning

Join Transmitted

Number of VTP-Pruning Joins transmitted

Join Received

Number of VTP-Pruning Joins received

Summary advts received from non-pruning-capable device

Number of summary advts received from nonpruning-capable devices

Misconceptions:
None

Related commands:
set vtp


 Command:

show cgmp

Mode:

Switch#

Syntax:

show cgmp

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the show cgmp privileged Exec command to display the Cisco Group Management Protocol (CGMP) status, CGMP Fast Leave status, CGMP hold time, multicast group information, and multicast router information.

Example:

This example shows how to display CGMP status for managed devices.

hostname# show cgmp

CGMP Status : Enabled
CGMP Fast Leave Status : Disabled
CGMP Holdtime (secs) : 600
Allow reserved address to join as GDA: Enabled

VLAN    Address              Destination
-----------------------------------------------------------------------
1       0100.5E00.0128       Fa2

VLAN    Router Address       Expiration    Interface
-----------------------------------------------------------------------
1       00E0.1E68.7751       589 sec       Fa2

Misconceptions:
None

Related Commands:
cgmp
cgmp leave-processing


 Command:

show mac-address-table security

Mode:

Switch>

Syntax:

show mac-address-table security

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the show (mac-address-table security) privileged Exec command to display the addressing security configuration.

Example:

This example shows how to display the address table security information.

hostname#show mac-address-table security

Action upon address violation : Suspend

InterfaceAddressing SecurityAddress Table SizeClear Address
----------------------------------------------------------------------------
Ethernet 0/1Enabled							10Yes
Ethernet 0/2DisabledN/A				No
Ethernet 0/3DisabledN/ANo

Misconceptions:

None

Related commands:
None


 Command:

show spanning-tree

Mode:

Switch#

Syntax:

show spanning-tree [brief] | [summary] | [vlan stp-list] [interface interface-list] | [{begin | exclude | include} expression]

Syntax Description:

brief

Display a brief status of the spanning tree

summary

Display a summary of the spanning-tree states

vlan stp-list

(Optional) List of spanning-tree instances. Each spanning-tree instance is associated with a VLAN ID. Enter each VLAN ID separated by a space. Valid IDs are from 1 to 1001; do not enter leading zeroes.
Ranges are not supported.

interface interface-list

List of ports for which spanning-tree information is displayed. Enter each port separated by a space. Ranges are not supported.

| begin

(Optional) Display begins with the line that matches the specified expression

| exclude

(Optional) Display excludes lines that match the specified expression

| include

(Optional) Display includes lines that match the specified expression

expression

Expression in the output to use as a reference point

Command Description:

Use the show spanning-tree privileged EXEC command to display spanning-tree information for the specified spanning-tree instances.

If the variable stp-list is omitted, the command applies to the Spanning Tree Protocol (STP) instance associated with VLAN 1.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples:

The following is a sample of output from the show spanning-tree summary command:

Switch#show spanning-tree summary

UplinkFast is disabled

Name                 Blocking Listening Learning Forwarding STP Active
-------------------- -------- --------- -------- ---------- ----------
VLAN1                23       0         0        1          24
-------------------- -------- --------- -------- ---------- ----------
              1 VLAN 23       0         0        1          24

Switch#show spanning-tree brief

VLAN1
  Spanning tree enabled protocol IEEE
  ROOT ID    Priority 32768
             Address 0030.7172.66c4
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
VLAN1
  Spanning tree enabled protocol IEEE
  ROOT ID    Priority 32768
             Address 0030.7172.66c4
Port                           Designated
Name    Port ID Prio Cost Sts  Cost  Bridge ID      Port ID
------- ------- ---- ---- ---  ----  -------------- -------
Fa0/11  128.17  128  100  BLK  38    0404.0400.0001 128.17
Fa0/12  128.18  128  100  BLK  38    0404.0400.0001 128.18
Fa0/13  128.19  128  100  BLK  38    0404.0400.0001 128.19
Fa0/14  128.20  128  100  BLK  38    0404.0400.0001 128.20
Fa0/15  128.21  128  100  BLK  38    0404.0400.0001 128.21
Fa0/16  128.22  128  100  BLK  38    0404.0400.0001 128.22
Fa0/17  128.23  128  100  BLK  38    0404.0400.0001 128.23
Fa0/18  128.24  128  100  BLK  38    0404.0400.0001 128.24
Fa0/19  128.25  128  100  BLK  38    0404.0400.0001 128.25
Fa0/20  128.26  128  100  BLK  38    0404.0400.0001 128.26
Fa0/21  128.27  128  100  BLK  38    0404.0400.0001 128.27

Port                           Designated
Name    Port ID Prio Cost Sts  Cost  Bridge ID      Port ID
------- ------- ---- ---- ---  ----  -------------- -------
Fa0/22  128.28  128  100  BLK  38    0404.0400.0001 128.28
Fa0/23  128.29  128  100  BLK  38    0404.0400.0001 128.29
Fa0/24  128.30  128  100  BLK  38    0404.0400.0001 128.30
Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

The following is a sample of output from the show spanning-tree command for VLAN 1:

Switch#show spanning-tree vlan 1

Spanning tree 1 is executing the IEEE compatible Spanning Tree protocol
  Bridge Identifier has priority 32768, address 00e0.1eb2.ddc0
  Configured hello time 2, max age 20, forward delay 15
  Current root has priority 32768, address 0010.0b3f.ac80
  Root port is 5, cost of root path is 10
  Topology change flag not set, detected flag not set, changes 1
  Times:  hold 1, topology change 35, notification 2
          hello 2, max age 20, forward delay 15
  Timers: hello 0, topology change 0, notification 0

Interface Fa0/1  in Spanning tree 1 is down
   Port path cost 100, Port priority 128
   Designated root has priority 32768, address 0010.0b3f.ac80
   Designated bridge has priority 32768, address 00e0.1eb2.ddc0
   Designated port is 1, path cost 10
   Timers: message age 0, forward delay 0, hold 0
   BPDU: sent 0, received 0
...

The following is a sample of output from the show spanning-tree interface command for port 3:

Switch#show spanning-tree interface fa0/3

Interface Fa0/3 (port 3) in Spanning tree 1 is down
   Port path cost 100, Port priority 128
   Designated root has priority 6000, address 0090.2bba.7a40
   Designated bridge has priority 32768, address 00e0.1e9f.4abf
   Designated port is 3, path cost 410
   Timers: message age 0, forward delay 0, hold 0
   BPDU: sent 0, received 0

Misconceptions:
None

Related commands:
spanning-tree
spanning-tree forward-time
spanning-tree max-age
spanning-tree port-priority


 Command:

show vlan (IOS)

Mode:

Switch#

Syntax:

show vlan [vlan]

Syntax Description:

vlan

Number from 1 to 1005.

Command Description:

Use the show vlan privileged Exec command to display the settings of VLAN configuration parameters.

If you do not specify vlan, the system displays all VLAN configuration parameters. This command is not functional when bridge groups are enabled.

Example:

This example shows how to display the settings of the VLAN configuration parameters:

hostname#show vlan

VLAN NameStatusPorts
---- -------------------------------- --------- ----------------------------
1    defaultactive1-15
2    VLAN0002                                active16-18
3    VLAN0003                                active
4    VLAN0004active
5    VLAN0005active
6    VLAN0006active
7    VLAN0007active
8    VLAN0008active
9    VLAN0009active
10   VLAN0010active
11   VLAN0011active
12   VLAN0012active
13   VLAN0013active
14   VLAN0014active
15   VLAN0015active
1002 fddi-defaultsuspended
1003 token-ring-defaultsuspended
1004 fddinet-defaultsuspended
1005 trnet-defaultsuspended

VLANTypeSAIDMTUParentRingNoBridgeNoStpTrans1Trans2
------------------------------------------------------
1enet1000011500000IEEE10021003
2enet1000021500000IEEE00
3enet1000031500000
4enet1000041500-000
5enet1000051500-000
6enet1000061500-000
7enet1000071500-000
8enet1000081500-0---00
9enet1000091500-0-- -00
10enet1000101500-0---00
11enet1000111500-0---00
12enet1000121500-0---00
13enet1000131500-0---00
14enet1000141500-000
15enet1000151500000
1002FDDI1010021500000IEEE11003
1003Token_Ring1010031500100510IEEE111002
1004FDDI_Net1010041500001IEEE00
1005Token_Ring_Net1010051500001IEEE00

Misconceptions:

None

Related commands:
spantree


 Command:

show vtp

Mode:

Switch#

Syntax:

show vtp {counters | status} | [{begin | exclude | include} expression]

Syntax Description:

counters

Display the VTP counters for the switch.

status

Display general information about the VTP management domain.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.

Command Description:

Use the show vtp privileged EXEC command to display general information about the VLAN Trunk Protocol (VTP) management domain, status, and counters.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples:

The following is a sample of output from the show vtp counters command. The table describes each field in the display.

Switch#show vtp counters

VTP statistics:
Summary advertisements received    : 38
Subset advertisements received     : 0
Request advertisements received    : 0
Summary advertisements transmitted : 13
Subset advertisements transmitted  : 3
Request advertisements transmitted : 0
Number of config revision errors   : 0
Number of config digest errors     : 0
Number of V1 summary errors        : 0

VTP pruning statistics:

Trunk            Join Transmitted Join Received    Summary advts received from
                                                   non-pruning-capable device
---------------- ---------------- ---------------- ---------------------------
Fa0/9               827              824              0
Fa0/10              827              823              0
Fa0/11              827              823              0

Table: Show VTP Counters Field Descriptions
Field Description

Summary Advts Received

Number of summary advertisements received by this switch on its trunk ports. Summary advertisements contain the management domain name, the configuration revision number, the update timestamp and identity, the authentication checksum, and the number of subset advertisements to follow.

Subset Advts Received

Number of subset advertisements received by this switch on its trunk ports. Subset advertisements contain all the information for one or more VLANs.

Request Advts Received

Number of advertisement requests received by this switch on its trunk ports. Advertisement requests normally request information on all VLANs. They can also request information on a subset of VLANs.

Summary Advts Transmitted

Number of summary advertisements sent by this switch on its trunk ports. Summary advertisements contain the management domain name, the configuration revision number, the update timestamp and identity, the authentication checksum, and the number of subset advertisements to follow.

Subset Advts Transmitted

Number of subset advertisements sent by this switch on its trunk ports. Subset advertisements contain all the information for one or more VLANs.

Request Advts Transmitted

Number of advertisement requests sent by this switch on its trunk ports. Advertisement requests normally request information on all VLANs. They can also request information on a subset of VLANs.

No. of Configuration Revision Errors

Number of revision errors.

Whenever you define a new VLAN, delete an existing one, suspend or resume an existing VLAN, or modify the parameters on an existing VLAN, the configuration revision number of the switch increments.

Revision errors increment whenever the switch receives an advertisement whose revision number matches the revision number of the switch, but the MD5 digest values do not match. This error indicates that the VTP password in the two switches is different, or the switches have different configurations.

These errors indicate that the switch is filtering incoming advertisements, which causes the VTP database to become unsynchronized across the network.

No. of Configuration Digest Errors

Number of MD5 digest errors.

Digest errors increment whenever the MD5 digest in the summary packet and the MD5 digest of the received advertisement calculated by the switch do not match. This error usually indicates that the VTP password in the two switches is different. To solve this problem, make sure the VTP password on all switches is the same.

These errors indicate that the switch is filtering incoming advertisements, which causes the VTP database to become unsynchronized across the network.

No. of V1 Summary Errors

Number of version 1 errors.

Version 1 summary errors increment whenever a switch in VTP V2 mode receives a VTP version 1 frame. These errors indicate that at least one neighboring switch is either running VTP version 1 or VTP version 2 with V2-mode disabled. To solve this problem, change the configuration of the switches in VTP V2-mode to disabled.

Summary Advts Received from non-pruning-capable device

Number of VTP summary messages received on the trunk from devices that do not support pruning.

The following is a sample of output from the show vtp status command. Table below describes each field in the display.

Switch#show vtp status

VTP Version                     : 2
Configuration Revision          : 1
Maximum VLANs supported locally : 68
Number of existing VLANs        : 7
VTP Operating Mode              : Server
VTP Domain Name                 : test1
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x3D 0x02 0xD4 0x3A 0xC4 0x46 0xA1 0x03
Configuration last modified by 172.20.130.52 at 3-4-93 22:25:

Table: Show VTP Status Field Descriptions
Field Description

VTP Version

Displays the VTP version operating on the switch. By default,
2950 switches implement version 1 but can be set to
version 2.

Configuration Revision

Current configuration revision number on this switch

Maximum VLANs Supported Locally

Maximum number of VLANs supported locally

Number of Existing VLANs

Number of existing VLANs

VTP Operating Mode

Displays the VTP operating mode, which can be server, client, or transparent

Server: a switch in VTP server mode is enabled for VTP and sends advertisements. You can configure VLANs on it. The switch guarantees that it can recover all the VLAN information in the current VTP database from nonvolatile storage after reboot. By default, every switch is a VTP server.

Client: a switch in VTP client mode is enabled for VTP, can send advertisements, but does not have enough nonvolatile storage to store VLAN configurations. You cannot configure VLANs on it. When a VTP client starts up, it does not transmit VTP advertisements until it receives advertisements to initialize its VLAN database.

Transparent: a switch in VTP transparent mode is disabled for VTP, does not transmit advertisements or learn from advertisements sent by other devices, and cannot affect VLAN configurations on other devices in the network. The switch receives VTP advertisements and forwards them on all trunk ports except the one on which the advertisement was received.

VTP Domain Name

Name that identifies the administrative domain for the switch

VTP V2 Mode

Displays if VTP version 2 mode is enabled. All VTP version 2 switches operate in version 1 mode by default. Each VTP switch automatically detects the capabilities of all the other VTP devices. A network of VTP devices should be configured to version 2 only if all VTP switches in the network can operate in version 2 mode.

VTP Traps Generation

Displays whether VTP traps are transmitted to a network management station

MD5 Digest

A 16-byte checksum of the VTP configuration

Configuration Last Modified

Displays the date and time of the last configuration modification. Displays the IP address of the switch that caused the configuration change to the database.

Misconceptions:
None

Related commands:


 Command:

show interface (switch)

Mode:

Switch#

Syntax:

show interface [interface-id | vlan number] [flow-control | pruning | status | switchport [allowed-vlan | prune-elig | native-vlan]]

Syntax Description:

interface-id

ID of the module and port.

vlan number

VLAN number of the management VLAN. Valid IDs are from 1 to 1000. Do not enter leading zeroes.

flow-control

Displays flowcontrol information for the specified port.

pruning

(Optional) Display pruning information for the trunk port.

status

(Optional) Display the status of the interface.

switchport

(Optional) Display the administrative and operational status of a switching (nonrouting) port.

  • allowed-vlan—Display the VLAN IDs that receive and transmit all types of traffic on the trunk port. By default, all VLAN IDs are included.

  • prune-elig—Display the VLAN ID whose flood traffic can be pruned. By default, all VLANs, except VLAN 1 and 1002 through 1005, are pruning-eligible on the trunk.

  • native-vlan—Display the native VLAN ID for untagged traffic when the port is in 802.1Q trunking mode.

Command Description:

Use the show interface privileged EXEC command to display the administrative and operational status of a switching (nonrouting) port.

Examples:

The following is a sample of output from the show interface gi 0/1 flow-control command.

Switch#show interface gi0/1 flow-control
Any,Input only

The display shows two values separated by a comma. The first value is the value you configured by using the flowcontrol command or through the Cluster Management Suite (or the default value if you did not configure it). The first value displayed can be one of the following settings:

  • None—Flow control is not enabled.
  • Asymmetric—Only the transmit or receive flow control is enabled.
  • Symmetric—Both the transmit and receive flow control are enabled.
  • Any—Any type of flow control is supported.

The second value in the display represents the flow control value that is autonegotiated with the link partner and can be one of the following settings:

  • None—Flow control with the link partner does not occur.
  • Output only—The interface can only transmit pause frames but not receive any.
  • Input only—The interface can only receive pause frames but not transmit any.
  • Output and Input—The interface can transmit and receive pause frames.

    Note If you execute the show interface interface-id flow-control command on a GigaStack Gigabit Interface Converter (GBIC), the first value in the display is the setting for both GigaStack GBIC ports, and the second value is the autonegotiated setting for both ports.

The following is a sample of output from the show interface fa 0/2 switchport command. Table: describes each field in the display.

Switch#show interface fa0/2 switchport
Name: fa0/2
Switchport: Enabled
Administrative Mode: Trunk
Operational Mode: Trunk
Administrative Trunking Encapsulation: ISL
Operational Trunking Encapsulation: ISL
Negotiation of Trunking: Disabled
Access Mode VLAN: 0 (inactive)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: 1-30, 50, 100-1005
Trunking VLANs Active: 1-4
Pruning VLANs Enabled: 2-1001

Priority for untagged frames: 0
Voice VLAN: none
Appliance trust: none

      Table: Show Interface fa0/2 Switchport Field Descriptions
      Field Description

      Name

      Displays the port name

      Switchport

      Displays the administrative and operational status of the port. In this display, the port is in switchport mode.

      Administrative Mode

      Operational Mode

      Displays the administrative and operational mode

      Administrative Trunking Encapsulation

      Operation Trunking Encapsulation

      Negotiation of Trunking

      Displays the administrative and operational encapsulation method. Also displays whether trunking negotiation is enabled.

      Access Mode VLAN

      Displays the VLAN ID to which the port is configured

      Trunking Native Mode VLAN

      Trunking VLANs Enabled

      Trunking VLANs Active

      Lists the VLAN ID of the trunk that is in native mode. Lists the allowed VLANs on the trunk. Lists the active VLANs on the trunk.

      Pruning VLANs Enabled

      Lists the VLANs that are pruning-eligible

      Priority for untagged frames

      Displays the port priority on incoming untagged frames

      Voice VLAN

      Displays the voice VLAN

      Appliance trust

      Displays how the appliance (telephone) connected to the specified port handles priority traffic received on its incoming port

      The following is a sample of output from the show interface fa0/9 pruning command when pruning is enabled in the VTP domain:

      Switch#show interface fa0/9 pruning

Port    Vlans pruned for lack of request by neighbor
Fa0/9   3,4

Port    Vlans traffic requested of neighbor
Fa0/9   1-3

      The following is a sample of output from the show interface status command:

      Switch#show interface status
Port    Name               Status       Vlan     Duplex Speed   Type
------- ------------------ ------------ -------- ------ ------- ----
Fa0/1                      connected    trunk    A-Full   A-100 100BASE-TX/FX
Fa0/2                      notconnect   1          Auto    Auto 100BASE-TX/FX
Fa0/3                      notconnect   1          Auto    Auto 100BASE-TX/FX
Fa0/4                      notconnect   1          Auto    Auto 100BASE-TX/FX
Fa0/5                      notconnect   1          Auto    Auto 100BASE-TX/FX
Fa0/6                      notconnect   1          Auto    Auto 100BASE-TX/FX
Fa0/7                      notconnect   1          Auto    Auto 100BASE-TX/FX
Fa0/8                      notconnect   1          Auto    Auto 100BASE-TX/FX
Fa0/9                      notconnect   1          Auto    Auto 100BASE-TX/FX
<output truncated>

      Misconceptions:

      None

      Related commands:
      switchport mode


Command:

show fm interface

Mode:

Switch#
Switch>

Syntax:

show fm interface {interface-id} | [ | {begin | exclude | include} expression]

Syntax Description:

interface-id | ID of the interface, which can be one of these: physical interface—type and port number. port channel—port-channel port-channel-number (1 to 64). null—null 0. VLAN—vlan vlan-id (1 to 1001). VLAN interfaces are VLANs that have a switch virtual interface (SVI) assigned.
begin | (Optional) Display begins with the line that matches the expression.
exclude | (Optional) Display excludes lines that match the expression.
include | (Optional) Display includes lines that match the specified expression.
expression | Expression in the output to use as a reference point.

Command Description:

Use the show fm interface privileged EXEC command to display per-interface feature-manager information. Use it with the show fm label command to determine which features were able to fit into the hardware.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Example:

This example shows how to display detailed feature manager information on a specified interface:

Switch# show fm interface gigabitethernet0/12

Input Label: 0 (default)
Output Label: 0 (default)
Priority: normal

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show fm label

Mode:

Switch#
Switch>

Syntax:

show fm label label-number [ | {begin | exclude | include} expression]

Syntax Description:

label-number | Label number from 0 to 255
begin | (Optional) Display begins with the line that matches the expression.
exclude | (Optional) Display excludes lines that match the expression.
include | (Optional) Display includes lines that match the specified expression.
expression | Expression in the output to use as a reference point.

Command Description:

Use the show fm label privileged EXEC command to display feature-manager information for a specified label to list features associated with that label that were not able to fit in the hardware.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

An unloaded indicator in the output means that the feature was not loaded in the hardware. To allocate more system resources to maximize the number of security ACLs that can fit in the hardware, you can use the sdm prefer access global configuration command to set the Switch Database Management feature to the access template.

If the output shows a merge failure, using the sdm prefer access command has no effect.

Example:

The following is sample output from the show fm label command when there has been a merge failure on an input access-group:

Switch# show fm label 1

Unloaded due to merge failure or lack of space:
  InputAccessGroup
  Merge Fail:input
Input Features:
  Interfaces or VLANs: Vl1
  Priority:normal
  Vlan Map:(none)
  Access Group:131, 6788 VMRs
  Multicast Boundary:(none), 0 VMRs
Output Features:
  Interfaces or VLANs:
  Priority:low
  Bridge Group Member:no
  Vlan Map:(none)
  Access Group:(none), 0 VMRs

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show fm vlan

Mode:

Switch#
Switch>

Syntax:

show fm vlan vlan-id [ | {begin | exclude | include} expression]

Syntax Description:

vlan-id | Any VLAN ID, whether or not a switch virtual interface (SVI) has been assigned. The range is 1 to 1001.
begin | (Optional) Display begins with the line that matches the expression.
exclude | (Optional) Display excludes lines that match the expression.
include | (Optional) Display includes lines that match the specified expression.
expression | Expression in the output to use as a reference point.

Command Description:

Use the show fm vlan privileged EXEC command to display per-VLAN feature-manager information. Use with the show fm label command to determine which features were able to fit into the hardware.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Example:

This example shows how to display the label used in hardware for VLAN feature configuration:

Switch# show fm vlan 1

Input Label: 0 (default)
Output Label: 0 (default)
Priority: normal

Misconceptions:

None.

Related Commands:

show fm interface

show fm label

© Cisco Systems, Inc. 2001, 2002


Command:

show mac-address-table multicast

Mode:

Switch>

Syntax:

show mac-address-table multicast [vlan vlan-id] [count] [igmp-snooping | user] [ | {begin | exclude | include} expression]

Syntax Description:

vlan vlan-id | (Optional) Specify a VLAN; valid values are 1 to 4094 when the enhanced software image (EI) is installed and 1 to 1005 when the standard software image (SI) is installed. Do not enter leading zeros. (This keyword is only available in privileged EXEC mode.)
count | (Optional) Display total number of entries for the specified criteria instead of the actual entries (only available in privileged EXEC mode).
igmp-snooping | (Optional) Display only entries learned through Internet Group Management Protocol (IGMP) snooping (only available in privileged EXEC mode).
user | (Optional) Display only the user-configured multicast entries (only available in privileged EXEC mode).
begin | (Optional) Display begins with the line that matches the specified expression.
exclude | (Optional) Display excludes lines that match the specified expression.
include | (Optional) Display includes lines that match the specified expression.
expression | Expression in the output to use as a reference point.

Command Description:

Use the show mac-address-table multicast user EXEC command to display the Layer 2 multicast entries for the switch or for the VLAN.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Example:

This is an example of output from the show mac-address-table multicast vlan 1 command:

Switch#show  mac-address-table multicast vlan 1

Vlan    Mac Address     Type    Ports
----    -----------     ----    -----
   1    0100.5e00.0128  IGMP    Fa0/11
   1    0100.5e01.1111  USER    Fa0/5, Fa0/6, Fa0/7, Fa0/11

This is an example of output from the show mac-address-table multicast count command:

Switch#show mac-address-table multicast count

Multicast Mac Entries for all vlans: 10

This is an example of output from the show mac-address-table multicast vlan 1 count command:

Switch#show  mac-address-table multicast vlan 1 count

Multicast Mac Entries for vlan 1: 2

This is an example of output from the show mac-address-table multicast vlan 1 user command:

Switch#show  mac-address-table multicast vlan 1 user

vlan   mac address      type        ports
-----+----------------+-------+---------------------
1     0100.5e02.0203    user     Fa0/1,Fa0/2,Fa0/4

This is an example of output from the show mac-address-table multicast vlan 1 igmp-snooping count command:

Switch#show  mac-address-table multicast vlan 1 igmp-snooping count

Number of igmp-snooping programmed entries : 1

Misconceptions:

None

Related Commands:

None


Command:

show mac-address-table

Mode:

Switch>

Syntax:

show mac-address-table [aging-time | count | dynamic | static] [address hw-addr]
[interface interface-id] [vlan vlan-id] [ | {begin | exclude | include} expression]

Syntax Description:

aging-time

(Optional) Display aging time for dynamic addresses for all VLANs.

count

(Optional) Display the count for different kinds of MAC addresses (only available in privileged EXEC mode).

dynamic

(Optional) Display only the dynamic addresses.

static

(Optional) Display only the static addresses.

address hw-addr

(Optional) Display information for a specific address (only available in privileged EXEC mode).

interface interface-id

(Optional) Display addresses for a specific interface.

vlan vlan-id

(Optional) Display addresses for a specific VLAN. Valid IDs are from
1 to 4094 when the enhanced software image (EI) is installed and 1 to 1001 when the standard software image (SI) is installed.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.

Command Description:

Use the show mac-address-table user EXEC command to display the MAC address table.

This command displays the MAC address table for the switch. Specific views can be defined by using the optional keywords and values. If more than one optional keyword is used, all of the conditions must be true in order for that entry to appear.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Note: Beginning with Release 12.1(11)EA1, the show mac address-table command replaces the show mac-address-table command (with the hyphen). The show mac-address-table command (with the hyphen) will become obsolete in a future release.

Example:

This is an example of output from the show mac-address-table command:

Switch>show mac-address-table

Dynamic Addresses Count: 9

Secure Addresses (User-defined) Count: 0

Static Addresses (User-defined) Count: 0

System Self Addresses Count: 41

Total MAC addresses: 50

Non-static Address Table:

Destination Address Address Type VLAN Destination Port

------------------- ------------ ---- --------------------

0010.0de0.e289 Dynamic 1 FastEthernet0/1

0010.7b00.1540 Dynamic 2 FastEthernet0/5

0010.7b00.1545 Dynamic 2 FastEthernet0/5

0060.5cf4.0076 Dynamic 1 FastEthernet0/1

0060.5cf4.0077 Dynamic 1 FastEthernet0/1

0060.5cf4.1315 Dynamic 1 FastEthernet0/1

0060.70cb.f301 Dynamic 1 FastEthernet0/1

00e0.1e42.9978 Dynamic 1 FastEthernet0/1

00e0.1e9f.3900 Dynamic 1 FastEthernet0/1

This is an example of output from the show mac-address-table static interface fastethernet0/2 vlan 1 command:

Switch>show mac-address-table static interface fastethernet0/2 vlan 1

vlan mac address type ports

-----+---------------+--------+---------

1 abcd.2345.0099 static Fa0/2

1 abcd.0070.0070 static Fa0/2

1 abcd.2345.0099 static Fa0/2

1 abcd.2345.0099 static Fa0/2

1 00d0.d333.7f34 static Fa0/2

1 abcd.2345.0099 static Fa0/2

1 0005.6667.0007 static Fa0/2

This is an example of output from the show mac-address-table count vlan 1 command:

Switch#show mac-address-table count vlan 1

MAC Entries for Vlan 1 :

Dynamic Address Count: 1

Static Address (User-defined) Count: 41

Total MAC Addresses In Use:42

Remaining MAC addresses: 8150

This is an example of output from the show mac-address-table aging-time command:

Switch>show mac-address-table aging-time

Vlan Aging Time

---- ----------

1 450

2 300

3 600

300 450

301 450

This is an example of output from the show mac-address-table aging-time vlan 1 command:

Switch>show mac-address-table aging-time vlan 1

Vlan Aging Time

---- ----------

1 450

Misconceptions:

None.

Related Commands:

clear mac-address-table dynamic


Command:

show monitor

Mode:

Switch>

Syntax:

show monitor [session {session_number | all | local | range | remote}] [ | {begin | exclude | include} expression]

Syntax Description:

session session_number | (Optional) Specify the session number identified with this SPAN or RSPAN session.
all | Specify all sessions.
local | Specify local sessions.
range | Specify a range of sessions.
remote | Specify remote sessions.
begin | (Optional) Display begins with the line that matches the expression.
exclude | (Optional) Display excludes lines that match the expression.
include | (Optional) Display includes lines that match the specified expression.
expression | Expression in the output to use as a reference point.

Command Description:

Use the show monitor user EXEC command to display Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) session information.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Example:

This is an example of output for the show monitor privileged EXEC command for RSPAN source session 1:

Switch# show monitor session 1
Session 1
---------
Type: Remote Source Session
Source Ports:
RX Only: Fa0/3
TX Only: None
Both: None
Source VLANs:
RX Only: None
TX Only: None
Both: None
Source RSPAN VLAN: None
Destination Ports: None
Encapsulation: Native
Reflector Port: Fa0/4
Filter VLANs: None
Dest RSPAN VLAN: 901

Misconceptions:

None.

Related Commands:

None

© Cisco Systems, Inc. 2001, 2002


Command:

show port-security

Mode:

Switch#

Syntax:

show port-security [interface interface-id] [address] [ | {begin | exclude | include} expression]

Syntax Description:

interface interface-id

(Optional) Display the port security settings for the specified interface.

address

(Optional) Display all the secure addresses on all ports.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.

Command Description:

Use the show port-security privileged EXEC command to display the port security settings defined for an interface or for the switch.

If you enter this command without keywords, the output includes the administrative and the operational status of all secure ports on the switch.

If you enter an interface-id, the show port-security command displays port security settings for the interface.

If you enter the address keyword, the show port-security address command displays the secure MAC addresses for all interfaces and the aging information for each secure address.

If you enter an interface-id and the address keyword, the show port-security interface interface-id address command displays all the MAC addresses for the interface with aging information for each secure address. You can also use this command to display all the MAC addresses for an interface even if you have not enabled port security on it.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Example:

This is an example of output from the show port-security command:

Switch#show port-security

Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security

Action

(Count) (Count) (Count)

----------------------------------------------------------------------------

---

Fa0/1 11 11 0 Shutdown

Fa0/5 15 5 0 Restrict

Fa0/11 5 4 0 Protect

----------------------------------------------------------------------------

---

Total Addresses in System :21

Max Addresses limit in System :1024

This is an example of output from the show port-security interface fastethernet0/2 command:

Switch#show port-security interface fastethernet0/2

Port Security :Enabled

Port status :SecureUp

Violation mode :Shutdown

Maximum MAC Addresses :11

Total MAC Addresses :11

Configured MAC Addresses :3

Aging time :20 mins

Aging type :Inactivity

SecureStatic address aging :Enabled

Security Violation count :0

This is an example of output from the show port-security address command:

Switch#show port-security address

Secure Mac Address Table

-------------------------------------------------------------------

Vlan Mac Address Type Ports Remaining Age

(mins)

---- ----------- ---- ----- -------------

1 0001.0001.0001 SecureDynamic Fa0/1 15 (I)

1 0001.0001.0002 SecureDynamic Fa0/1 15 (I)

1 0001.0001.1111 SecureConfigured Fa0/1 16 (I)

1 0001.0001.1112 SecureConfigured Fa0/1 -

1 0001.0001.1113 SecureConfigured Fa0/1 -

1 0005.0005.0001 SecureConfigured Fa0/5 23

1 0005.0005.0002 SecureConfigured Fa0/5 23

1 0005.0005.0003 SecureConfigured Fa0/5 23

1 0011.0011.0001 SecureConfigured Fa0/11 25 (I)

1 0011.0011.0002 SecureConfigured Fa0/11 25 (I)

-------------------------------------------------------------------

Total Addresses in System :10

Max Addresses limit in System :1024

This is an example of output from the show port-security interface fastethernet0/5 address command:

Switch#show port-security interface fastethernet0/5 address

Secure Mac Address Table

-------------------------------------------------------------------

Vlan Mac Address Type Ports Remaining Age

(mins)

---- ----------- ---- ----- -------------

1 0005.0005.0001 SecureConfigured Fa0/5 19 (I)

1 0005.0005.0002 SecureConfigured Fa0/5 19 (I)

1 0005.0005.0003 SecureConfigured Fa0/5 19 (I)

-------------------------------------------------------------------

Total Addresses:3

Misconceptions:

None.

Related Commands:

switchport port-security


Command:

show post

Mode:

Switch#

Syntax:

show post

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the show post privileged EXEC command to see which or if a POST test failed.

Example:

The following is sample output from the show post command:

Switch#show post
Passed

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show vlan access-map

Mode:

Switch#

Syntax:

show vlan access-map [mapname] [ | {begin | exclude | include} expression]

Syntax Description:

mapname | (Optional) Name of a specific VLAN access map.
begin | (Optional) Display begins with the line that matches the expression.
exclude | (Optional) Display excludes lines that match the expression.
include | (Optional) Display includes lines that match the specified expression.
expression | Expression in the output to use as a reference point.

Command Description:

Use the show vlan access-map privileged EXEC command to display information about a particular virtual LAN (VLAN) access map or all VLAN access maps.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Example:

The following is sample output from the show vlan access-map command:

Switch# show vlan access-map

Vlan access-map "map_1" 10
  Match clauses:
     ip address: ip1
  Action:
     drop
Vlan access-map "map_1" 20
  Match clauses:
     mac address: mac1
  Action:
     forward
Vlan access-map "map_1" 30
  Match clauses:
  Action:
     drop

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show vlan filter

Mode:

Switch#

Syntax:

show vlan filter [access-map name | vlan vlan-id] [ | {begin | exclude | include} expression]

Syntax Description:

access-map name | (Optional) Display filtering information for the specified VLAN access map.
vlan vlan-id | (Optional) Display filtering information for the specified VLAN.
begin | (Optional) Display begins with the line that matches the expression.
exclude | (Optional) Display excludes lines that match the expression.
include | (Optional) Display includes lines that match the specified expression.
expression | Expression in the output to use as a reference point.

Command Description:

Use the show vlan filter privileged EXEC command to display information about all virtual LAN (VLAN) filters or about a particular VLAN or VLAN access map.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Example:

The following is sample output from the show vlan filter command:

Switch# show vlan filter

VLAN Map map_1 is filtering VLANs:
  20-22

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

show vlan-membership (Catalyst 1900 Switches)

Mode:

Switch#

Syntax:

show vlan membership

Syntax Description:

This command has no additional arguments or keywords.

Command Description:

Use the show vlan-membership privileged Exec command to display the VLAN assignment and membership type for all switch ports.

This command is not functional when bridge groups are enabled.

Example:

This example shows how to display the VLAN assignment and membership type for all switch ports:

hostname# show vlan-membership
Port  VLAN  Membership Type            Port  VLAN  Membership Type
---------------------------------------------------------------------------
  1       1      Static                     14      2       Static
  2       1      Static                     15      2       Static
  3       1      Static                     16      2       Static
  4       1      Static                     17      2       Static
  5       1      Static                     18      2       Static
  6       1      Static                     19      2       Static
  7       1      Dynamic                    20      2       Static
  8       1      Dynamic                    21      2       Static
  9       1      Dynamic                    22      2       Static
  10      1      Dynamic                    23      2       Static
  11      1      Dynamic                    24      2       Static
  12      1      Dynamic                    AUI     2       Static
  13      1      Dynamic
  A       1      Static
  B       2      Static

Misconceptions:

None.

Related Commands:

vlan

vlan-membership (reconfirm)

vlan-membership (server)

vlan-membership (server-retry)


Command:

show vmps

Mode:

Switch>

Syntax:

show vmps [noalias]

Syntax Description:

noalias (Optional) Forces the display to show IP addresses, not IP aliases.

Command Description:

To display VMPS configuration information, use the show vmps command.

Example:

This example shows how to display VMPS configuration information:

Console> show vmps
VMPS Server Status:
-------------------
Management Domain: (null)
State: disabled
Operational Status: inactive
TFTP Server: default
TFTP File: vmps-config-database.1
Fallback VLAN: (null)
Secure Mode: open
VMPS No Domain Req: allow
VMPS Client Status:
---------------------
VMPS VQP Version: 1
Reconfirm Interval: 60 min
Server Retry Count: 3
VMPS domain server:
No dynamic ports configured.
Console>
No dynamic ports configured.

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

snmp-server community

Mode:

Router(config)#

Syntax:

snmp-server community string [view view-name] [ro | rw] [number]
no snmp-server community string

Syntax Description:

string | Community string that acts like a password and permits access to the SNMP protocol.
view view-name | (Optional) Name of a previously defined view. The view defines the objects available to the community.
ro | (Optional) Specifies read-only access. Authorized management stations are only able to retrieve MIB objects.
rw | (Optional) Specifies read-write access. Authorized management stations are able to both retrieve and modify MIB objects.
number | (Optional) Integer from 1 to 99 that specifies an access list of IP addresses that are allowed to use the community string to gain access to the SNMP agent.

Command Description:

To set up the community access string to permit access to the Simple Network Management Protocol (SNMP), use the snmp-server community global configuration command. To remove the specified community string, use the no form of this command.

By default, an SNMP community string permits read-only access to all objects.

The no snmp-server command disables all versions of SNMP (SNMPv1, SNMPv2C, SNMPv3).

The first snmp-server command that you enter enables all versions of SNMP.

Example:

The following example assigns the string comaccess to SNMP allowing read-only access and specifies that IP access list 4 can use the community string:

Router(config)# snmp-server community comaccess ro 4

The following example assigns the string mgr to SNMP allowing read-write access to the objects in the restricted view:

Router(config)# snmp-server community mgr view restricted rw

The following example removes the community comaccess:

Router(config)# no snmp-server community comaccess

The following example disables all versions of SNMP:

Router(config)# no snmp-server

Misconceptions:

If the snmp-server community command is not used during the SNMP configuration session, it will automatically be added to the configuration after the snmp host command is used. In this case, the default password (string) for the snmp-server community will be taken from the snmp host command.

Related Commands:

access-list


Command:

snmp-server contact

Mode:

Router(config)#

Syntax:

snmp-server contact text

no snmp-server contact

Syntax Description:

text

String that describes the system contact information.

Defaults

No system contact string is set.

Command Description:

To set the system contact (sysContact) string, use the snmp-server contact global configuration command. To remove the system contact information, use the no form of this command.

Example:

The following is an example of a system contact string:

Router(config)# snmp-server contact Dial System Operator at beeper # 27345

Misconceptions:

None.

Related Commands:

snmp-server location


Command:

snmp-server enable traps

Mode:

Router(config)#

Syntax:

snmp-server enable traps [notification-type]
no snmp-server enable traps [notification-type]

Syntax Description:

notification-type (Optional) Type of notification (trap or inform) to enable or disable. If no type is specified, all notifications available on your device are enabled or disabled. The notification type can be one of the following keywords:
config--Controls configuration notifications, as defined in the CISCO-CONFIG-MAN-MIB (enterprise 1.3.6.1.4.1.9.9.43.2). The notification type is: (1) ciscoConfigManEvent. dlsw [circuit | tconn]--Controls DLSw notifications, as defined in the CISCO-DLSW-MIB (enterprise 1.3.6.1.4.1.9.10.9.1.7). When the dlsw keyword is used, you can specify the specific notification types you wish to enable or disable. If no keyword is used, all DLSw notification types are enabled. The option can be one of the following keywords:
circuit--Enables DLSw circuit traps:
(5) ciscoDlswTrapCircuitUp
(6) ciscoDlswTrapCircuitDown

tconn--Enables DLSw peer transport connection traps:
(1) ciscoDlswTrapTConnPartnerReject
(2) ciscoDlswTrapTConnProtViolation
(3) ciscoDlswTrapTConnUp
(4) ciscoDlswTrapTConnDown

ds0-busyout--Sends notification whenever the busyout of a DS0 interface changes state (Cisco AS5300 platform only). This is from the CISCO-POP-MGMT-MIB (enterprise 1.3.6.1.4.1.9.10.19.2) and the notification type is:(1) cpmDS0BusyoutNotification

ds1-loopback--Sends notification whenever the DS1 interface goes into loopback mode (Cisco AS5300 platform only). This notification type is defined in the CISCO-POP-MGMT-MIB (enterprise 1.3.6.1.4.1.9.10.19.2) as: (2) cpmDS1LoopbackNotification.

entity--Controls Entity MIB modification notifications. This notification type is defined in the ENTITY-MIB (enterprise 1.3.6.1.2.1.47.2) as: (1) entConfigChange.

hsrp--Controls Hot Standby Routing Protocol (HSRP) notifications, as defined in the CISCO-HSRP-MIB (enterprise 1.3.6.1.4.1.9.9.106.2). The notification type is: (1) cHsrpStateChange.

ipmulticast--Controls IP Multicast notifications.

modem-health--Controls modem-health notifications.

rsvp--Controls Resource Reservation Protocol (RSVP) notifications.

rtr--Controls Service Assurance Agent / Response Time Reporter (RTR) notifications.

syslog--Controls error message notifications (Cisco Syslog MIB). Specify the level of messages to be sent with the logging history level command.

xgcp--Sends External Media Gateway Control Protocol (XGCP) notifications. This notification is from the XGCP-MIB-V1SMI.my and the notifications are: enterprise 1.3.6.1.3.90.2 (1) xgcpUpDownNotification

Command Description:

To enable all Simple Network Management Protocol (SNMP) notifications (traps or informs) available on your system, use the snmp-server enable traps global configuration command. To disable all available SNMP notifications, use the no form of this command.

This command is disabled by default. Most notification types are disabled. However, some notification types cannot be controlled with this command.

SNMP notifications can be sent as traps or inform requests. This command enables both traps and inform requests for the specified notification types. To specify whether the notifications should be sent as traps or informs, use the snmp-server host [traps | informs] command.

If you do not enter an snmp-server enable traps command, no notifications controlled by this command are sent. In order to configure the router to send these SNMP notifications, you must enter at least one snmp-server enable traps command. If you enter the command with no keywords, all notification types are enabled. If you enter the command with a keyword, only the notification type related to that keyword is enabled. In order to enable multiple types of notifications, you must issue a separate snmp-server enable traps command for each notification type and notification option.

The snmp-server enable traps command is used in conjunction with the snmp-server host command. Use the snmp-server host command to specify which host or hosts receive SNMP notifications. In order to send notifications, you must configure at least one snmp-server host command.

Example:

The following example enables the router to send all traps to the host specified by the name myhost.cisco.com, using the community string defined as public:

Router(config)#snmp-server enable traps
Router(config)#snmp-server host myhost.cisco.com public

The following example enables the router to send Frame Relay and environmental monitor traps to the host myhost.cisco.com using the community string public:

Router(config)#snmp-server enable traps frame-relay
Router(config)#snmp-server enable traps envmon temperature
Router(config)#snmp-server host myhost.cisco.com public

The following example will not send traps to any host. The BGP traps are enabled for all hosts, but the only traps enabled to be sent to a host are ISDN traps (which are not enabled in this example).

Router(config)#snmp-server enable traps bgp
Router(config)#snmp-server host bob public isdn

The following example enables the router to send all inform requests to the host at the address myhost.cisco.com, using the community string defined as public:

Router(config)#snmp-server enable traps
Router(config)#snmp-server host myhost.cisco.com informs version 2c public

The following example sends HSRP MIB traps to the host myhost.cisco.com using the community string public.

Router(config)#snmp-server enable traps hsrp
Router(config)#snmp-server host myhost.cisco.com traps version 2c public hsrp

Misconceptions:

None

Related Commands:

snmp-server host


Command:

snmp-server host

Mode:

Router(config)#

Syntax:

snmp-server host host-addr [traps | informs] [version {1 | 2c | 3 [auth | noauth | priv]}] community-string [udp-port port] [notification-type]
no snmp-server host host-addr [traps | informs]

Syntax Description:

host-addr | Name or Internet address of the host (the targeted recipient).
traps | (Optional) Sends SNMP traps to this host. This is the default.
informs | (Optional) Sends SNMP informs to this host.
version (Optional) Version of the SNMP used to send the traps. Version 3 is the most secure model, because it allows packet encryption with the priv keyword. If you use the version keyword, one of the following must be specified:
1--SNMPv1. This option is not available with informs.
2c--SNMPv2C.
3--SNMPv3. The following three optional keywords can follow the version 3 keyword:
auth (Optional). Enables Message Digest 5 (MD5) and Secure Hash Algorithm (SHA) packet authentication
noauth (Default). The noAuthNoPriv security level. This is the default if the [auth | noauth | priv] keyword choice is not specified.
priv (Optional). Enables Data Encryption Standard (DES) packet encryption (also called "privacy").
community-string | Password-like community string sent with the notification operation. Though you can set this string using the snmp-server host command by itself, we recommend you define this string using the snmp-server community command prior to using the snmp-server host command.
udp-port port | (Optional) UDP port of the host to use. The default is 162.
notification-type (Optional) Type of notification to be sent to the host. If no type is specified, all notifications are sent. The notification type can be one or more of the following keywords:
bgp--Sends Border Gateway Protocol (BGP) state change notifications.
calltracker--Sends Call Tracker call-start/call-end notifications.
config--Sends configuration notifications.
dspu--Sends downstream physical unit (DSPU) notifications.
entity--Sends Entity MIB modification notifications.
envmon--Sends Cisco enterprise-specific environmental monitor notifications when an environmental threshold is exceeded.
frame-relay--Sends Frame Relay notifications.
hsrp--Sends Hot Standby Routing Protocol (HSRP) notifications.
isdn--Sends Integrated Services Digital Network (ISDN) notifications.
llc2--Sends Logical Link Control, type 2 (LLC2) notifications.
repeater--Sends standard repeater (hub) notifications.
rsrb--Sends remote source-route bridging (RSRB) notifications.
rsvp--Sends Resource Reservation Protocol (RSVP) notifications.
rtr--Sends SA Agent (RTR) notifications.
sdlc--Sends Synchronous Data Link Control (SDLC) notifications.
sdllc--Sends SDLLC notifications.
snmp--Sends any enabled RFC 1157 SNMP linkUp, linkDown, authenticationFailure, warmStart, and coldStart notifications.
stun--Sends serial tunnel (STUN) notifications.
syslog--Sends error message notifications (Cisco Syslog MIB). Specify the level of messages to be sent with the logging history level command.
tty--Sends Cisco enterprise-specific notifications when a Transmission Control Protocol (TCP) connection closes.
voice--Sends SNMP poor quality of voice traps, when used with the snmp enable peer-trap poor qov command.
x25--Sends X.25 event notifications.

Command Description:

To specify the recipient of a Simple Network Management Protocol (SNMP) notification operation, use the snmp-server host global configuration command. To remove the specified host, use the no form of this command.

This command is disabled by default. No notifications are sent.

If you enter this command with no keywords, the default is to send all trap types to the host. No informs will be sent to this host.

If no version keyword is present, the default is version 1. The no snmp-server host command with no keywords will disable traps, but not informs, to the host. In order to disable informs, use the no snmp-server host informs command.

SNMP notifications can be sent as traps or inform requests. Traps are unreliable because the receiver does not send acknowledgments when it receives traps. The sender cannot determine if the traps were received. However, an SNMP entity that receives an inform request acknowledges the message with an SNMP response PDU. If the sender never receives the response, the inform request can be sent again. Thus, informs are more likely to reach their intended destination.

However, informs consume more resources in the agent and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request must be held in memory until a response is received or the request times out. Also, traps are sent only once, while an inform may be retried several times. The retries increase traffic and contribute to a higher overhead on the network.

If you do not enter an snmp-server host command, no notifications are sent. In order to configure the router to send SNMP notifications, you must enter at least one snmp-server host command. If you enter the command with no keywords, all trap types are enabled for the host.

In order to enable multiple hosts, you must issue a separate snmp-server host command for each host. You can specify multiple notification types in the command for each host.

When multiple snmp-server host commands are given for the same host and kind of notification (trap or inform), each succeeding command overwrites the previous command. Only the last snmp-server host command will be in effect. For example, if you enter an snmp-server host inform command for a host and then enter another snmp-server host inform command for the same host, the second command will replace the first.

The snmp-server host command is used in conjunction with the snmp-server enable command. Use the snmp-server enable command to specify which SNMP notifications are sent globally. For a host to receive most notifications, at least one snmp-server enable command and the snmp-server host command for that host must be enabled.

However, some notification types cannot be controlled with the snmp-server enable command. For example, some notification types are always enabled. Other notification types are enabled by a different command. For example, the linkUpDown notifications are controlled by the snmp trap link-status command. These notification types do not require an snmp-server enable command.

A notification-type option's availability depends on the router type and Cisco IOS software features supported on the router. For example, the envmon notification-type is available only if the environmental monitor is part of the system. To see what notification types are available on your system, use the command help ? at the end of the snmp-server host command.

Example:

If you want to configure a unique snmp community string for traps, but you want to prevent snmp polling access with this string, the configuration should include an access-list. In the following example, the community string is named "comaccess" and the access list is numbered 10:

Router(config)#snmp-server community comaccess ro 10
Router(config)#snmp-server host 172.20.2.160 comaccess
Router(config)#access-list 10 deny any

The following example sends RFC 1157 SNMP traps to the host specified by the name myhost.cisco.com. Other traps are enabled, but only SNMP traps are sent because only snmp is specified in the snmp-server host command. The community string is defined as comaccess.

Router(config)#snmp-server enable traps
Router(config)#snmp-server host myhost.cisco.com comaccess snmp

The following example sends the SNMP and Cisco environmental monitor enterprise-specific traps to address 172.30.2.160:

Router(config)#snmp-server enable traps snmp
Router(config)#snmp-server enable traps envmon
Router(config)#snmp-server host 172.30.2.160 public snmp envmon

The following example enables the router to send all traps to the host myhost.cisco.com using the community string public:

Router(config)#snmp-server enable traps
Router(config)#snmp-server host myhost.cisco.com public

The following example will not send traps to any host. The BGP traps are enabled for all hosts, but only the ISDN traps are enabled to be sent to a host.

Router(config)#snmp-server enable traps bgp
Router(config)#snmp-server host bob public isdn

The following example enables the router to send all inform requests to the host myhost.cisco.com using the community string public:

Router(config)#snmp-server enable traps
Router(config)#snmp-server host myhost.cisco.com informs version 2c public

The following example sends HSRP MIB informs to the host specified by the name myhost.cisco.com. The community string is defined as public.

Router(config)#snmp-server enable traps hsrp
Router(config)#snmp-server host myhost.cisco.com informs version 2c public hsrp

Misconceptions:

None

Related Commands:

snmp-server enable traps


Command:

snmp-server location

Mode:

Router(config)#

Syntax:

snmp-server location text

no snmp-server location

Syntax Description:

text

String that describes the system location information.

Defaults

No system location string is set.

Command Description:

To set the system location string, use the snmp-server location global configuration command. To remove the location string, use the no form of this command.

Example:

The following example illustrates a system location string:

snmp-server location Building 3/Room 214

Misconceptions:

None.

Related Commands:

snmp-server contact


 Command:

default-information originate

Mode:

Router(config-router)#

Syntax:

default-information originate [route-map mapname]

no default-information originate [route-map mapname]

Syntax Description:

route-map

(Optional) Routing process will generate the default route if the route map is satisfied

Command Description:

To generate a default route into RIP, use the default-information originate router configuration command. To disable this feature, use the no form of this command.

Example:

Router(config-router)#default-information originate route-map condition

Misconceptions:

None

Related Commands:
None


 Command:

ip classless

Mode:

Router(config)#

Syntax:

ip classless

no ip classless

Syntax Description:

This command has no arguments or keywords.

Command Description:

At times the router might receive packets destined for a subnet of a network that has no network default route. To have the Cisco IOS software forward such packets to the best supernet route possible, use the ip classless global configuration command. To disable this feature, use the no form of this command. When this feature is disabled, the software discards the packets when a router receives packets for a subnet that numerically falls within its subnetwork addressing scheme.

Example:
Router(config)#ip classless

Misconceptions:
None

Related Commands:
ip subnet-zero


 Command:

ip default-gateway

Mode:

Router(config)#

Syntax:

ip default-gateway ip address

no ip default-gateway ip address

Syntax Description:
ip-address IP address of the router

Command Description:

To define a default gateway (router) when IP routing is disabled, use the ip default-gateway global configuration command. To disable this function, use the no form of this command.

Example:
Router(config)#ip default-gateway 192.31.7.18

Misconceptions:

The ip default-gateway command is often used to try to set the router's default route. This is incorrect. The ip default-gateway setting is only used when ip routing is disabled. This command does not set the router's default route.

Related Commands:

None


 Command:

ip default-network

Mode:

Router(config)#

Syntax:

ip default-network network-number

no ip default-network network-number

Syntax Description:

network-number

Number of the network

Command Description:

To select a network as a candidate route for computing the gateway of last resort, use the ip default-network global configuration command. To remove a route, use the no form of this command.

The Cisco IOS software uses both administrative distance and metric information to determine the default route. Multiple ip default-network commands can be given. All candidate default routes, both static (that is, flagged by ip default-network) and dynamic, appear in the routing table preceded by an asterisk.

If the IP routing table indicates that the specified network number is subnetted and a non-zero subnet number is specified, then the system will automatically configure a static summary route. This static summary route is configured instead of a default network. The effect of the static summary route is to cause traffic destined for subnets that are not explicitly listed in the IP routing table to be routed using the specified subnet.
Example:

The following example defines a static route to network 10.0.0.0 as the static default route:

Router(config)#ip route 10.0.0.0 255.0.0.0 131.108.3.4
Router(config)#ip default-network 10.0.0.0

In the preceeding example, the ip default-network command will only be in effect if network 10.0.0.0 exists in the router's routing table.

Misconceptions:

None

Related Commands:
show ip route


Command:

clear config all

Mode:

Switch> (enable)

Syntax:

clear config all

Syntax Description:

all

Keyword that clears all information about modules and system configuration, including the IP address.

Command Description:

Use the clear config command to clear information about the system or module configuration stored in NVRAM.

When you clear the configuration using the clear config all command, the default switch configuration is restored. The information that is cleared includes manually configured IP addresses and IP addresses learned through DHCP or RARP.

When you clear the configuration, the IP address and subnet mask on the me1 and sc0 interfaces are set to 0.0.0.0. The me1 interface is brought down, and the sc0 interface is brought up.

Before using the clear config all command, save a backup of the configuration.

Example:

This example shows how to delete all the configuration information:

Switch (enable)>clear config all

Misconceptions:

None

Related Commands:

configure (CLI)

show config


Command:

clear mls

Mode:

Switch> (enable)

Syntax:

clear mls include {{ip_addr} | all}
clear mls nde flow
clear mls statistics
clear mls entry {[destination {ip_addr_spec}] [source {ip_addr_spec}] | [flow {protocol}{src_port} {dst_port}] | all}

Syntax Description:

include | Keyword used to remove the inclusion of the specified routers.
ip_addr | Route-processor IP address, or name of the route processor if DNS is enabled.
all | Keyword used to remove all routers from participation in the flow.
nde flow | Keywords used to reset the filter to the defaults.
statistics | Keyword used to clear the following statistics: total packets switched and total packets exported (for NDE).
entry | Keyword used to purge the specified NFLS entry, or all entries if all is specified. All matching NFLS entries are purged.
destination | (Optional) Keyword used to specify the destination IP address.
ip_addr_spec | (Optional) Full IP address or a subnet address in the following formats: ip_subnet_addr, ip_addr/subnet_mask, or ip_addr/#subnet_mask_bits.
source | (Optional) Keyword used to specify the source IP address.
flow | (Optional) Keyword used to specify additional flow information (protocol family and protocol port pair) to be matched.
protocol | (Optional) Keyword used to specify flow information; valid values include tcp,udp, icmp, or a decimal number for other protocol families.
src_port | (Optional) Source port IP address.
dst_port | (Optional) Destination port IP address.
all | (Optional) Keyword used to specify all NFLS entries.

Command Description:

Use the clear mls command set to clear the MLS feature in the Catalyst 5000 series switch.

If you enter any of the clear mls commands on a Catalyst 5000 series switch without MLS, the following warning message is displayed:

MLS not supported on feature card.

When you remove an RSM from the Catalyst 5000 series switch, it is immediately removed from the inclusion list and all the NFLS entries for the RSM are removed.

Up to 16 routers can be explicitly included.

To use a router as an NFLS, you must meet the following conditions:

  • The router must be included (either explicitly or automatically).
  • The MLS feature must be enabled in the Catalyst 5000 series switch.
  • The Catalyst 5000 series switch must know the router's MAC-VLAN pairs.

Use the following syntax to specify an IP subnet address:

  • ip_subnet_addr—This is the short subnet address format. The trailing decimal number 00 in an IP address YY.YY.YY.00 specifies the boundary for an IP subnet address. For example, 172.22.36.00 indicates a 24-bit subnet address (subnet mask 172.22.36.00/255.255.255.0), and 173.24.00.00 indicates a 16-bit subnet address (subnet mask 173.24.00.00/255.255.0.0). However, this format can only identify a subnet address with a length of 8,16, or 24 bits.
  • ip_addr/subnet_mask—This is the long subnet address format, for example, 172.22.252.00/255.255.252.00 indicates a 22-bit subnet address. This format can specify a subnet address of any bit number. To provide more flexibility, the ip_addr is allowed to be a full host address, such as 172.22.253.1/255.255.252.00.
  • ip_addr/maskbits—This is the simplified long subnet address format. The mask bits specifies the number of bits of the network masks. For example, 172.22.252.00/22 indicates a 22-bit subnet address. The ip_addr is allowed to be a full host address, such as 172.22.254.1/22, which has the same subnet address as 172.22.252.00/22.

If you do not use the all argument in the clear mls entry command, you must specify at least one of the other three keywords (source, destination, or flow) and its arguments.

A 0 value for source_port and destination_port clears all entries. Unspecified options are treated as wildcards and all entries are cleared.

Example:

This example shows how to disable MLS for the Stargate router (IP address 172.20.15.1):

Console> (enable) clear mls include Stargate

Multilayer switching is disabled for router 172.20.15.1 (Stargate)
Console>(enable)

This example shows how to clear additional flow information (protocol family and protocol port pair):

Console> (enable) clear mls nde flow

Netflow data export filter cleared.
Console>(enable)

This example shows how to clear MLS statistics, including: total packets switched and total packets exported (for NDE):

Console> (enable) clear mls statistics

Netflow data export statistics cleared.
Console>(enable)

This example shows how to clear the MLS entries with destination IP address 172.20.26.22:

Console>(enable) clear mls entry destination 172.20.26.22

Multilayer switching entry cleared.
Console>(enable)

This example shows how to clear specific MLS entries for destination IP address 172.20.26.22:

Console>(enable) clear mls destination 172.20.26.22 source 172.20.22.113 flow tcp 520 320

Multilayer switching entry cleared
Console>(enable)

Misconceptions:

None

Related Commands:

set mls

show mls


Command:

clear trunk

Mode:

Switch> (enable)

Syntax:

clear trunk mod ports [vlans]

Syntax Description:

mod

Variable that specifies the number of the module.

ports

Variable that specifies the number of the ports on the module.

vlans

(Optional) Variable that specifies one or more VLANs to remove from the allowed VLAN list for the trunk port; valid values are from 2 to 1005.

Command Description:

Use the clear trunk command to restore a trunk port to its default trunk type and mode or to clear specific VLANs from the allowed VLAN list for a trunk port.

If you specify VLANs, those VLANs are removed from the list of VLANs allowed on the trunk. Traffic for the removed VLANs is not forwarded over the trunk port.

Default VLANs cannot be cleared from the allowed VLAN list on the trunk.

To add VLANs that you have removed, use the set trunk mod_num/port_num vlan_range command.

Example:

This example shows how to clear VLANs 200 to 500 from the trunk port on port 2 of module 1:

Console> (enable) clear trunk 1/2 200-500

Removing Vlan(s) 200-500 from allowed list.
Port 1/2 allowed vlans modified to 1-199,501-1000.
Console> (enable)

This example shows how to clear the trunk on port 2 of module 1:

Console> (enable) clear trunk 1/2

Port(s) 1/2 trunk mode set to auto.
Port(s) 1/2 trunk type set to isl.
Console> (enable)

Misconceptions:

None

Related Commands:

set trunk

show trunk


Command:

clear vlan

Mode:

Switch> (enable)

Syntax:

clear vlan vlan

Syntax Description:

vlan

Variable that specifies the number of the VLAN, valid values are from 2 to 1000.

Command Description:

Use the clear vlan command to delete an existing VLAN from a management domain.

Follow these guidelines for deleting VLANs:

  • When you delete a normal-range Ethernet VLAN in VTP server mode, the VLAN is removed from all switches in the same VTP domain.
  • When you delete a normal-range VLAN in VTP transparent mode, the VLAN is deleted only on the current switch.
  • You can delete an extended-range VLAN only on the switch where it was created.

Example:

This example shows how to clear an existing VLAN (VLAN 4) from a management domain:

Console> (enable) clear vlan 4
This command will deactivate all ports on vlan 4 in the entire management domain:
Do you want to continue(y/n) [n]? y
VLAN 4 deleted
Console> (enable)

Misconceptions:

When you clear a VLAN on a switch configured as a VTP server, the VLAN is deleted from the entire VTP domain. Every switch in that VTP domain will delete the VLAN.

When you clear a VLAN, all ports assigned to that VLAN become inactive. However, the VLAN port assignments are retained until you move the ports to another VLAN. If the cleared VLAN is reactivated, all ports still configured on that VLAN are also reactivated.

When you clear a private VLAN (primary, isolated, or community), the ports are set to inactive and are not assigned to any VLAN. The private VLAN mappings for the selected VLAN are also cleared. ACL to VLAN mappings are also deleted.

Related Commands:

set vlan

show vlan


Command:

clear vtp pruning

Mode:

Switch> (enable)

Syntax:

clear vtp pruning vlan_num

Syntax Description:

vlan_num

Variable that specifies the number of VLANs to be made ineligible for pruning. Valid values are from 1 to 1005.

Command Description:

Use the clear vtp pruning command to specify the VLANs in the VTP domain that are ineligible for pruning.

VTP pruning prevents traffic in each pruning-eligible VLAN from being transmitted on a VLAN trunk if no stations belonging to that VLAN are located across that trunk. Use the set vtp command to enable VTP pruning.

Use the set vtp pruning command to make the VLANs eligible for pruning again.

Example:

This example shows how to make VLANs 200 to 500 ineligible for pruning:

Console> (enable) clear vtp pruning 200-500

Vlans 1,200-500,1001-1005 will not be pruned on this device.
VTP domain Company modified.
Console> (enable)

Misconceptions:

None

Related Commands:

set vtp

show vtp statistics

set vtp pruneeligible

set vtp pruning


 Command:

configure (CLI)

Mode:

Switch> (enable)

Syntax:

configure host file [rcp]

Syntax Description:

host

Variable that specifies the IP address or IP alias of the host.

file

Variable that specifies the name of the configuration file.

rcp

(Optional) Keyword that specifies rcp as file transfer method.

Command Description:

Use the configure command to download a configuration file from a host and execute each command in that file.

Example:

Refer to the Software Configuration Guide-Catalyst 4000 Family, 2948G, and 2980G Switches for information on how to construct a configuration file to download using the configure command.

The following is a sample configuration file. Each line contains a command, except for the lines that begin with ! or #. On some servers (NT), the TFTP directory might not be /tftpboot.

begin
show time
set ip alias conc7 198.133.219.207
set ip alias montreux 198.133.119.42
set ip alias cres 192.122.174.42
set prompt system5>
set password
# empty string old password

pingpong
pingpong
end
#

This example shows how to configure the switch using a configuration file downloaded from a TFTP server:

Console> (enable) configure 192.122.174.42 system5.cfg

Configure using system5.cfg from 192.122.174.42 (y/n) [n]? y

/
Done.  Finished Network Download.  (446 bytes)
>> show time
Wed Nov 11 1998, 17:42:50
>> set ip alias conc7 198.133.219.207
IP alias added.
>> set ip alias montreux 198.133.219.40
IP alias added.
>> set ip alias cres 192.122.174.42
IP alias added.
>> set prompt system5>
>> set password
Enter old password:
Enter new password: pingpong

Retype new password: pingpong

Password changed.

Misconceptions:

None

Related Commands:
show config


Command:

copy (CLI)

Mode:

Switch> (enable)

Syntax:

copy file-id
  {config | flash | rcp | tftp}

copy config {file-id | flash | rcp| tftp}
  [all]

copy tftp {file-id | flash | config}

copy rcp {file-id | flash | config}

copy flash {file-id | tftp | rcp | config}

Syntax Description:

file-id

Variable that specifies the file on which to perform the copy action, where file-id is in the format [[m/]device:][filename].

m/ = The module where the Flash device is located (such as the standby supervisor engine, an FDDI module, or an ATM module). Module 1 is assumed if a different module is not specified.

device: = Device where the file is located. Valid Flash devices are bootflash:, slot0:, and slot1:. You can also specify tftp: as the device name. The colon (:) is required after the device name.

filename = Name of the system image or configuration file.

config

Keyword that copies the switch configuration file to the specified file, or that the specified file will be used to configure the switch.

flash

Keyword that copies the file to or from the Flash file system

rcp

Keyword that copies the file to or from an rcp server

tftp

Keyword that copies the file to or from a TFTP server

all

(Optional) Keyword that copies the entire configuration to the specified destination configuration file. If you do not use the all keyword, only nondefault commands are copied to the destination configuration file.

Command Description:

Use the copy command set to upload or download a Flash image or a switch configuration to or from a Flash device, rcp server, or TFTP server.

The Catalyst 4000 family switches support only the bootflash: Flash device.

If you use the flash keyword as the copy source or destination, you are prompted for the Flash device name. If you are copying a software image to multiple intelligent switching modules of the same type, use the flash keyword as the copy destination. The switch automatically determines which modules to copy the image to based on the header in the source image file. If you want to copy a software image to a single intelligent switching module in a switch with multiple modules of the same type, you must specify the destination file-id as m/bootflash: (do not specify a filename).

Examples:

This example shows how to upload the non-default switch configuration to a file named cat.cfg on the slot0: Flash device:

Console> (enable) copy config slot0:cat.cfg

Upload configuration to slot0:cat.cfg
649324 bytes available on device slot0, proceed (y/n) [n]? y

.........
/
Configuration has been copied successfully. (10200 bytes)
Console> (enable)

This example shows how to upload both the default and non-default switch configuration to a file named lab2.cfg on a TFTP server:

Console> (enable) copy config tftp:lab2.cfg all

IP address or name of remote host [172.20.22.7]? y

Upload configuration to imgFile:lab2.cfg (y/n) [n]? y

.........
/
Configuration has been copied successfully. (10299 bytes).
Console> (enable)

This example shows how to upload the non-default switch configuration to the cat.cfg file on the slot1: Flash device:

Console> (enable) copy config flash

Flash device [bootflash]? slot1:

Name of file to copy to [configFile]? cat.cfg

Upload configuration to slot1:cat.cfg
749124 bytes available on device slot1, proceed (y/n) [n]? y

.........
/
Configuration has been copied successfully. (200345 bytes).
Console> (enable)

This example shows how to upload an image from a remote host into Flash using rcp:

Console> (enable) copy rcp flash

IP address or name of remote host []? 172.20.52.3

Name of file to copy from []? cat5000-sup3.4-2-1.bin

Flash device [bootflash]?
Name of file to copy to [cat5000-sup3.4-2-1.bin]?

4369664 bytes available on device bootflash, proceed (y/n) [n]? y

CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
File has been copied successfully.
Console> (enable)

This example shows how to upload the running configuration on a Catalyst 4000 family, Catalyst 2948G, or Catalyst 2980G switch to an rcp server for storage:

Console> (enable) copy config rcp

IP address or name of remote host []? 172.20.52.3

Name of file to copy to []? cat5000_config.cfg

Upload configuration to rcp:cat5000_config.cfg, (y/n) [n]? y

.....
/
Configuration has been copied successfully.
Console> (enable)

This example shows how to configure a switch using a configuration file downloaded from an rcp server:

Console> (enable) copy rcp config

IP address or name of remote host []? 172.20.52.3

Name of file to copy from []? dns-config.cfg

Configure using rcp:dns-config.cfg (y/n) [n]? y

/
Finished network download.  (134 bytes)
>>
>> set ip dns server 172.16.10.70 primary
172.16.10.70 added to DNS server table as primary server.
>> set ip dns server 172.16.10.140
172.16.10.140 added to DNS server table as backup server.
>> set ip dns enable
DNS is enabled
>> set ip dns domain corp.com
Default DNS domain name set to corp.com
Console> (enable)

This example shows how to configure the switch using a configuration file on a Flash device:

Console> (enable) copy flash config

Flash device [bootflash]?
Name of configuration file? test.cfg

Configure using bootflash:test.cfg (y/n) [n]? y

/
Finished download. (10900 bytes)
>> set password $1$FMFQ$HfZR5DUszVHIRhrz4h6V70
Password changed.
>> set enablepass $1$FMFQ$HfZR5DUszVHIRhrz4h6V70
Password changed.
>> set prompt Console>
>> set length 24 default
Screen length set to 24.
>> set logout 20
.....
Console> (enable)

This example shows how to copy a file from a TFTP server to a Flash device:

Console> (enable) copy tftp bootflash:

Address or name of remote host [172.20.22.7]?
Enter source file name [cat4000-sup.4-5-1.bin]?
Enter destination file name [cat4000-sup.4-5-1.bin]?
6942528 bytes available in flash, proceed (y/n) [n]?y

Console> (enable)

Misconceptions:

None

Related Commands:

None


 Command:

session

Mode:

Switch> (enable)

Syntax:

session mod

Syntax Description:

mod

Variable that specifies the number of the module

Command Description:

Use the session command to access the CLI of an intelligent module such as a Catalyst 5000 family RSM, RSFC, or ATM module.

After you enter this command, the system responds with the Enter Password: prompt, if a password is configured on the module.

To end the session with the intelligent module, enter the quit command.

Example:

This example shows how to open a session with an ATM module (module 4):

Console> session 4

Trying ATM-4...
Connected to ATM-4.
Escape character is `^]'.
ATM>
2

Misconceptions:

None

Related Commands:

None


 Command:

set authentication login

Mode:

Switch> (enable)

Syntax:

set authentication login attempt count [console | remote]

set authentication login lockout time [console | remote]

set authentication login {radius | tacacs | kerberos}enable [console | telnet | http | all] [primary]

set authentication login {radius | tacacs | kerberos}disable [console | telnet | http | all]

set authentication login local {enable | disable} [console | telnet | http | all]

Syntax Description:

attempt count

Keyword and variable that specify the number of login attempts.

remote

(Optional) Keyword that specifies the authentication method applies to remote logins such as Telnet, SSH, kerberos, and HTTP.

lockout time

Keyword and variable that specify that the period of time a user is locked out of the switch after unsuccessfully attempting login.

radius

Keyword that specifies RADIUS authentication for normal mode access.

tacacs

Keyword that specifies TACACS+ authentication for normal mode access.

kerberos

Keyword that specifies Kerberos authentication for normal mode access.

enable

Keyword that enables the specified authentication method for normal mode access.

console

(Optional) Keyword that applies the authentication method to console sessions.

telnet

(Optional) Keyword that applies the authentication method to Telnet sessions.

http

(Optional) Keyword that applies the authentication method to HTTP sessions.

all

(Optional) Keyword that applies the authentication method to all sessions.

primary

(Optional) Keyword that specifies that the specified authentication method be tried first.

disable

Keyword that disables the specified authentication method for normal mode access.

local

Keyword that specifies local authentication for normal mode access.

Command Description:

Use the set authentication login command to configure the switch to use TACACS+, Kerberos, RADIUS, or local authentication to authenticate normal (login) mode access on the switch.

Examples:

This command allows you to choose the authentication method for the web interface. If you configure the authentication method for the HTTP session as RADIUS, then the username or password is validated using the RADIUS protocol, and TACACS+ and Kerberos authentication is set to disable for the HTTP sessions. By default, the HTTP login is validated using the local login password.

You can specify the authentication method for console, telnet, http, or all by entering the console, telnet, http, or all keywords. If you do not specify console, telnet, http, or all, the authentication method default is for all sessions.

The maximum number of login attempts from SNMP and the command-line interface (CLI) can be configured. The configurable range is from 0 to 10. To disable login attempts, set the level to 0. Failed login system logs are generated at level 5. If you are attempting access to enable mode, and the password fails more than the number of attempts allowed, the system will disable the execution of the enable command for the lockout time.

The lockout time is configurable from SNMP and the CLI. The configurable range is from 30 to 600 seconds (half a minute to ten minutes). For console login, the console will not allow logging in during that time. For remote logins the connection will be closed when the limit is reached, and any subsequent login attempts from that station will be closed immediately by the switch.

When attempt limit checking is disabled, the lockout restriction is no longer applicable.

This example shows how to set the login attempt to 5 for both console and remote sessions:

Console> (enable) set authentication login attempt 5

Login authentication attempts for console and remote login set to 5.

Console> (enable)

This example shows how to set the login attempt to 7 for remote sessions:

Console> (enable) set authentication login attempt 7 remote

Login authentication attempts for remote login set to 7.

Console> (enable)

This example shows how to set the login attempt to 8 for console sessions:

Console> (enable) set authentication login attempt 8 console

Login authentication attempts for console login set to 8.

Console> (enable)

This example shows how to set the lockout time for both console and remote sessions to 50 seconds:

Console> (enable) set authentication login lockout 50

Login lockout time for console and remote login set to 50 seconds.

Console> (enable)

This example shows how to set the lockout time for console sessions to 5 minutes:

Console> (enable) set authentication login lockout 300 console

Login lockout time for console login set to 5 minutes.

Console> (enable)

This example shows how to set the lockout time for remote sessions to 7 minutes and 10 seconds:

Console> (enable) set authentication login lockout 430 remote

Login lockout time for console and remote login set to 7 minutes and 10 seconds.

Console> (enable)

This example shows how to disable TACACS+ authentication access for Telnet sessions:

Console> (enable) set authentication login tacacs disable telnet

tacacs login authentication set to disable for the telnet sessions.
Console> (enable)

This example shows how to disable RADIUS authentication access for console sessions:

Console> (enable) set authentication login radius disable console

radius login authentication set to disable for the console sessions.
Console> (enable)

This example shows how to disable Kerberos authentication access for Telnet sessions:

Console> (enable) set authentication login kerberos disable telnet

kerberos login authentication set to disable for the telnet sessions.
Console> (enable)

This example shows how to set TACACS+ authentication access as the primary method for HTTP sessions:

Console> (enable) set authentication login tacacs enable http primary

tacacs login authentication set to enable for HTTP sessions as primary authentication
method.
Console> (enable)

Misconceptions:
None

Related Commands:
show authentication


 Command:

set banner motd

Mode:

Switch(enable)#

Syntax:

set banner motd c [text] c

Syntax Description:

c

Variable that specifies the delimiting character used to begin and end the message.

text

(Optional) Variable that specifies the message of the day.

Command Description:

Use the set banner motd command to create a login banner that is displayed when users access the switch.

The banner cannot contain more than 3070 characters, including tabs. Tabs display as eight characters but take only one character of memory.

You can use either the clear banner motd command or the set banner motd command to clear the message-of-the-day banner.

Example:

This example shows how to set the message of the day using the pound sign (#) as the delimiting character:

Console> (enable) set banner motd #

** System upgrade: starting: 6:00am Tuesday.

** Please log out before leaving on Monday. #

MOTD banner set.
Console> (enable>

This example shows how to clear the message of the day using the set banner motd command:

Console> (enable) set banner motd ##

MOTD banner cleared.
Console> (enable>

Misconceptions:
None


 Command:

set cgmp leave

Mode:

Switch> (enable)

Syntax:

set cgmp fastleave {enable | disable}

Syntax Description:

enable

Keyword that enables CGMP leave processing.

disable

Keyword that disables CGMP leave processing.

Command Description:

Use the set cgmp leave command to enable or disable Cisco Group Management Protocol (CGMP) leave processing.

Example:

This example shows how to enable CGMP leave processing:

Console> (enable) set cgmp leave enable

CMGP leave processing enabled.

Console> (enable)

This example shows how to disable CGMP leave processing:

Console> (enable) set cgmp leave disable

CMGP leave processing disabled.

Console> (enable)

Misconceptions:

None

Related Commands:
set cgmp
show cgmp leave
show cgmp statistics
show multicast group


 Command:

set cgmp

Mode:

Switch> (enable)

Syntax:

set cgmp {enable | disable}

Syntax Description:

enable

Keyword that enables CGMP on the switch.

disable

Keyword that disables CGMP on the switch.

Command Description:

Use the set cgmp command to enable or disable Cisco Group Management Protocol (CGMP) on the switch.

CGMP requires that you connect the switch to a router running CGMP.

Example:

This example shows how to enable CGMP on a device:

Console> (enable) set cgmp enable

CMGP support for IP multicast enabled.

Console> (enable)

This example shows how to disable CGMP on a device:

Console> (enable) set cgmp disable

CMGP support for IP multicast disabled.

Console> (enable)

This example shows what happens if you try to enable CGMP if IGMP snooping is already enabled:

Console> (enable) set cgmp enable

Disable IGMP Snooping feature to enable CGMP.
Console> (enable)

Misconceptions:
None

Related Commands:
set cgmp leave
show cgmp leave
show cgmp statistics
show multicast group


 Command:

set enablepass

Mode:

Switch> (enable)

Syntax:

set enablepass

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the set enablepass command to change the privileged (enable) mode password on the switch.

Passwords are case sensitive; they may be 0 to 30 characters in length, including spaces.

The command prompts you for the old password. If the password you enter is valid, you are prompted to enter a new password and to verify the new password.

Example:

This example shows how to establish a new password:

Console> (enable) set enablepass
Enter old password: <old_password>
Enter new password: <new_password>
Retype new password: <new_password>
Password changed.
Console> (enable)

Misconceptions:
None

Related Commands:
enable
set password


 Command:

set interface

Mode:

Switch> (enable)

Syntax:

set interface {sc0 | me1 | sl0} {up | down}

set interface sc0 [vlan] [ip_addr [netmask [broadcast]]]

set interface sc0 [vlan] [ip_addr/netmask[broadcast]]

set interface me1 ip_addr [netmask [broadcast]]

set interface me1 ip_addr/netmask [broadcast]

set interface sl0 slip_addr dest_addr

set interface sc0 dhcp {renew | release}

Syntax Description:

sc0

Keyword that specifies the in-band management interface.

me1

Keyword that specifies the out-of-band management Ethernet interface.

sl0

Keyword that specifies the SLIP interface.

up

Keyword used to bring the interface into operation.

down

Keyword used to bring the interface out of operation.

vlan

(Optional) Variable that specifies the number of the VLAN to be assigned to the interface.

ip_addr

(Optional) Variable that specifies the IP address to assign to the interface.

netmask

(Optional) Variable that specifies the subnet mask or mask bits to assign to the interface.

broadcast

(Optional) Variable that specifies the broadcast address to assign to the interface.

slip_addr

Variable that specifies the SLIP source address of the console port.

dest_addr

Variable that specifies the SLIP destination address of the host to which the console port will be connected.

dhcp

Keyword used to perform DHCP operations on the sc0 interface.

renew

Keyword used to renew the lease on a DHCP-learned IP address.

release

Keyword used to release a DHCP-learned IP address back to the DHCP IP address pool.

Defaults

The default configuration has the IP address, subnet mask, and broadcast address of the in-band management interface (sc0) and out-of-band management Ethernet interface (me1) set to 0.0.0.0, with the sc0 interface in VLAN 1. The default configuration for the SLIP interface (sl0) is that the SLIP source and destination addresses are set to 0.0.0.0.

Command Description:

Use the set interface command to set the network interface configuration and to enable or disable standard SNMP trap operation.

The Catalyst 4000 family switches support three IP management interfaces: sc0, sl0, and an out-of-band management Ethernet interface (me1). The me1 interface is not attached to the switching fabric. If both the sc0 and me1 interfaces are configured, the supervisor engine software determines which interface to use when performing standard transmission and reception of IP packets based on the local routing table. Operations that use this functionality include TFTP, ping, Telnet, and SNMP.

You can enter the netmask value in dotted decimal format or you can specify the number of bits in the netmask (for example, 204.20.22.7/24).

Example:

This example shows how to use set interface sc0 and set interface sl0 from the console port. It also shows how to bring down interface sc0 using a terminal connected to the console port:

Console> (enable) set interface sc0 192.200.11.44 255.255.255.0

Interface sc0 IP address and netmask set.
Console> (enable) set interface sl0 192.200.10.45 192.200.10.103

Interface sl0 SLIP and destination address set.
Console> (enable) set interface sc0 down

Interface sc0 administratively down.
Console> (enable)

This example shows how to set the IP address for sc0. If you do not specify a subnet mask, the default mask for that IP address class is used (for example, 255.255.0.0 for a class B address):

Console> (enable) set interface sc0 172.20.52.123

Interface sc0 IP address and netmask set.
Console> (enable)

This example shows how to set the VLAN, IP address, and subnet mask bits for the sc0 interface:

Console> (enable) set interface sc0 5 172.20.52.123/28

Interface sc0 vlan set, IP address and netmask set.
Console> (enable)

This example shows how to change the VLAN membership of the sc0 interface:

Console> (enable) set interface sc0 2

Interface sc0 vlan set.
Console> (enable)

This example shows how to take the sc0 interface down:

Console> (enable) set interface sc0 down

Interface sc0 administratively down.
Console> (enable)

This example shows how to bring the sc0 interface up:

Console> (enable) set interface sc0 up

Interface sc0 administratively up.
Console> (enable)

This example shows how to set the IP address and netmask for me1:

Console> (enable) set interface me1 10.10.10.20/24
Interface me1 IP address and netmask set.
Console> (enable)

This example shows how to set the SLIP source and destination addresses for the console port on the sl0 interface:

Console> (enable) set interface sl0 10.1.1.1 10.1.1.2

Interface sl0 slip and destination address set.
Console> (enable)

This example shows how to release a DHCP IP address assigned to the sc0 interface:

Console> (enable) set interface sc0 dhcp release

Console> (enable)

This example shows how to renew the lease on a DHCP IP address assigned to the sc0 interface:

Console> (enable) set interface sc0 dhcp release

Console> (enable)

This example shows how to release a DHCP IP address assigned to the sc0 interface and obtain a new IP address from the DHCP server:

Console> (enable) set interface sc0 dhcp release

Console> (enable)

This example shows how to renew the lease on a DHCP-assigned IP address:

Console> (enable) set interface sc0 dhcp renew

Renewing IP address...
Console> (enable) Sending DHCP packet with address:00:90:0c:5a:8f:ff
dhcpoffer
Sending DHCP packet with address:00:90:0c:5a:8f:ff
Timezone set to '', offset from UTC is 7 hours 58 minutes
Timezone set to '', offset from UTC is 7 hours 58 minutes
172.16.30.32 added to DNS server table as primary server.
172.16.31.32 added to DNS server table as backup server.
172.16.32.32 added to DNS server table as backup server.
NTP server 172.16.25.253 added
NTP server 172.16.25.252 added
%MGMT-5-DHCP_S:Assigned IP address 172.20.25.244 from DHCP Server 172.20.25.254
Console> (enable)

This example shows how to release the lease on a DHCP-assigned IP address:

Console> (enable) set interface sc0 dhcp release

Releasing IP address...
Console> (enable) Sending DHCP packet with address:00:90:0c:5a:8f:ff
Done
Console> (enable)

Misconceptions:

On the Catalyst 4000 family switches, when entering the set interface me1 or set interface trap {sc0 | sl0 | me1} command, sc0 and me1 cannot be configured as up when both are in the same subnet or overlapping subnets. If you specify an IP address and subnet for the sc0 or me1 interface that causes an overlap, the me1 interface is kept up or brought up, and the sc0 interface is brought down. The only exception is when both the me1 and sc0 interfaces have IP address 0.0.0.0. In this case, the me1 interface is brought down and the sc0 interface is brought up to allow the DHCP and RARP to run on the sc0 interface.

Related Commands:
show interface (switch)


 Command:

set ip dns domain

Mode:

Switch> (enable)

Syntax:

set ip dns domain name

Syntax Description:

name

Default DNS domain name

Command Description:

Use the set ip dns domain command to set the default DNS domain name.

If you specify a domain name on the command line, the system attempts to resolve the host name as entered. If the system cannot resolve the host name as entered, it appends the default DNS domain name as defined with the set ip dns domain command. If you specify a domain name with a trailing dot, the program considers this an absolute domain name.

Example:

This example shows how to set the default DNS domain name as yow.com:

Switch> (enable) set ip dns domain yow.com

Default DNS domain name set to yow.com.
Switch> (enable)

Misconceptions:
None

Related Commands:
set ip dns server


 Command:

set ip dns server

Mode:

Switch> (enable)

Syntax:

set ip dns server ip_addr [primary]

Syntax Description:

ip_addr

IP address of the DNS server

primary

(Optional) Keyword that specifies to configure a DNS server as the primary server

Command Description:

Use the set ip dns server command to set the IP address of a DNS server.

You can configure up to three DNS name servers as backup. You can also configure any DNS server as the primary server. The primary server is queried first. If the primary server fails, the backup servers are queried.

Example:

These examples show how to set the IP address of a DNS server:

Switch> (enable) set ip dns server 198.92.30.32

198.92.30.32 added to DNS server table as primary server.
Switch> (enable)

Switch> (enable) set ip dns server 171.69.2.132 primary

171.69.2.132 added to DNS server table as primary server.
Switch> (enable)

Switch> (enable) set ip dns server 171.69.2.143 primary

171.69.2.143 added to DNS server table as primary server.
Switch> (enable)

This example shows what happens if you enter more than three DNS name servers as backup:

Switch> (enable) set ip dns server 161.44.128.70

DNS server table is full. 161.44.128.70 not added to DNS server table.
Switch> (enable)

Misconceptions:
None

Related Commands:
set ip dns domain


 Command:

set ip http port

Mode:

Switch> (enable)

Syntax:

set ip http port {port_num} [default port_num]

Syntax Description:

port_num

Variable that specifies the TCP port number. Valid values are from 1 to 65535.

default port_num

(Optional) Keyword and variable that specify the TCP default port number. Valid values are from 80 to 65535.

Command Description:

Use the set ip http port command to configure the TCP port number for the HTTP server.

Examples:

This example shows how to set the IP HTTP port default:

Console> (enable) set ip http port default
HTTP TCP port number is set to 80.
Console> (enable)

This example shows how to set the IP HTTP port number:

Console> (enable) set ip http port 2398
HTTP TCP port number is set to 2398.
Console> (enable)

Misconceptions:
None

Related Commands:
set ip http server


 Command:

set ip http server

Mode:

Switch> (enable)

Syntax:

set ip http server {enable | disable}

Syntax Description:

enable

Keyword that enables the HTTP server.

disable

Keyword that disables the HTTP server.

Command Description:

Use the set ip http server command to enable or disable the HTTP server.

Example:

This example shows how to enable the HTTP server:

Console> (enable) set ip http server enable

HTTP server is enabled.
Console> (enable)

This example shows the system response when the HTTP server enable command is not supported:

Console> (enable) set ip http server enable

Feature not supported.
Console> (enable)

This example shows how to disable the HTTP server:

Console> (enable) set ip http server disable
HTTP server disabled.
Console> (enable)

Misconceptions:
None

Related Commands:
set ip http port


 Command:

set ip route

Mode:

Switch> (enable)

Syntax:

set ip route default gateway [metric] [primary]

set ip route destination[/netmask] gateway

Syntax Description:

default

Keyword that specifies the entry as a default route.

gateway

Variable that specifies the IP address or IP alias of the router.

metric

(Optional) Variable that specifies the value used to indicate the number of hops between the switch and the gateway.

primary

(Optional) Keyword that specifies the primary default route.

destination

Variable that specifies the IP address or IP alias of the network, or IP address, DNS hostname, or IP alias of a specific host to be added.

/netmask

(Optional) Variable that specifies the subnet mask or mask bits to assign to the interface.

Command Description:

Use the set ip route command to add IP addresses or aliases to the IP routing table.

You can configure up to three default gateways. You can specify a primary default gateway using the primary keyword. If a primary is not designated, the first default gateway you configure is the primary.

The switch forwards all off-network IP traffic generated by the switch itself to the primary default gateway unless the primary is unavailable. The entries in the IP routing table are only used for IP traffic generated by the switch itself (for example, Telnet, ping, or TFTP sessions from the switch CLI), not for IP data traveling through the switch.

On the Catalyst 4000 family switches, the supervisor engine software automatically determines whether a default gateway is reached through the sc0 interface or the me1 interface.

You can enter the destination and gateway as either an IP alias or IP address in dotted format (for example, 172.20.52.7). You can enter the destination network mask in dotted decimal format or you can specify the number of bits in the netmask (for example, 204.20.22.7/24). CIDR IP address and subnet mask values are accepted for the destination network address.

Examples:

This example shows how to add three default routes to the IP routing table:

Console> (enable) set ip route default 172.20.52.35

Route added.
Console> (enable) set ip route default 172.20.52.40

Route added.
Console> (enable) set ip route default 172.20.52.45

Route added.
Console> (enable)

This example shows how to add a route to network 10.10.0.0/16 through gateway 172.20.52.33:

Console> (enable) set ip route 10.10.0.0/16 172.20.52.33

Route added.
Console> (enable)

This example shows how to add a route to a specific host:

Console> (enable) set ip route 172.20.50.2/32 172.20.52.41

Route added.
Console> (enable)

Misconceptions:
None

Related Commands:
None


 Command:

set logout

Mode:

Switch> (enable)

Syntax:

set logout timeout

Syntax Description:

timeout

Variable that specifies the number of minutes until the system disconnects an idle session automatically. Valid values are from 0 to 10000. Setting the value to 0 disables the automatic disconnection of idle sessions.

Command Description:

Use the set logout command to specify the number of minutes the system waits before automatically disconnecting an idle session. The default value is 20 minutes.

Example:

This example shows how to set the number of minutes until the system disconnects an idle session automatically:

Console> (enable) set logout 20

Sessions will be automatically logged out after 20 minutes of idle time.
Console> (enable)

This example shows how to disable the automatic disconnection of idle sessions:

Console> (enable) set logout 0

Sessions will not be automatically logged out.
Console> (enable)

Misconceptions:
None

Related Commands:

None


 Command:

set mls agingtime fast

Mode:

Switch> (enable)

Syntax:

set mls agingtime fast [fastagingtime] [pkt_threshold]

Syntax Description:

fastagingtime

(Optional) Valid values are: 32, 64, 96 or 128 seconds. A "0" entry disables fast aging. If a value is not specified, the default value is used.

pkt_threshold

(Optional) Valid values: 0, 1, 3, 7, 15, 31, and 63 packets. A "0" entry disables fast aging. If a value is not specified, the default value is used.

Command Description:

Use the set mls agingtime fast command to specify the MLS aging time of shortcuts to an MLS entry that has no more than pkt_threshold packets switched within fastagingtime seconds after it is created.

If you enter any of the set mls agingtime fast commands on a Catalyst 5000 series switch without MLS, the following warning message displays:

mls not supported on feature card.

If fastagingtime is not configured exactly the same as the valid values, it is adjusted to the closest one. A typical value for fastagingtime and pkt_threshold is 32 seconds and 0 packet, respectively (it means no packet is switched within 32 seconds after the entry is created).

Agingtime applies to an MLS entry that has no more than <pkt_threshold> packets switched within <fastagingtime> seconds after it is created. A typical example is the MLS entry destined to/sourced from a DNS or TFTP server. This entry may never be used again after it is created. For example, only one request goes to a server and one reply returns from the server, and then the connection is closed.

The agingtime fast option is used to purge entries associated with very short flows, such as DNS and TFTP.

We recommend that you keep the number of MLS entries in the MLS cache below 32K. If the number of MLS entries is more than 32K, some flows (less than 1 percent) are sent to the router.

To keep the number of MLS cache entries below 32K, enable agingtime fast. Initially set it at 128 seconds. If the number of cache entries continues to exceed 32K, decrease the setting; start with 96, then 64, and 32 as necessary.

If cache entries continue to exceed 32K, decrease the normal agingtime in increments of 64 seconds from the 256-second default.

Example:

This example shows how to use the set mls agingtime fast command to set the agingtime:

console>(enable) set mls agingtime fast 32 0

MLS fast aging time set to 32 seconds for entries with no more than 0 packet switched.
Console> (enable)

Misconceptions:
None

Related Commands:
show mls


 Command:

set mls

Mode:

Switch> (enable)

Syntax:

set mls agingtime [agingtime]
set mls disable
set mls enable
set mls include {ip_addr}

Syntax Description:

agingtime

Keyword used to specify the aging time (in seconds) for an MLS entry.

agingtime

(Optional) MLS aging time of shortcuts to an MLS entry.

disable

Keyword used to disable IP shortcut functions on the Catalyst 5000 series switch, disable any NFCP message processing, delete any existing shortcut entries, and prevent new shortcut entries from being established.

enable

Keyword used to enable IP shortcut functions on the switch, enable NFCP message processing, and allow new shortcut entries to be established.

include

Keyword used to include the specified router(s) to participate in MLS.

ip_addr

Router IP address, or name of the router if DNS is enabled.

Command Description:

Use the set mls command set to configure the MLS feature in the Catalyst 5000 series switch.

If you enter any of the set mls commands on a Catalyst 5000 series switch without MLS, the following warning message displays:

MLS not supported on feature card.

The set mls disable command disables IP shortcut functions on the Catalyst 5000 series switch, does not process any NFCP messages, deletes any existing shortcut entries, and prevents new ones from being established.

The set mls enable command enables the IP shortcut function on this device, processes NFCP messages, and starts establishing shortcuts for IP data packets.

The Catalyst 5000 series switch does not process NFCP messages from routers that are not configured to participate in MLS. You must use the set mls include command to configure a router to participate in MLS. You can specify multiple router entries on the same command line. The included router entries are saved in NVRAM and retained across a power cycle.

You must enable DNS to resolve the router's IP address.

Example:

These examples show how to use the set mls command set to configure MLS:

console>(enable) set mls agingtime 512

MLS aging time set to 512 seconds.
Console> (enable)

console>(enable) set mls agingtime fast 32 0

MLS fast aging time set to 32 seconds for entries with no more than 0 packet switched.
Console> (enable)

Console> (enable) set mls disable

Multilayer switching disabled
Console> (enable)

Console> (enable) set mls enable
Multilayer switching enabled
Console> (enable)

Console> (enable) set mls include 170.170.2.1

Multilayer switching enabled for router 170.170.2.1
Console> (enable)

Console> (enable) set mls include Stargate

Multilayer switching enabled for router 172.20.15.1 (Stargate)
Console> (enable)

Misconceptions:

None

Related Commands:
clear mls
show mls


 Command:

set password

Mode:

Switch> (enable)

Syntax:

set password

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the set password command to change the normal (login) mode password on the switch.

Passwords are case sensitive; they may be 0 to 30 characters in length, including spaces.

The command prompts you for the old password. If the password you enter is valid, you are prompted to enter a new password and to verify the new password. A zero-length password is allowed by pressing Return.

Example:

This example shows how to set the normal (login) mode password:

Console> (enable) set password
Enter old password: <old_password>
Enter new password: <new_password>
Retype new password: <new_password>
Password changed.
Console> (enable)

Misconceptions:
None

Related Commands:
set enablepass


 Command:

set port channel

Mode:

Switch> (enable)

Syntax:

set port channel mod/port [admin_group]

set port channel mod/port mode {on | off | desirable | auto} [silent | non-silent]

set port channel all mode off

set port channel all distribution {ip | mac} [source | destination | both]

set port channel all distribution {session} [source | destination | both]

Syntax Description:

mod/port

Variable that specifies the number of the module and the port on the module.

admin_group

(Optional) Variable that specifies the number of administrative group. Valid values are from 1 to 1024.

mode

Keyword that specifies the EtherChannel mode.

on

Keyword to enable and force specified ports to channel without PAgP.

off

Keyword to prevent ports from channeling.

desirable

Keyword to set a PAgP mode that places a port into an active negotiating state, in which the port initiates negotiations with other ports by sending PAgP packets.

auto

Keyword to set a PAgP mode that places a port into a passive negotiating state, in which the port responds to PAgP packets it receives, but does not initiate PAgP packet negotiation.

silent

(Optional) Keyword to use with auto or desirable when no traffic is expected from the other device to prevent the link from being reported to STP as down.

non-silent

(Optional) Keyword to use with auto or desirable when traffic is expected from the other device.

all mode off

Keywords to globally turn off channeling on all ports.

all distribution

Keywords to apply frame distribution to all ports in the switch.

ip

Keyword that specifies the frame distribution method using IP address values.

mac

Keyword that specifies the frame distribution method using MAC address values.

source

(Optional) Keyword that specifies the frame distribution method using source address values.

destination

(Optional) Keyword that specifies the frame distribution method using destination address values.

both

(Optional) Keyword that specifies the frame distribution method using source and destination address values.

session

Keyword to allow frame distribution of Layer 4 traffic.

both

(Optional) Keyword that specifies the frame distribution method using source and destination Layer 4 port number.

Command Description:

Use the set port channel command set to configure EtherChannel on Ethernet module ports.

Make sure that all ports you intend to channel are configured properly. For complete information on EtherChannel configuration restrictions, refer to the Software Configuration Guide-Catalyst 4000 Family, Catalyst 2948G, and Catalyst 2980G Switches.

Because of the port ID handling by the spanning tree feature, the maximum supported number of channels is 126 for a 6-slot chassis.

Administrative groups specify which ports can form an EtherChannel together. An administrative group can contain a maximum of eight ports. However, administrative group membership is restricted by hardware capabilities. Use the show port capabilities command to determine which ports can form a channel together.

On the Catalyst 4000 family switches, an EtherChannel bundle can consist of any two to eight ports. Ports in an EtherChannel do not have to be contiguous, nor do they have to be on the same module. With the on mode, a usable EtherChannel exists only when a port group in on mode is connected to another port group in on mode.

If you are running QoS, make sure that bundled ports are all of the same trust types and have similar queueing and drop capabilities.

Disable the port security feature on the channeled ports (see the set port security command). If you enable port security for a channeled port, the port shuts down when it receives packets with source addresses that do not match the secure address of the port.

You can configure up to eight ports on the same switch in each administrative group.

When you assign ports to an existing admin group, the original ports associated with the admin group will move to an automatically picked new admin group. You cannot add ports to the same admin group.

If you do not enter an admin_group, it means that you want to create a new administrative group with admin_group selected automatically. The next available admin_group is automatically selected. If you do not enter the channel mode, the channel mode of the ports addressed are not modified.

The silent | non-silent parameters only apply if desirable or auto modes are entered.

If you do not specify silent or non-silent, the current setting is not affected.

To support jumbo frames, channeling ports need to have the same jumbo frame setting on each port.

This command is not supported by non-EtherChannel-capable modules.

Example:

This example shows how to create an EtherChannel on ports 5 and 6 of module 4:

Console> (enable) set port channel 4/5-6 on

Port(s) 4/5-6 are assigned to admin group 56.
Port(s) 4/5-6 channel mode set to on.
Console> (enable)

This example shows how to remove an EtherChannel on ports 5 and 6 of module 4:

Console> (enable) set port channel 4/5-6 mode auto
Port(s) 4/5-6 channel mode set to auto.
Console> (enable) show port channel

This example shows the display when the port list is exceeded:

Console> (enable) set port channel 2/1-9 1
No more than 8 ports can be assigned to an admin group.
Console> (enable)

This example shows how to disable EtherChannel on module 4, ports 4 to 6:

Console> (enable) set port channel 4/4-6 mode off

Port(s) 4/4-6 channel mode set to off.

Console> (enable)

This example shows the display output when you assign ports to an existing admin group. This example moves ports in admin group 96 to another admin group and assigns module 4, ports 4 to 6 to admin group 96:

Console> (enable) set port channel 4/4-6 96

Port(s) 4/1-3 are moved to admin group 97.

Port(s) 4/4-6 are assigned to admin group 96.

Console> (enable)

This example shows how to set the channel mode to off for module 4, ports 4 to 6 and assign those ports to an automatically selected admin group:

Console> (enable) set port channel 4/4-6 off

Port(s) 4/4-6 channel mode set to off.

Port(s) 4/4-6 are assigned to admin group 23.

Console> (enable)

This example shows how to configure the EtherChannel load-balancing feature:

Console> (enable) set port channel all distribution ip destination

Channel distribution is set to ip destination.

Console> (enable)

Misconceptions:
None

Related Commands:
None


 Command:

set port duplex

Mode:

Switch> (enable)

Syntax:

set port duplex mod_num/port_num {full | half}

Syntax Description:

mod_num

Variable that specifies the number of the module.

port_num

Variable that specifies the number of the port.

full

Keyword that specifies full-duplex transmission.

half

Keyword that specifies half-duplex transmission.

Command Description:

Use the set port duplex command to configure the duplex type of an Ethernet or Fast Ethernet port or range of ports.

You can configure Ethernet and Fast Ethernet interfaces to either full duplex or half duplex.

The set port duplex command is not supported on Token Ring ports.

You cannot configure the duplex mode on Gigabit Ethernet ports (they are always in full-duplex mode).

Example:

This example shows how to set port 1 on module 2 to full duplex:

Console> (enable) set port duplex 2/1 full
Port 2/1 set to full-duplex.
Console> (enable)

This example shows how to set port 1 on module 2 to half duplex:

Console> (enable) set port duplex 2/1 half
Port 2/1 set to half-duplex.
Console> (enable)

Misconceptions:
None

Related Commands:
set port speed
set port membership


 Command:

set port enable

Mode:

Switch> (enable)

Syntax:

set port enable mod_num/port_num

Syntax Description:

mod_num

Variable that specifies the number of the module.

port_num

Variable that specifies the number of the port.

Command Description:

Use the set port enable command to enable a port or a range of ports.

Example:

This example shows how to enable port 3 on module 2:

Console> (enable) set port enable 2/3

Port 2/3 enabled.
Console> (enable)

Misconceptions:
None

Related Commands:
None


 Command:

set port membership

Mode:

Switch> (enable)

Syntax:

set port membership mod_num/port_num {dynamic | static}

Syntax Description:

mod_num

Variable that specifies the module number.

port_num

Variable that specifies the port number.

dynamic

Keyword that specifies to configure the port for dynamic VLAN membership.

static

Keyword that specifies to configure the port for static VLAN membership.

Command Description:

Use the set port membership command to configure ports for dynamic or static VLAN membership.

Ports configured for dynamic VLAN membership obtain their VLAN assignment through VMPS. Ports configured for static VLAN membership obtain their VLAN assignment through the set vlan command.

When a port is assigned a VLAN dynamically, the show port command output identifies the VLAN as dynamic. If the dynamic port is shut down by a VMPS, its status is shown as shutdown.

This command is not supported by the Access Gateway module.

Dynamic VLAN support for VVID includes these restrictions to the following configuration of MVAP on the switch port:

  • You can configure any VVID on a dynamic port including dot1p and untagged, except when the VVID is equal to dot1p or untagged. If this case, then you must configure VMPS with the MAC address of the IP phone. When you configure the VVID as dot1p or untagged on a dynamic port, this warning message displays:
    VMPS should be configured with the IP phone mac's.

  • You cannot change the VVID of the port equal to PVID assigned by the VMPS for the dynamic port.
  • You cannot configure trunk ports as dynamic ports, but an MVAP can be configured as a dynamic port.

Example:

This example shows how to set the port membership VLAN assignment to dynamic on module 3, ports 1 to 3:

Console> (enable) set port membership 3/1-3 dynamic

Ports 3/1-3 vlan assignment set to dynamic.
Spantree port fast start option enabled for ports 3/1-3.
Console> (enable)

This example shows how to configure a port for static VLAN membership on module 3, ports 1 to 3:

Console> (enable) set port membership 3/1-3 static

Ports 3/1-3 vlan assignment set to static.
Console> (enable)

Misconceptions:
None

Related Commands:
set port enable
show port


 Command:

set port name

Mode:

Switch> (enable)

Syntax:

set port name mod_num/port_num [port_name]

Syntax Description:

mod_num

Variable that specifies the number of the module.

port_num

Variable that specifies the number of the port.

port_name

(Optional) Variable that specifies the name of the port.

Command Description:

Use the set port name command to configure a name for a port.

If you do not specify the name string, the port name is cleared.

Example:

This example shows how to set port 1 on module 4 to Snowy:

Console> (enable) set port name 4/1 Snowy
Port 4/1 name set.
Console> (enable)

Misconceptions:
None


 Command:

set port security

Mode:

Switch> (enable)

Syntax:

set port security mod/port... [enable | disable] [mac_addr] [age {age_time}]
[maximum {num_ of_mac}] [shutdown {shutdown_time}][violation {shutdown | restrict}]

Syntax Description:

mod/port...

Variable that specifies the number of the module and the port on the module.

enable

(Optional) Keyword used to enable port security.

disable

(Optional) Keyword used to disable port security.

mac_addr

(Optional) Secure MAC address of the enabled port.

age age_time

(Optional) Keyword and variable that specify the duration for which addresses on the port will be secured; valid values are 0 (to disable) and from 1 to 1440 (minutes).

maximum num_of_mac

(Optional) Keyword and variable that specify the maximum number of MAC addresses to secure on the port; valid values are from
1 to 1025.

shutdown shutdown_time

(Optional) Keyword and variable that specify the duration for which a port will remain disabled in case of a security violation; valid values are 0 (to disable) and from 1 to 1440 (minutes).

violation

(Optional) Keyword that specifies the action to be taken in the event of a security violation.

shutdown

Keyword to shut down the port in the event of a security violation.

restrict

Keyword to restrict packets from unsecure hosts.

Command Description:

Use the set port security command set to configure port security on a port or range of ports.

If you enter the set port security enable command but do not specify a MAC address, the first MAC address seen on the port becomes the secure MAC address.

You can specify the number of MAC addresses to secure on a port. You can add MAC addresses to this list of secure addresses. The maximum number is 1024.

The s et port security violation command allows you to specify whether you want the port to shut down or to restrict access to insecure MAC addresses only. The shutdown time allows you to specify the duration of shutdown in the event of a security violation.

We recommend that you configure the age timer and the shutdown timer if you want to move a host from one port to another when port security is enabled on those ports. If the age_time value is less than or equal to the shutdown_time value, the moved host will function again in an amount of time equal to the shutdown_time value. The age timer begins upon learning the first MAC address, and the disable timer begins when there is a security violation.

Example:

This example shows how to set port security with a learned MAC address:

Console> (enable) set port security 3/1 enable

Port 3/1 port security enabled with the learned mac address.

Console> (enable)

This example shows how to set port security with a specific MAC address:

Console> (enable) set port security 3/1 enable 01-02-03-04-05-06

Port 3/1 port security enabled with 01-02-03-04-05-06 as the secure mac address.

Console> (enable)

This example sets the shutdown time to 600 minutes on port 7/7:

Console> (enable) set port security 7/7 shutdown 600
Secure address shutdown time set to 600 minutes for port 7/7.
Console> (enable)

This example sets the port to drop all packets that are coming in on the port from insecure hosts:

Console> (enable) set port security 7/7 violation restrict
Port security violation on port 7/7 will cause insecure packets to be dropped.
Console> (enable)

Misconceptions:

This command is not supported by the NAM.


Command:

set port speed

Mode:

Switch> (enable)

Syntax:

set port speed mod_num port_num {10 | 100 | 1000 | auto}

Syntax Description:

mod_num

Variable that specifies the number of the module.

port_num

Variable that specifies the number of the port on the module.

10

Keyword that specifies a transmission rate of 10 Mbps on 10/100 Fast Ethernet ports.

100

Keyword that specifies a transmission rate of 100 Mbps on 10/100 Fast Ethernet ports.

1000

Keyword that specifies a transmission rate of 1000 Mbps on a 1000BASE-T port.

auto

Keyword that specifies autonegotiation for transmission speed and duplex mode on 10/100 Fast Ethernet ports. On 1000BASE-T Gigabit Ethernet ports, this keyword specifies that autonegotiation determines the master and slave links.

Command Description:

Use the set port speed command to configure transmission speed or autonegotiation. In the default mode, autonegotiation manages the transmission speed, duplex mode, master link, and slave link. On 1000BASE-T Gigabit Ethernet ports, autonegotiation determines which side of the link is master and which side is slave.

You can configure Ethernet interfaces on the 10/100-Mbps Ethernet switching modules to either 10 Mbps or 100 Mbps, or to autosensing mode, allowing them to sense and distinguish between 10-Mbps and 100-Mbps port transmission speeds and full-duplex or half-duplex port transmission types at a remote port connection. If you set the interfaces to autosensing mode, they automatically configure themselves to operate at the proper speed and transmission type.

If you change the transmission speed of a port that is open to 4 Mbps or 16 Mbps, the port will close and reopen at the new transmission speed. If a port closes and reopens on an existing ring using a transmission speed different from that which the ring is operating, the ring will beacon.

If you set the port speed to auto, duplex mode is automatically set to auto.

Example:

This example shows how to configure port 1 on module 2 to auto:

Console> (enable) set port speed 2/1 auto

Port 2/1 speed set to auto-sensing mode.

Console> (enable)

This example shows how to configure port 2 on module 2 setting port speed to 10 Mbps:

Console> (enable) set port speed 2/2 10

Port 2/2 speed set to 10 Mbps.

Console> (enable)

This example shows how to configure port 4 on module 3 setting port speed to 16 Mbps:

Console> (enable) set port speed 3/4 16

Port(s) 3/4 speed set to 16Mbps.

Console> (enable)

Misconceptions:

None

Related Commands:

set port duplex


 Command:

set prompt

Mode:

Switch> (enable)

Syntax:

set prompt prompt_string

Syntax Description:

prompt_string

String to use as the command prompt.

Command Description:

Use the set prompt command to change the prompt for the CLI.

If you use the set system name command to assign a name to the switch, the switch name is used as the prompt string. However, if you specify a different prompt string later, using the set prompt command, that new string is used as the prompt.

Example:

This example shows how to set the prompt to system100>:

Console> (enable) set prompt system100>

system100> (enable)

Misconceptions:
None

Related Commands:
set system name


 Command:

set spantree backbonefast

Mode:

Switch> (enable)

Syntax:

set spantree backbonefast {enable | disable}

Syntax Description:

enable

Keyword that enables Backbone Fast Convergence.

disable

Keyword that disables Backbone Fast Convergence.

Command Description:

Use the set spantree backbonefast command to enable or disable the spanning tree Backbone Fast Convergence feature.

Example:

This example shows how to enable Backbone Fast Convergence:

Console> (enable) set spantree backbonefast enable

Backbonefast enabled for all VLANs.
Console> (enable)

Misconceptions:

This command is not supported by the NAM.

This command is not available in MISTP mode.

This command is not available in MST mode.

For BackboneFast Convergence to work, you must enable it on all switches in the network.

When you try to enable BackboneFast and the switch is in MISTP or MISTP-PVST+ mode, this message is displayed:

Cannot enable backbonefast when the spantree mode is MISTP-PVST+.

Related Commands:
show spantree
show spantree backbonefast


 Command:

set spantree disable

Mode:

Switch> (enable)

Syntax:

set spantree disable vlan

set spantree disable all

set spantree disable mistp-instance instance

set spantree disable mistp-instance all

Syntax Description:

vlan

Variable that specifies the number of the VLAN; valid values are from 1 to 1005 and from 1025 to 4094.

all

Keyword that specifies all VLANs.

mistp-instance instance

Keyword and variable that specify the instance number; valid values are from 1 to 16.

mistp-instance all

Keywords that delete all instances.

Command Description:

Use the set spantree disable command set to disable the spanning tree algorithm for all VLANs or a specific VLAN or disable spanning tree instance.

Example:

This example shows how to disable the spanning tree for VLAN 1:

Console> (enable) set spantree disable 1

VLAN 1 bridge spanning tree disabled.
Console> (enable)

This example shows how to disable spanning tree for a specific instance:

Console> (enable) set spantree disable mistp-instance 2

MI-STP instance 2 disabled.
Console> (enable)

Misconceptions:

This command is not supported by the NAM.

If you do not specify a VLAN number or an instance number, 1 is assumed.

When an instance is enabled, the Spanning Tree Protocol starts running on that instance.

When an instance is disabled, the switch stops sending out config TLVs for that instance and starts flooding incoming TLVs for the same instance (but checks the VLAN mapping on the incoming side). All the traffic running on the VLANs mapped to the instance is flooded as well.

This command is not available in MST mode.

Related Commands:
set spantree enable
show spantree


 Command:

set spantree enable

Mode:

Switch> (enable)

Syntax:

set spantree enable vlans

set spantree enable all

set spantree enable mistp-instance instance

set spantree enable mistp-instance all

Syntax Description:

vlans

Variable that specifies the number of the VLAN; valid values are from 1 to 1005 and from 1025 to 4094.

all

Keyword that specifies all VLANs.

mistp-instance instance

Keyword and variable that specify the instance number; valid values are from 1 to 16.

mistp-instance all

Keywords that enable all instances.

Command Description:

Use the set spantree enable command set to enable the spanning tree algorithm for all VLANs, a specific VLAN, a specific instance, or all instances.

Example:

This example shows how to activate spanning tree for VLAN 1:

Console> (enable) set spantree enable 1

VLAN 1 bridge spanning tree enabled.
Console> (enable)

This example shows how to activate spanning tree for an instance:

Console> (enable) set spantree enable mistp-instance 1

-STP instance 1 enabled.
Console> (enable)

Misconceptions:

This command is not supported by the NAM.

MISTP and VTP pruning cannot be enabled at the same time.

If you do not specify a VLAN number or an instance number, 1 is assumed.

This command is not available in MST mode.

Related Commands:

set spantree disable
show spantree


 Command:

set spantree fwddelay

Mode:

Switch> (enable)

Syntax:

set spantree fwddelay delay [vlans]

set spantree fwddelay delay mistp-instance [instances]

set spantree fwddelay delay mst

Syntax Description:

delay

Variable that specifies the number of seconds for the bridge forward delay; valid values are from 4 to 30 seconds.

vlans

(Optional) Variable that specifies the number of the VLAN; valid values are from 1 to 1005 and from 1025 to 4094.

mistp-instance [instances]

Keyword and optional variable that specify the instance number; valid values are from 1 to 16.

mst

Keyword that sets the forward delay time for the IST instance and all MST instances. See the "Usage Guidelines" section for more information.

Command Description:

Use the set spantree fwddelay command to set the bridge forward delay for a VLAN or an instance.

Example:

This example shows how to set the bridge forward delay for VLAN 100 to 16 seconds:

Console> (enable) set spantree fwddelay 16 100

Spantree 100 forward delay set to 16 seconds.
Console> (enable)

This example shows how to set the bridge forward delay for an instance to 16 seconds:

Console> (enable) set spantree fwddelay 16 mistp-instance 1

Instance 1 forward delay set to 16 seconds.
Console> (enable)

Misconceptions:

If you do not specify a VLAN number or an instance number, 1 is assumed.

This command is not supported by the NAM.

If you enable MISTP, you cannot set the VLAN bridge forward delay.

If you enable PVST+, you cannot set the instance bridge forward delay.

If you enter the set spantree fwddelay delay mst command, you set the forward delay time for the IST instance and all MST instances. You do not need to set the forward delay time for each MST instance.

Related Commands:

show spantree


 Command:

set spantree hello

Mode:

Switch> (enable)

Syntax:

set spantree hello interval [vlans]

set spantree hello interval mistp-instance instances

set spantree hello interval mst

Syntax Description:

interval

Variable that specifies the number of seconds the system waits before sending a bridge hello message (a multicast message indicating that the system is active). Valid values are from 1 to 10 seconds.

vlans

(Optional) Variable that specifies the number of the VLAN; valid values are from 1 to 1005 and from 1025 to 4094.

mistp-instance instances

Keyword and variable that specify the instance number; valid values are from1 to 16.

mst

Keyword that sets the hello time for the IST instance and all MST instances. See the "Usage Guidelines" section for more information.

Command Description:

Use the set spantree hello command to set the bridge hello time for a VLAN or an instance.

Example:

This example shows how to set the spantree hello time for VLAN 100 to 3 seconds:

Console> (enable) set spantree hello 3 100
Spantree 100 hello time set to 3 seconds.
Console> (enable)

This example shows how to set the spantree hello time for an instance to 3 seconds:

Console> (enable) set spantree hello 3 mistp-instance 1

Spantree 1 hello time set to 3 seconds.
Console> (enable)

Misconceptions:

If you do not specify a VLAN number or an instance number, 1 is assumed.

This command is not supported by the NAM.

If you enable MISTP, you cannot set the VLAN hello time.

If you enable PVST+, you cannot set the instance hello time.

If you enter the set spantree hello interval mst command, you set the hello time for the IST instance and all MST instances. You do not need to set the hello time for each MST instance.

Related Commands:

show spantree


 Command:

set spantree maxage

Mode:

Switch> (enable)

Syntax:

set spantree maxage agingtime [vlans]

set spantree maxage agingtime mistp-instance instances

set spantree maxage agingtime mst

Syntax Description:

agingtime

Variable that specifies the maximum number of seconds that the system retains the information received from other bridges through Spanning Tree Protocol. Valid values are from 6 to 40 seconds.

vlan

(Optional) Variable that specifies the number of the VLAN; valid values are from 1 to 1005.

mistp-instance instances

Keyword and variable that specify the instance number; valid values are from 1 to 16.

mst

Keyword that sets the maximum aging time for the IST instance and all MST instances. See the "Usage Guidelines" section for more information.

Command Description:

Use the set spantree maxage command to set the bridge maximum aging time for a VLAN or an instance.

Example:

This example shows how to set the maximum aging time for VLAN 1000 to 25 seconds:

Console> (enable) set spantree maxage 25 1000

Spantree 1000 max aging time set to 25 seconds.
Console> (enable)

This example shows how to set the maximum aging time for an instance to 25 seconds:

Console> (enable) set spantree maxage 25 mistp-instance 1

Instance 1 max aging time set to 25 seconds.
Console> (enable)

Misconceptions:

If you do not specify a VLAN number or an instance number, 1 is assumed.

This command is not supported by the NAM.

If you enable MISTP, you cannot set the VLAN maximum aging time.

If you enable PVST+, you cannot set the instance maximum aging time.

If you enter the set spantree maxage agingtime mst command, you set the maximum aging time for the IST instance and all MST instances. You do not need to set the maximum aging time for each MST instance.

Related Commands:

show spantree


 Command:

set spantree portcost

Mode:

Switch> (enable)

Syntax:

set spantree portcost mod/port cost [mst]

Syntax Description:

mod/port

Variable that specifies the number of the module and the port on the module.

cost

Variable that specifies the number of the path cost; see the "Usage Guidelines" section for more information.

mst

(Optional) Keyword that sets the path cost for an MST port.

Default Port Cost—Short Mode
Port Speed Default Port Cost

4 Mb

250

10 Mb

100

16 Mb

62

100 Mb

19

155 Mb

14

1 Gb

4

10 Gb

2

Default Port Cost—Long Mode
Port Speed Default Port Cost

100 Kb

200,000,000

1 Mb

20,000,000

10 Mb

2,000,000

10 Mb

200,000

1 Gb

20,000

10 Gb

2,000

100 Gb

200

1 Tb

20

10 Tb

2

Command Description:

Use the set spantree portcost command to set the path cost for a port.

If the spanning tree mode is short and long or MISTP, valid cost values are from 1 to 65535, otherwise, valid cost values are from 1 to 2,000,000.

This command is not supported by the NAM.

The Spanning Tree Protocol uses port path costs to determine which port to select as a forwarding port. You should assign lower numbers to ports attached to faster media (such as full duplex) and higher numbers to ports attached to slower media.

Example:

This example shows how to set the port cost for port 12 on module 2 to 19:

Console> (enable) set spantree portcost 2/12 19

Spantree port 2/12 path cost set to 19.
Console> (enable)

Misconceptions:
None

Related Commands:
show spantree


 Command:

set spantree portfast

Mode:

Switch> (enable)

Syntax:

set spantree portfast mod/port {enable [trunk] | disable | default}

Syntax Description:

mod/port

Variable that specifies the number of the module and the port on the module.

enable

Keyword that enables the spanning tree PortFast-start feature on the port.

trunk

(Optional) Keyword that enables the spanning tree PortFast start feature on the port.

disable

Keyword that disables the spanning tree PortFast-start feature on the port.

default

Keyword that sets the spanning tree start feature back to its default setting.

Command Description:

Use the set spantree portfast command to allow a port that is connected to a single workstation or PC to start faster when it is connected.

When a port configured with the spantree portfast enable command is connected, the port immediately enters the spanning tree forwarding state instead of going through the normal spanning tree states such as listening and learning.

If the trunk keyword is used, the spanning tree PortFast-start feature is enabled on the specified trunk.

Example:

This example shows how to enable the spanning tree PortFast-start feature on port 2 on module 1:

Console> (enable) set spantree portfast 1/2 enable

Warning: Connecting layer 2 devices to a fast-start port can cause temporary spanning tree
loops. Use with caution.
Spantree port 1/2 fast start enabled.
Console> (enable)

This example shows how to enable the spanning tree PortFast-start feature on the trunk port:

Console> (enable) set spantree portfast 3/2 enable trunk
 Warning: Connecting layer 2 devices to a fast-start port can cause temporary spanning
tree loops. Use with caution.
Spantree port 1/2 fast start enabled.
Console> (enable)

Misconceptions:
None

Related Commands:

show spantree


 Command:

set spantree portpri

Mode:

Switch> (enable)

Syntax:

set spantree portpri mod/port priority [mst]

Syntax Description:

mod/port

Variable that specifies the number of the module and the port on the module.

priority

Variable that specifies the number that represents the cost of a link in a spanning tree bridge; valid values are from 0 (high priority) to 63 (low priority).

mst

(Optional) Keyword that sets the bridge priority for an MST port.

Command Description:

Use the set spantree portpri command to set the bridge priority for a spanning tree port.

Example:

This example shows how to set the priority of port 1 on module 4 to 63:

Console> (enable) set spantree portpri 4/1 63

Bridge port 4/1 priority set to 63.
Console> (enable)

Misconceptions:

This command is not supported by the NAM.

Related Commands:
show spantree


 Command:

set spantree portvlancost

Mode:

Switch> (enable)

Syntax:

set spantree portvlancost mod_num/port_num [cost cost_value] [preferred_vlans]

Syntax Description:

mod_num

Variable that specifies the number of the module.

port_num

Variable that specifies the number of the port.

cost cost_value

(Optional) Keyword that indicates the path cost. The port VLAN cost applies only to trunk ports; valid values are from 1 to 65535.

preferred_vlans

(Optional) Variable that specifies the preferred VLANs. If you do not list a specific VLAN, the VLANs that were listed in prior use of this command are affected. If you do not list a specific cost, and previous cost values are specified in prior use of the command, then the port VLAN cost is set to one less than the current port cost for a port. However, this might not ensure load balancing in all cases; valid values are from 1 to 1005.

Command Description:

Use the set spantree portvlancost command to assign a lower path cost to a set of VLANs on a port.

Example:

These examples show various ways to use the set spantree portvlancost command:

Console> (enable) set spantree portvlancost 2/10 cost 25 1-20

Cannot set portvlancost to a higher value than the port cost, 10, for port 2/10.
Console> (enable)

Console> (enable) set spantree portvlancost 2/10 1-20

Port 2/10 VLANs 1-20 have a path cost of 9.
Console> (enable)

Console> (enable) set spantree portvlancost 2/10 cost 4 1-20
Port 2/10 VLANs 1-20 have path cost 4.
Port 2/10 VLANs 21-1000 have path cost 10.
Console> (enable)
Console> (enable) set spantree portvlancost 2/10 cost 6 21

Port 2/10 VLANs 1-21 have path cost 6.
Port 2/10 VLANs 22-1000 have path cost 10.
Console> (enable)

These examples show how to use the set spantree portvlancost command without explicitly

specifying cost:

Console> (enable) set spantree portvlancost 1/2

Port 1/2 VLANs 1-1005 have path cost 3100.
Console> (enable)

Console> (enable) set spantree portvlancost 1/2 21

Port 1/2 VLANs 1-20,22-1005 have path cost 3100.
Port 1/2 VLANs 21 have path cost 3099.
Console> (enable)

Misconceptions:
None

Related Commands:
show spantree


 Command:

set spantree portvlanpri

Mode:

Switch> (enable)

Syntax:

set spantree portvlanpri mod_num/port_num priority [vlans]

Syntax Description:

mod_num

Variable that specifies the number of the module.

port_num

Variable that specifies the number of the port.

priority

Variable that specifies the number that represents the cost of a link in a spanning tree bridge. The priority level is from 0 to 63, with 0 indicating high priority and 63 indicating low priority.

vlans

(Optional) Variable that specifies the VLANs that use the specified priority level.

Command Description:

Use the set spantree portvlanpri command to set the port priority for a subset of VLANs in the trunk port.

Example:

You can use this command to add VLANs to a specified port priority level. Subsequent calls to this command do not replace VLANs that are already set at a specified port priority level.

The set spantree portvlanpri command applies only to trunk ports.

  Switch> (enable) set spantree portvlanpri 2/24 2

Misconceptions:
None

Related Commands:
show spantree


 Command:

set spantree root

Mode:

Switch> (enable)

Syntax:

set spantree root [secondary] [vlans] [dia network_diameter] [hello hello_time]

set spantree root [secondary] mistp-instance instances [dia network_diameter]

set spantree root [secondary] mst {instance | {[dia network_diameter] [ hello hello_time]}}

Syntax Description:

secondary

(Optional) Keyword that designates this switch as a secondary root, if the primary root fails.

vlans

(Optional) Variable that specifies the number of the VLAN; valid values are from 1 to 1005.

dia network_diameter

(Optional) Keyword that specifies the maximum number of bridges between any two points of attachment of end stations; valid values are from 2 to 7.

hello hello_time

(Optional) Keyword that specifies, in seconds, the duration between generation of configuration messages by the root switch; valid values are from 1 to 10.

mistp-instance instances

Keyword and variable that specify the instance number; valid values are from 1 to 16.

mst instance

Keyword and variable that set the forward delay time for the IST instance and all MST instances

Command Description:

Use the set spantree root command to set the primary or secondary root for specific VLANs of the switch or for all VLANs of the switch.

Examples:

This example shows how to set the primary root for a range of VLANs:

Console> (enable) set spantree root 1-10 dia 4

VLANs 1-10 bridge priority set to 8192
VLANs 1-10 bridge max aging time set to 14 seconds.
VLANs 1-10 bridge hello time set to 2 seconds.
VLANs 1-10 bridge forward delay set to 9 seconds.
Switch is now the root switch for active VLANs 1-6.
Console> (enable)

This example shows how to set the primary root for an instance:

Console> (enable) set spantree root mistp-instance 2-4 dia 4

Instances 2-4 bridge priority set to 8192
VLInstances 2-4 bridge max aging time set to 14 seconds.
Instances 2-4 bridge hello time set to 2 seconds.
Instances 2-4 bridge forward delay set to 9 seconds.
Switch is now the root switch for active Instances 1-6.
Console> (enable)

This example shows how to set the primary root for MST instance 5:

Console> (enable) set spantree root mst 5

Instance 5 bridge priority set to 24576.
Instance 5 bridge max aging time set to 16.
Instance 5 bridge hello time set to 2.
Instance 5 bridge forward delay set to 15.
Switch is now the root switch for active Instance 5.
Console> (enable)

This example shows how to set the secondary root for MST instance 0:

Console> (enable) set spantree root secondary mst 0

Instance 0 bridge priority set to 28672.
Instance 0 bridge max aging time set to 20.
Instance 0 bridge hello time set to 2.
Instance 0 bridge forward delay set to 15.
Console> (enable)

This example shows how to set the maximum number of bridges and the hello time of the root for MST instance 0:

Console> (enable) set spantree root mst 0 dia 7 hello 2
Instance 0 bridge priority set to 24576.
Instance 0 bridge max aging time set to 20.
Instance 0 bridge hello time set to 2.
Instance 0 bridge forward delay set to 15.
Switch is now the root switch for active Instance 0.
Console> (enable)

These examples show that setting the bridge priority to 8192 was not sufficient to make this switch the root. So, the priority was further reduced to 7192 (100 less than the current root switch) to make this switch the root switch. However, reducing it to this value did not make it the root switch for active VLANs 16 and 17.

Console> (enable) set spantree root 11-20.

VLANs 11-20 bridge priority set to 7192
VLANs 11-10 bridge max aging time set to 20 seconds.
VLANs 1-10 bridge hello time set to 2 seconds.
VLANs 1-10 bridge forward delay set to 13 seconds.
Switch is now the root switch for active VLANs 11-15,18-20.
Switch could not become root switch for active VLAN 16-17.
Console> (enable)

Console> (enable) set spantree root secondary 22,24 dia 5 hello 1

VLANs 22,24 bridge priority set to 16384.
VLANs 22,24 bridge max aging time set to 10 seconds.
VLANs 22,24 bridge hello time set to 1 second.
VLANs 22,24 bridge forward delay set to 7 seconds.
Console> (enable)

Misconceptions:

If you do not specify a VLAN number, VLAN 1 is used.

This command is not supported by the NAM.

This command runs on backbone or distribution switches.

This command increases path costs to a value greater than 3000.

If you enable MISTP, you cannot set the VLAN root. If you enable PVST+, you cannot set the instance root.

You can run the secondary root many times to create backup switches for use in case of a root failure.

The set spantree root secondary bridge priority value is 16,384 except when MAC reduction or MISTP are enabled, then the value is 28,672.

The set spantree root bridge priority value is 16,384 except when MAC reduction or MISTP are enabled, then the value is 24,576.
Related Commands:
show spantree


 Command:

set spantree uplinkfast

Mode:

Switch> (enable)

Syntax:

set spantree uplinkfast enable [rate station_update_rate] [all-protocols {off | on}]

set spantree uplinkfast disable

Syntax Description:

enable

Keyword that enables a fast switchover.

rate station_update_rate

(Optional) Keyword and variable that specify the number of multicast packets transmitted per 100 ms when an alternate port is chosen after the root port goes down.

all-protocols

(Optional) Keyword that specifies whether the switch generates dummy multicast packets for all protocol groups (IP, IPX, and Group) in a network with switches using protocol filtering.

off

(Optional) Keyword that prevents the switch from generating multicasts for all protocol groups.

on

(Optional) Keyword that causes the switch to generate multicasts for all protocol groups.

disable

Keyword that disables Uplink Fast Switchover.

Command Description:

Use the set spantree uplinkfast command to enable and Uplink Fast Switchover to alternate ports when the root port fails. This command applies to a switch, not to a WAN.

The set spantree uplinkfast enable command has the following results:

  • Changes the bridge priority to 49152 for all VLANs (allowed VLANs).
  • Increases the path cost and port VLAN cost of all ports to a value greaterthan 3000.
  • On detecting the failure of a root port, an instant cutover occurs to analternate port selected by Spanning Tree Protocol.

If you run set spantree uplinkfast enable on a switch that has this feature already enabled, only the station update rate is updated. The rest of the parameters are not modified.

If you run set spantree uplinkfast disable on a switch, the UplinkFast feature is disabled, but the switch priority and port cost values are not reset to the factory defaults. To reset the values to the factory defaults, enter the clear spantree uplinkfast command.

The default station_update_rate value is 15 packets per 100 ms, which is equivalent to a 1 percent load on a 10-Mbps Ethernet port. If you specify this value as 0, the switch does not generate station-update-rate packets.

Use the all-protocols on keywords on switches that have UplinkFast enabled but do not have protocol filtering enabled, and that are connected to upstream switches in the network that have protocol filtering enabled. The all-protocols on keywords cause the switch to generate multicasts for each protocol-filtering group.

On switches with both UplinkFast and protocol filtering enabled, or if no other switches have protocol filtering enabled, you do not need to use the all-protocols on keywords.

Example:

This example shows how to enable the spantree UplinkFast feature and specify the number of multicast packets transmitted to 40 packets per 100 ms:

Console>(enable) set spantree uplinkfast enable rate 40

VLANs 1-1005 bridge priority set to 49152.
The port cost and portvlancost of all ports increased to above 3000.
Station update rate set to 40 packets/100ms.
uplinkfast turned on for bridge.
Console> (enable)

This example shows how to disable the spantree UplinkFast feature:

console> (enable) set spantree uplinkfast disable

Uplinkfast disabled for switch.
Use clear spantree uplinkfast to return stp parameters to default.
console>(enable) clear spantree uplink
This command will cause all portcosts, portvlancosts, and the
bridge priority on all vlans to be set to default.
Do you want to continue (y/n) [n]? y
VLANs 1-1005 bridge priority set to 32768.
The port cost of all bridge ports set to default value.
The portvlancost of all bridge ports set to default value.
uplinkfast disabled for bridge.
Console> (enable)

This example shows how to enable the all-protocols feature:

Console> (enable) set spantree uplinkfast enable all-protocols on

uplinkfast update packets enabled for all protocols.
uplinkfast already enabled for bridge.

This example shows how to disable the all-protocols feature:

Console> (enable) set spantree uplinkfast disable all-protocols off

uplinkfast all-protocols field set to off.
uplinkfast already enabled for bridge.
Console> (enable)

Misconceptions:
None

Related Commands:
show spantree


 Command:

set system name

Mode:

Switch> (enable)

Syntax:

set system name [name_string]

Syntax Description:

name_string

(Optional) Variable text string that identifies the system

Command Description:

Use the set system name command to configure a name for the system.

In Catalyst 4000 family software release 4.4 and later, if you use the set system name command to assign a name to the switch, the switch name is used as the prompt string. However, if you specify a different prompt string using the set prompt command, that string is used for the prompt. If no name is specified, the system name is cleared.

The system name can be 255 characters long, and the prompt can be 20 characters long. The system name is truncated appropriately when used as a prompt; a greater-than symbol (>) is appended to the truncated system name. If the system name was found from a DNS lookup, it is truncated to remove the domain name. If the prompt is obtained using the system name, it is updated whenever the system name changes. You can overwrite this prompt any time by setting the prompt manually. Any change in the prompt is reflected in all current open sessions.

Example:

This example shows how to set the system name to Information Systems:

Console> (enable) set system name Information Systems

System name set.
Console> (enable)

Misconceptions:
None

Related Commands:
set prompt


 Command:

set tacacs key

Mode:

Switch> (enable)

Syntax:

set tacacs key key

Syntax Description:

key

Variable that specifies printable ASCII characters used for authentication and encryption. Key length must be less than 100 characters.

Command Description:

Use the set tacacs key command to set the key for TACACS+ authentication and encryption.

The key must be the same as the key used on the TACACS+ server. All leading spaces are ignored. Spaces within the key and at the end of the key are included. Double quotation marks are not required, even if there are spaces between words in the key, unless the quotation marks themselves are part of the key. The key can consist of any printable ASCII characters except the tab character.

Example:

This example shows how to set the authentication and encryption key:

Console> (enable) set tacacs key Who Goes There

The tacacs key has been set to Who Goes There.
Console> (enable)

Misconceptions:
None

Related Commands:
set tacacs server


 Command:

set tacacs server

Mode:

Switch> (enable)

Syntax:

set tacacs server ip_addr [primary]

Syntax Description:

ip_addr

Variable that specifies the IP address of the server on which the TACACS+ server resides.

primary

(Optional) Keyword that specifies to designate the specified server as the primary TACACS+ server.

Command Description:

Use the set tacacs server command to define a TACACS+ server.

You can configure a maximum of three servers. The primary server, if configured, is contacted first. If no primary server is configured, the first server configured becomes the primary server.

Example:

This example shows how to configure the server on which the TACACS+ server resides and to designate it as the primary server:

Console> (enable) set tacacs server 170.1.2.20 primary

170.1.2.20 added to TACACS server table as primary server.
Console> (enable)

Misconceptions:
None

Related Commands:
set tacacs key


 Command:

set trunk

Mode:

Switch> (enable)

Syntax:

set trunk mod_num/port_num [on | off | desirable | auto | nonegotiate] [vlan_range] [isl | dot1q dot10 | lane | negotiate]

Syntax Description:

mod_num

Variable that specifies the number of the module.

port_num

Variable that specifies the number of the port on the module.

on

(Optional) Keyword that forces the port to become a trunk port and persuade the neighboring port to become a trunk port. The port becomes a trunk port even if the neighbor port does not agree to become a trunk. The only possible mode for ATM ports is on.

off

(Optional) Keyword that forces a port to become a nontrunk port and persuades the neighboring port to become a nontrunk port. The port becomes a nontrunk port even if the neighbor port does not agree to become a nontrunk port. This is the default mode for FDDI trunks. This option is not allowed for ATM ports.

desirable

(Optional) Keyword that causes a port to negotiate actively with the neighbor port to become a trunk link. This mode is not allowed on FDDI and ATM ports.

auto

(Optional) Keyword that causes the port to become a trunk port if the neighboring port tries to negotiate a trunk link. This mode is not allowed on FDDI and ATM ports. This is the default mode for Fast Ethernet and Gigabit Ethernet ports.

nonegotiate

(Optional) Keyword that forces the port to become a trunk port but prevents it from sending DTP frames to its neighbor. This mode is allowed only on ISL and IEEE 802.1Q trunks.

vlan_range

(Optional) VLANs to add to the list of allowed VLANs on the trunk; valid values are from 1 to 1005.

isl

(Optional) Keyword that specifies an ISL trunk on an Ethernet port.

dot1q

(Optional) Keyword that specifies an IEEE 802.1Q trunk on an Ethernet port. IEEE 802.1Q trunks are supported in Catalyst 5000 family and 2926G series software release 4.1(1) and later with 802.1Q-capable hardware. Automatic negotiation of 802.1Q trunks is supported in software release 4.2(1) and later. In software release 4.1, you must use the nonegotiate keyword with 802.1Q trunks.

dot10

(Optional) Keyword that specifies an IEEE 802.10 trunk on a FDDI or CDDI port.

lane

(Optional) Keyword that specifies an ATM LANE trunk on an ATM port.

negotiate

(Optional) Keyword that causes the port to become an ISL (preferred) or 802.1Q trunk, depending on the configuration and capabilities of the neighboring port.

Command Description:

Use the set trunk command to configure trunk ports and to add VLANs to the allowed VLAN list for existing trunks.

Trunking capabilities are hardware dependent. Refer to the Module Installation Guide for your switch to determine the trunking capabilities of your hardware, or enter the show port capabilities command.

The Catalyst 4000 family switches use the DTP (formerly known as DISL) to negotiate trunk links automatically on Fast Ethernet and Gigabit Ethernet ports. Whether a port will negotiate to become a trunk port depends on both the mode and the trunk type specified for that port. Refer to the Software Configuration Guide-Catalyst 4000 Family, 2948G, and 2980G Switches for detailed information on how trunk ports are negotiated.

DTP is a point-to-point protocol. However, some internetworking devices might improperly forward DTP frames. You can avoid this problem by ensuring that trunking is turned off on ports connected to non-Catalyst 4000 family devices if you do not intend to trunk across those links. When enabling trunking on a link to a Cisco router, enter the nonegotiate keyword to cause the port to become a trunk but not generate DTP frames. The nonegotiate keyword is available in Catalyst 4000 family software release 2.4(3) and later.

For trunking to be negotiated on Fast Ethernet and Gigabit Ethernet ports, the ports must be in the same VTP domain. However, you can use the on or nonegotiate keywords to force a port to become a trunk, even if it is in a different domain.

To remove VLANs from the allowed list for a trunk, enter the clear trunk mod_num/port_num vlan_range command. When you first configure a port as a trunk, the set trunk command always adds all VLANs to the allowed VLAN list for the trunk, even if you specify a VLAN range (the specified VLAN range is ignored).

To remove VLANs from the allowed list, enter the clear trunk mod_num/port_num vlan_range command. To later add VLANs that were removed, enter the set trunk mod_num/port_num vlan_range command.

If you do not enter a trunk-type keyword, the value is unchanged from the previous configuration.

The dot1q trunk type is the only trunk type supported by the Catalyst 4000 family switches.

To return a trunk to its default trunk type and mode, enter the clear trunk mod_num/port_num command.

If you enter the set trunk command on a Token Ring port, you receive a message indicating that the port is "not a trunk-capable port."

When you are running the set trunk command on an Access Gateway module, you have limited usage of the command.

Examples:

This example shows how to set port 2 on module 1 as a trunk port:

Console> (enable) set trunk 1/2 on

Port(s) 1/2 trunk mode set to on.
Console> (enable)

This example shows how to set port 2 on module 1 as a nontrunk port:

Console> (enable) set trunk 1/2 off

Port(s)  1/2 trunk mode set to off.
Console> (enable)

This example shows how to set port 2 on module 1 as a preferred trunk port:

Console> (enable) set trunk 1/2 desirable
Port(s)  1/2 trunk mode set to desirable.
Console> (enable) 2000 Jan 11 09:16:29 %DTP-5-TRUNKPORTON:Port 1/2 has become ik

This example shows how to add VLANs 5 through 50 to the allowed VLAN list for a trunk port (VLANs were previously removed from the allowed list with the clear trunk command):

Console> (enable) set trunk 1/1 5-50

Adding vlans 5-50 to allowed list.
Port(s) 1/1 allowed vlans modified to 1,5-50,101-1005.
Console> (enable)

This example shows how to set port 5 on module 4 as an 802.1Q trunk port in
desirable mode:

Console> (enable) set trunk 4/5 desirable dot1q

Port(s) 4/5 trunk mode set to desirable.
Port(s) 4/5 trunk type set to dot1q.
Console> (enable)

This example shows how to set port 1 on module 1 as an ISL trunk port:

Console> (enable) set trunk 1/1 isl
Port(s)  1/1 trunk type set to isl.
Console> (enable)

Misconceptions:
None

Related Commands:
clear trunk
show trunk


 Command:

set vlan

Mode:

Switch> (enable)

Syntax:

set vlan {vlan} {mod/port}

set vlan {vlan} [name {name}] [type {type}] [state {state}] [said {said}] [mtu {mtu}]
[mode {bridge_mode}] [stp {stp_type}] [translation vlan_num]
[pvlan-type {pvlan_type}] [rspan]

Syntax Description:

vlan

Variable that specifies the number of the VLAN.

mod/port

Variable that specifies the number of the module and port.

name name

(Optional) Keyword and variable that defines a text string used as the name of the VLAN (1 to 32 characters).

type type

(Optional) Keyword and variable that identify the VLAN type as 802.1Q.

state state

(Optional) Keyword and variable that specify whether the state of the VLAN is active or suspended. VLANs in suspended state do not pass packets.

said said

(Optional) Keyword and variable that specify the security association identifier; valid values are from 1 to 4294967294.

mtu mtu

(Optional) Keyword and variable that specify the maximum transmission unit (packet size, in bytes) that the VLAN can use; valid values are from 576 to 18190.

mode bridge_mode

(Optional) Keyword and variable that specify the bridge mode; valid values are srt and srb.

stp stp_type

(Optional) Keyword and variable that specify the version of the Spanning Tree Protocol to use: source routing transparent (ieee), source route bridging (ibm), automatic source selection (auto).

translation vlan_num

(Optional) Keyword and variable that specify a translational VLAN used to translate FDDI to Ethernet; valid values are from 1 to 1005.

pvlan-type pvlan-type

(Optional) Keyword and variable that specify the private VLAN type. See the "Usage Guidelines" section below for valid values.

rspan

(Optional) Keyword that creates a VLAN for remote SPAN.

Command Description:

Use the set vlan command to group ports into a VLAN.

The VLAN numbers are always ISL VLAN identifiers, and not 802.1q VLAN identifiers.

VLAN 1 parameters are factory configured and cannot be changed.

If you specify a range of VLANs, you cannot use the VLAN name.

If you enter the mistp-instance none command, the specified VLANs are unmapped from any instance they are mapped to.

If you are configuring normal range VLANs, you cannot use the set vlan command until the Catalyst 4000 family switch is either in VTP transparent mode (set vtp mode transparent) or until a VTP domain name has been set (set vtp domain name). To create a private VLAN, UTP mode must be transparent.

You cannot set multiple VLANs for ISL ports using this command. The VLAN name can be from 1 to 32 characters in length. If you are adding a new VLAN or modifying an existing VLAN, the VLAN number must be within the range of 1 to 1000 and 1025 to 4094.

If you want to use the extended range VLANs (1025 to 4094), you must enable the MAC address reduction feature using the set spantree macreduction command. When you enable MAC address reduction, the pool of MAC addresses used for the VLAN spanning tree is disabled, leaving a single MAC address that identifies the switch.

You must configure a private VLAN on the supervisor engine.

Valid values for pvlan-type are the following:

  • primary specifies the VLAN as the primary VLAN in a private VLAN.
  • isolated specifies the VLAN as the isolated VLAN in a private VLAN.
  • community specifies the VLAN as the community VLAN in a private VLAN.
  • twoway-community specifies the VLAN as a bidirectional community VLAN that carries the traffic among community ports and to and from community ports to and from the MSFC. Non-trunk promiscuous ports do not support the twoway community type for remapping.
  • none specifies that the VLAN is a normal Ethernet VLAN, not a private VLAN.

Only regular VLANs with no access ports assigned to them can be used in private VLANs. Do not use the set vlan command to add ports to a private VLAN; use the set pvlan command to add ports to a private VLAN.

VLANs 1001, 1002, 1003, 1004, and 1005 cannot be used in private VLANs.

VLANs in a suspended state do not pass packets.

Example:

This example shows how to set VLAN 850 to include ports 4 through 6on module 3. Because ports 4 through 6 were originally assigned to VLAN 1, the message reflects the modification of VLAN 1:

Console> (enable) set vlan 850 3/4-6

VLAN 850 modified.
VLAN 1 modified.
VLAN  Mod/Ports
---- -----------------------
850   3/4-6
Console> (enable)

This example shows how to set VLAN 7 as a primary VLAN:

Console> (enable) set vlan 7 pvlan-type primary
Console> (enable)

This example shows how to set VLAN 901 as an isolated VLAN:

Console> (enable) set vlan 901 pvlan-type isolated
Console> (enable)

This example shows how to set VLAN 903 as a community VLAN:

Console> (enable) set vlan 903 pvlan-type community
Console> (enable)

This example shows how to set VLAN 2 as an RSPAN vlan:

Console> (enable) set vlan 2 rspan
VTP advertisements transmitting temporarily stopped,
and will resume after the command finishes.
Vlan 2 configuration successful
Console> (enable)

Misconceptions:
None

Related Commands:
show vlan
clear vlan


 Command:

set vmps server

Mode:

Switch> (enable)

Syntax:

set vmps server ip_addr [primary]

Syntax Description:

ip_addr

Variable that specifies the IP address of the VMPS server

primary

(Optional) Keyword that identifies the specified device as the primary VMPS server

Command Description:

Use the set vmps server command to configure the IP address of the VMPS server to be queried.

You can specify the IP addresses of up to three VMPS servers. You can define any VMPS server as the primary VMPS server.

If the primary VMPS server is down, all subsequent queries go to a secondary VMPS server. VMPS checks on the primary server's availability once every five minutes. When the primary VMPS server comes back online, subsequent VMPS queries are directed back to the primary VMPS server.

To use a co-resident VMPS (when VMPS is enabled in a device), configure one of the three VMPS addresses as the IP address of interface sc0.

Examples:

This example shows how to define a VMPS server:

Console> (enable) set vmps server 192.168.10.140 primary

192.168.10.140 added to VMPS table as primary domain server.
Console> (enable) set vmps server 192.168.69.171

192.168.69.171 added to VMPS table as backup domain server.
Console> (enable)

Misconceptions:
None

Related Commands:

None


 Command:

set vmps state

Mode:

Switch> (enable)

Syntax:

set vmps state {enable | disable}

Syntax Description:
enable | Keyword used to enable VMPS.
disable | Keyword used to disable VMPS.

Command Description:

Use the set vmps state command to enable or disable VMPS.

Before using the set vmps state command, you must use the set vmps storage command to specify the IP address of the server from which the VMPS database is downloaded.

Example:

The following examples show the set vmps state enable and set vmps state disable commands and the system's responses to these commands.

Console> (enable) set vmps state enable
Vlan membership Policy Server enabled.
Console> (enable) set vmps state enable
TFTP server IP address is not configured
Console> (enable) set vmps state enable
Unable to contact the TFTP server 198.4.254.222
Console> (enable) set vmps state enable
File "vmps_configuration.db" not found on the TFTP server 198.4.254.222
Console> (enable) set vmps state enable
Enable failed due to insufficient resources.
Console> (enable) set vmps state disable
All the VMPS configuration information will be lost and the resources released on disable.
Do you want to continue (y/n[n]):y
VLAN Membership Policy Server disabled.

Misconceptions:
None

Related Commands:

None


 Command:

set vtp pruneeligible

Mode:

Switch> (enable)

Syntax:

set vtp pruneeligible vlans

Syntax Description:

vlans

Variable that specifies the range of VLAN numbers; valid values are from 2 to 1000.

Command Description:

Use the set vtp pruneeligible command to specify the VTP domain on which VLANs are prune eligible.

VTP pruning causes information about each pruning-eligible VLAN to be removed from VTP updates if there are no stations belonging to that VLAN on a particular switch port. Use the set vtp command to enable VTP pruning.

By default, VLANs 2 to 1000 are pruning eligible. You do not need to use the set vtp pruning command unless you have previously used the clear vtp pruning command to make some VLANs pruning ineligible. If VLANs have been made pruning ineligible, use the set vtp pruning command to make them pruning eligible again.

Examples:

This example shows how to configure pruning eligibility for VLANs 120 and 150:

Console> set vtp pruneeligible 120,150

Vlans 120,150 eligible for pruning on this device.
VTP domain nada modified.
Console>

In this example, VLANs 200 to 500 were made pruning ineligible using the clear vtp pruning command. This example shows how to make VLANs 220 to 320 pruning eligible again:

Console> set vtp pruneeligible 220-320

Vlans 2-199,220-320,501-1000 eligible for pruning on this device.
VTP domain Company modified.
Console>

Misconceptions:
None

Related Commands:
clear vtp pruning
set vlan
show vtp domain


 Command:

set vtp pruning

Mode:

Switch> (enable)

Syntax:

set vtp pruning vlans

Syntax Description:

vlans

Variable that specifies the range of VLAN numbers; valid values are 2 to 1000.

Command Description:

Use the set vtp pruning command to specify which VLANs in the VTP domain are eligible for pruning.

VTP pruning causes information about each pruning-eligible VLAN to be removed from VTP updates if there are no stations belonging to that VLAN out a particular switch port. Use the set vtp command to enable VTP pruning.

By default, VLANs 2 to 1000 are pruning eligible. You do not need to use the set vtp pruning command unless you have previously used the clear vtp pruning command to make some VLANs pruning ineligible.

If VLANs have been made pruning ineligible, use the set vtp pruning command to make them pruning eligible again.

Examples:

This example shows how to configure pruning eligibility for VLANs 120 and 150:

Console> (enable) set vtp pruning 120,150

Vlans 120,150 eligible for pruning on this device.
VTP domain nada modified.
Console> (enable)

In this example, VLANs 200-500 were made pruning ineligible using the clear vtp pruning command. The following example shows how to make VLANs 220 to 320 pruning eligible again:

Console> (enable) clear vtp pruning 200-500

Vlans 1,200-500,1001-1005 will not be pruned on this device.
VTP domain Company modified.
Console> (enable)

Console> (enable) set vtp pruning 220-320

Vlans 2-199,220-320,501-1000 eligible for pruning on this device.
VTP domain Company modified.
Console> (enable)

Misconceptions:

None

Related Commands:
set vlan
clear vtp pruning
show vtp domain


 Command:

set vtp

Mode:

Switch> (enable)

Syntax:

set vtp [domain domain_name] [mode {client | server | transparent | off}] [passwd passwd] [pruning {enable | disable}] [v2 {enable | disable}]

Syntax Description:

domain domain_name

(Optional) Keyword and variable that identify the VLAN management domain. The domain_name can be from 1 to 32 characters in length.

mode {client | server | transparent | off}

(Optional) Keywords that specify the VTP mode

passwd passwd

(Optional) Keyword and variable that specify the VTP password; the VTP password can be from 8 to 64 characters in length.

pruning {enable | disable}

(Optional) Keywords to enable or disable VTP pruning for the entire management domain

v2 {enable | disable}

(Optional) Keywords to enable or disable version 2 mode

Command Description:

Use the set vtp command to set the options for VTP.

All switches in a VTP domain must run the same version of VTP. VTP version 1 and VTP version 2 do not operate on switches in the same VTP domain.

If all switches in a domain are VTP version 2-capable, enable VTP version 2 on one switch (using the set vtp v2 enable command). The version number is automatically propagated to the other version 2-capable switches in the VTP domain.

If the VTP password has already been defined, entering passwd 0 (zero) clears the VTP password.

VTP supports four different modes: server, client, transparent, and off. If you make a change to the VTP or VLAN configuration on a switch in server mode, that change is propagated to all of the switches in the same VTP domain.

If the receiving switch is in server mode and its revision number is higher than the sending switch, the configuration is not changed. If the revision number is lower, the configuration is duplicated.

VTP can be set to either server or client mode only when dynamic VLAN creation is disabled.

If the receiving switch is in server mode, the configuration is not changed.

If the receiving switch is in client mode, the client switch changes its configuration to duplicate the configuration of the server. Be sure you make all VTP or VLAN configuration changes on a switch in server mode.

If the receiving switch is in transparent mode, the configuration is not changed. Switches in transparent mode do not participate in VTP. If you make VTP or VLAN configuration changes on a switch in transparent mode, the changes are not propagated to the other switches in the network.

When you configure VTP "off" mode, the switch behaves the same as in VTP transparent mode with the exception that VTP advertisements are not forwarded.

The pruning keyword is used to enable or disable VTP pruning for the VTP domain. VTP pruning causes information about each pruning-eligible VLAN to be removed from VTP updates if there are no stations belonging to that VLAN on a particular switch port. Use the set vtp pruneeligible and clear vtp pruning commands to specify which VLANs should or should not be pruned when pruning is enabled for the domain.

Use the clear config all command to remove the domain from the switch.

Example:

This example shows how to use the set vtp command:

Console> (enable) set vtp domain Engineering mode client

VTP domain Engineering modified
Console> (enable)

This example shows what happens if you try to change VTP to server or client mode and dynamic VLAN creation is enabled:

Console> (enable) set vtp mode server

Failed to Set VTP to Server. Please disable Dynamic VLAN Creation First.
Console> (enable)

This command shows how to set VTP to off mode:

Console> (enable) set vtp mode off

VTP domain modified
Console> (enable)

Misconceptions:

This command is not supported by the NAM.

This command is not supported on extended-range VLANs.

VTP pruning and MISTP cannot be enabled at the same time.

Be careful when you use the clear config all command. This command clears the entire switch configuration, not just the VTP domain.

Related Commands:
set vlan
show vlan
show vtp domain
set vtp pruneeligible


 Command:

write

Mode:

Switch> (enable)

Syntax:

write {host file | network | terminal} [rcp all]

write memory

Syntax Description:

host

Variable that specifies the IP address or IP alias of the host

file

Variable that specifies the name of the configuration file

network

Keyword that specifies interactive prompting for the IP address or IP alias of the host and the filename to upload

terminal

Keyword that displays the nondefault configuration file on the terminal

rcp

(Optional) Keyword that uploads a software image to a host using RCP

all

(Optional) Keyword that specifies all modules and system configuration information, including the IP address

memory

Keyword that uploads the current configuration to a specified location

Command Description:

Use the write command to upload or display nondefault configurations to a host, terminal, or memory.

The write host file command is a shorthand version of the write network command.

You cannot use the write network command to upload software to the ATM module. With the write network command, the file must already exist on the host (use the UNIX touch filename command to create the file).

The write memory command is applicable only when the switch is set to save its configuration to a text file.
Examples:

This sample session assumes that module 1 is a 2-port supervisor engine module; module 2 is a 12-port 10/100BASE-T switched Ethernet module; modules 3 and 5 are empty; and module 4 is a FDDI module. Details of the ATM configuration must be accessed through the special module mode.

This example shows how to upload the system5.cfg file to the mercury host using the write network command:

Console> (enable) write network

IP address or name of host? mercury

Name of configuration file to write? system5.cfg

Upload configuration to system5.cfg on mercury (y/n) [y]? y

/
Done.  Finished Network Upload.  (9003 bytes)
Console> (enable)

This example shows how to upload the system5.cfg file to the mercury host using the write network rcp command:

Console> (enable) write network rcp

IP address or name of host? mercury

Name of configuration file to write? system5.cfg

Upload configuration to system5.cfg on mercury (y/n) [y]? y

/
Done.  Finished Network Upload.  (9003 bytes)
Console> (enable)

This example shows how to upload the system5.cfg file to the mercury host using the write host file command as a shorthand method:

Console> (enable) write mercury system5.cfg

Upload configuration to system5.cfg on mercury (y/n) [y]? y

/
Done.  Finished Network Upload.  (9003 bytes)
Console> (enable)

This example shows how to use the write terminal all command to display the entire (default and nondefault) configuration file on the terminal (partial display):

Console> (enable) write terminal all

begin
set password $1$FMFQ$HfZR5DUszVHIRhrz4h6V70
set enablepass $1$FMFQ$HfZR5DUszVHIRhrz4h6V70
set prompt Console>
!
#system
set system baud 9600
set system modem  disable
set system name
set system location
set system contact
!
#snmp
set snmp community read-only public
set snmp community read-write private
set snmp community read-write-all secret
set snmp trap  disable
!
#vlan/trunk
set vlan 1    1/1-2,4/1
set vlan 2    2/1-5
!
#trunks
!
#cam
set cam agingtime 1    300
set cam agingtime 2    300
!
#ip
set interface sc0 0.0.0.0 0.0.0.0 0.0.0.0
set interface sl0 0.0.0.0 0.0.0.0
set ip redirect      enable
set ip unreachable   disable
set ip fragmentation enable
set ip alias default         0.0.0.0
set arp agingtime 1200
!
...
<<<<output truncated>>>>
Console> (enable)

This example shows how to upload the running system configuration to a pre-specified location:

Console> (enable) write memory

Upload configuration to bootflash:switch.cfg
7165844 bytes available on device bootflash, proceed (y/n) [n]? y

Console> (enable)

Misconceptions:

By default, the write command will upload or output only nondefault configurations. Use the keyword all to upload or output both default and nondefault configurations.

Related commands:
show config


Command:

clear mac address-table

Mode:

Switch#

Syntax:

clear mac address-table {dynamic [address mac-addr | interface interface-id | vlan vlan-id] | notification}

Syntax Description:

dynamic

Delete all dynamic MAC addresses.

dynamic address mac-addr

(Optional) Delete the specified dynamic MAC address.

dynamic interface interface-id

(Optional) Delete all dynamic MAC addresses on the specified physical port or port channel.

dynamic vlan vlan-id

(Optional) Delete all dynamic MAC addresses for the specified VLAN. Valid IDs are from 1 to 4096 when the enhanced software image (EI) is installed and 1 to 1005 when the standard software image (SI) is installed.

notification

Clear the notifications in the history table and reset the counters.

Command Description:

Use the clear mac address-table privileged EXEC command to delete from the MAC address table a specific dynamic address, all dynamic addresses on a particular interface, or all dynamic addresses on a particular VLAN. This command also clears the MAC address notification global counters.

Note: Beginning with Release 12.1(11)EA1, the clear mac address-table command replaces the clear mac-address-table command (with the hyphen). The clear mac-address-table command (with the hyphen) will become obsolete in a future release.

Example:

This example shows how to remove a specific dynamic address from the MAC address table:

Switch# clear mac address-table dynamic address 0008.0070.0007

You can verify that the information was deleted by entering the show mac address-table privileged EXEC command.

Misconceptions:

None.

Related Commands:

mac address-table notification
show mac-address-table
show mac-address-table notification
snmp trap mac-notification


 Command:

duplex

Mode:

Switch(config-if)#

Syntax:

duplex {full | half | auto}

no duplex

Syntax Description:

full

Specifies full-duplex operation.

half

Specifies half-duplex operation.

auto

Specifies the auto negotiation capability. The interface automatically operates at half or full duplex, depending on environmental factors, such as the type of media and transmission speeds for the peer routers, hubs, and switches used in the network configuration.

Command Description:

To configure the duplex operation on an interface, use the duplex interface configuration command. Use the no form of this command to return the system to half-duplex mode, which is the system default.

To use the auto-negotiation capability (that is, detect speed and duplex modes automatically), you must set both speed and duplex to auto. Setting speed to auto negotiates speed only, and setting duplex to auto negotiates duplex only.

Table describes the access server's performance for different combinations of the duplex and speed modes. The specified duplex command configured with the specified speed command produces the resulting system action.

Duplex Commands Speed Commands Resulting System Action

duplex auto

speed auto

Auto negotiates both speed and duplex modes.

duplex auto

speed 100 or speed 10

Auto negotiates both speed and duplex modes.

duplex half or duplex full

speed auto

Auto negotiates both speed and duplex modes.

duplex half

speed 10

Forces 10 Mbps and half duplex.

duplex full

speed 10

Forces 10 Mbps and full duplex.

duplex half

speed 100

Forces 100 Mbps and half duplex.

duplex full

speed 100

Forces 100 Mbps and full duplex.

Example:

The following example shows the different duplex configuration options you can configure on a Cisco AS5300:

Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#interface fastethernet 0
Router(config-if)#duplex ?
  auto  Enable AUTO duplex configuration
  full  Force full duplex operation
  half  Force half-duplex operation

Misconceptions:

For the Cisco AS5300, the duplex {full | half | auto} command syntax replaces the following two earlier duplex commands:

  • half-duplex
  • full-duplex

You will get the following error messages if you try to use these commands on a Cisco AS5300:

Router(config)#interface fastethernet 0
Router(config-if)#full-duplex
Please use duplex command to configure duplex mode
Router(config-if)#
Router(config-if)#half-duplex

Please use duplex command to configure duplex mode

Related Commands:
speed


Command:

fabric required

Mode:

Router(config)#

Syntax:

fabric required

no fabric required

Syntax Description:

column1 row 1 | column 2 row1
column1 row 2 | column 2 row2

Command Description:

If you boot the switch with fabric-required mode configured but without a Switch Fabric Module installed, only the supervisor engine receives power; no switching modules power up.

When the switch is operating with fabric-required mode configured and a Switch Fabric Module installed, if you remove the switch fabric module or if it fails, the switch removes power from all switching modules; only the supervisor engine remains active.

When the switch is operating with fabric-required mode configured and with redundant Switch Fabric Modules installed, if you remove both switch fabric modules or if both fail, the switch removes power from all switching modules; only the supervisor engine remains active.

Example:

To configure fabric-required mode, which prevents all switching modules from operating unless there is a Switch Fabric Module installed, perform this task:

Router(config)#fabric required
Router(config)#no fabric required

Misconceptions:

None.

Related Commands

fabric switching-mode allowed

© Cisco Systems, Inc. 2001, 2002


Command:

fabric switching-mode allow

Mode:

Router(config)#

Syntax:

fabric switching-mode allow {bus-mode | {truncated [{threshold [mod]}]}}
no fabric switching-mode allow {bus-mode | {truncated [threshold]}}

Syntax Description:

bus-mode | Specifies bus-only mode.
truncated | Specifies truncated mode.
threshold mod | (Optional) Number of Switch Fabric Module-capable modules that are needed for truncated switching; see the "Usage Guidelines" section for additional information.

Command Description:

To enable truncated mode in the presence of two or more fabric-enabled switching modules, use the fabric switching-mode allow command. Use the no form of this command to disable truncated mode.

Bus mode--The switch uses this mode for traffic between nonfabric-enabled modules and for traffic between a nonfabric-enabled module and a fabric-enabled module. In this mode, all traffic passes between the local bus and the supervisor engine bus.

Truncated mode--The switch uses this mode for traffic between fabric-enabled modules when there are both fabric-enabled and nonfabric-enabled modules installed. In this mode, the switch sends a truncated version of the traffic (the first 64 bytes of the frame) over the switch fabric channel.

Compact mode--The switch uses this mode for all traffic when only fabric-enabled modules are installed. In this mode, a compact version of the DBus header is forwarded over the switch fabric channel, which provides the best possible performance.

To prevent use of nonfabric-enabled modules or to prevent fabric-enabled modules from using bus mode, enter the no fabric switching-mode allow bus-mode command.

The fabric switching-mode allow command affects switches configured with a minimum of two fabric-enabled modules.

You can enter the fabric switching-mode allow truncated command to unconditionally allow truncated mode.

You can enter the no fabric switching-mode allow truncated command to allow truncated mode if the threshold is met.

You can enter the no fabric switching-mode allow bus-mode command to prevent any module from running in bus-mode.

To return to the default truncated-mode threshold, enter the no fabric switching-mode allow truncated threshold command.

The valid value for mod is the threshold value.

Example:

This example shows how to specify truncated mode:

Router (config)# fabric switching-mode allow truncated

Misconceptions:

None

Related Commands:

None


Command:

hw-mod

Mode:

Router#

Syntax:

hw-mod module mod shutdown

Syntax Description:

mod Module to be shutdown

Command Description:

Use this command to shutdown switch module before removing it form the modular switch chassis.

Example:

The following is the command in use.

Router# hw-mod module 1 shutdown

Misconceptions:

None.

Related Commands

None.

© Cisco Systems, Inc. 2001, 2002


 Command:

login authentication

Mode:

Router(config-line)#

Syntax:

login authentication {default  | list-name}

no login authentication {default  | list-name}

Syntax Description:
default

Uses the default list created with the aaa authentication login command.

list-name

Uses the indicated list created with the aaa authentication login command.

Command Description:

To enable AAA authentication for logins, use the login authentication line configuration command. Use the no form of this command to either disable TACACS+ authentication for logins or to return to the default.

Usage Guidelines

This command is a per-line command used with AAA that specifies the name of a list of AAA authentication methods to try at login. If no list is specified, the default list is used (whether or not it is specified in the command line).

Caution If you use a list-name value that was not configured with the aaa authentication login command, you will disable login on this line.

Entering the no version of login authentication has the same effect as entering the command with the default keyword.

Before issuing this command, create a list of authentication processes by using the global configuration aaa authentication login command.

Example:

The following example specifies that the default AAA authentication is to be used on line 4:

Router(config)#line 4
Router(config-line)#login authentication default

The following example specifies that the AAA authentication list called list1 is to be used on line 7:

Router(config)#line 7
Router(config-line)#login authentication list1
Misconceptions:
None

Related Commands:
aaa authentication login


Command:

mac access-list extended

Mode:

Switch(config)#

Syntax:

mac access-list extended name

no mac access-list extended name

Syntax Description:

name Assign a name to the MAC extended ACL.

Command Description:

Use the mac access-list extended global configuration command to create an access control list (ACL) based on MAC addresses. Using this command changes the mode to extended MAC access-list configuration mode. Use the no form of this command to return to the default setting.

MAC-named extended ACLs are used with the mac access-group interface configuration command and class maps.

Example:

This example shows how to enter extended MAC access-list configuration mode and to create a MAC extended ACL named mac1:

Switch(config)# mac access-list extended mac1

Switch(config-ext-macl)#

This example shows how to delete the MAC extended ACL named mac1:

Switch(config)# no mac access-list extended mac1

You can verify your settings by entering the show access-lists privileged EXEC command.

Misconceptions:

None

Related Commands:

None


Command:

mac address-table static

Mode:

Switch(config)#

Syntax:

mac address-table static mac-addr vlan vlan-id interface interface-id

no mac address-table static mac-addr vlan vlan-id interface interface-id

Syntax Description:

mac-addr

Destination MAC address (unicast or multicast) to add to the address table. Packets with this destination address received in the specified VLAN are forwarded to the specified interface.

vlan vlan-id

Specify the VLAN for which the packet with the specified MAC address is received. Valid VLAN IDs are 1 to 4094 when the enhanced software image (EI) is installed and 1 to 1005 when the standard software image (SI) is installed.

interface interface-id

Interface to which the received packet is forwarded. Valid interfaces include physical ports and port channels.

Command Description:

Use the mac address-table static global configuration command to add static addresses to the MAC address table. Use the no form of this command to remove static entries from the MAC address table.

Note: Beginning with Release 12.1(11)EA1, the mac address-table static command replaces the mac-address-table static command (with the hyphen). The mac-address-table static command (with the hyphen) will become obsolete in a future release.

Example:

This example shows how to add the static address 0004.5600.67ab to the MAC address table:

Switch(config)# mac address-table static 0004.5600.67ab vlan 1 interface fastethernet0/2

This example shows how to add the static address c2f3.220a.12f4 to the MAC address table. When a packet is received in VLAN 4 with this MAC address as its destination, the packet is forwarded to the specified interface:

Switch(config)# mac address-table static c2f3.220a.12f4 vlan 4 interface gigabitethernet0/1

You can verify your settings by entering the show mac address-table privileged EXEC command.

Misconceptions:

None.

Related Commands:

clear mac address-table

mac address-table aging-time

show mac address-table

show mac address-table static


Command:

monitor session

Mode:

Switch(config)#

Syntax:

monitor session session_number {destination {interface interface-id [encapsulation {dot1q}] | remote vlan vlan-id reflector-port interface-id} | source {interface interface-id [, | -] [both | rx | tx ] | remote vlan vlan-id}}
no monitor session session_number {destination {interface interface-id [encapsulation {dot1q}] | remote vlan vlan-id reflector-port interface-id} | source {interface interface-id [, | -] [both | rx | tx ] | remote vlan vlan-id}}
no monitor session {session_number | all | local | remote}

Syntax Description:

session_number | Specify the session number identified with the SPAN or RSPAN session.
destination interface interface-id | Specify the destination interface for a local SPAN session. Valid interfaces are physical ports.
encapsulation | (Optional) Specify the encapsulation header for outgoing packets through a destination port. If encapsulation type is not specified, packets are sent in native form. To reconfigure a destination port in native form, enter the command without the encapsulation keyword.
dot1q | Specify the encapsulation type as 802.1Q.
destination remote vlan vlan-id | Specify the destination remote VLAN for an RSPAN source session.
reflector-port interface-id | Specify the reflector port used for a source RSPAN session.
source interface interface-id | Specify the SPAN source interface type, slot, and port number. Valid interfaces include physical ports and port channels.
, Note (Optional) Specify a series of interfaces, or separate a range of interfaces from a previous range. Enter a space after the comma.
- Note (Optional) Specify a range of interfaces. Enter a space before and after the hyphen.
both, rx, tx | (Optional) Specify the traffic direction for each source.
source remote vlan vlan-id | Specify the source RSPAN VLAN for an RSPAN destination session.
all, local, remote | Specify all, local, or remote to clear a SPAN or RSPAN session.

Command Description:

Use the monitor session global configuration command to start a new Switched Port Analyzer (SPAN) or Remote SPAN (RSPAN) session. Use the no form of this command to remove the SPAN or the RSPAN session or to remove source or destination interfaces from the SPAN or RSPAN session.

To use the RSPAN feature, you must have the enhanced software image (EI) installed on your switch.

On a source interface, the default is to monitor both received and transmitted traffic.

If encapsulation type is not specified on a destination port, packets are sent in native form with no encapsulation.

Traffic that enters or leaves source ports can be monitored by using SPAN or RSPAN. Traffic routed to source ports cannot be monitored.

You can configure (and store in NVRAM) one local SPAN session or multiple RSPAN sessions on a switch. The number of active sessions and combinations are subject to these restrictions:

SPAN or RSPAN source (rx, tx, both): one active session limit. (SPAN and RSPAN are mutually exclusive on a source switch).

RSPAN source sessions have one destination per session with an RSPAN VLAN associated for that session.

Each RSPAN destination session has one or more destination interfaces for each RSPAN VLAN that it supports.

RSPAN destination sessions are limited to two, or one if a local SPAN or a source RSPAN session is configured on the same switch.

You can monitor traffic on a single port or on a series or range of ports. You select a series or range of interfaces by using the [, | -] options.

If you specify a series of interfaces, you must enter a space after the comma. If you specify a range of interfaces, you must enter a space before and after the hyphen (-).

EtherChannel ports cannot be configured as SPAN or RSPAN destination or reflector ports. A physical port that is a member of an EtherChannel group can be used as a source or destination port. It cannot participate in the EtherChannel group while it is configured for SPAN or RSPAN.

A port used as a reflector port cannot be a SPAN or RSPAN source or destination port, nor can a port be a reflector port for more than one session at a time.

A port used as a destination port cannot be a SPAN or RSPAN source or reflector port, nor can a port be a destination port for more than one session at a time.

You can enable 802.1X on a port that is a SPAN or RSPAN destination port; however, 802.1X is disabled until the port is removed as a SPAN destination. (If 802.1X is not available on the port, the switch will return an error message.) You can enable 802.1X on a SPAN or RSPAN source port.

Example:

This example shows how to create SPAN session 1 to monitor both sent and received traffic on source interface 0/1 on destination interface 0/8:

Switch(config)#monitor session 1 source interface fastEthernet 0/1 both
Switch(config)#monitor session 1 destination interface fastEthernet 0/8

This example shows how to delete a destination port from an existing SPAN session:

Switch(config)# no monitor session 2 destination fastEthernet 0/1

This example shows how to configure RSPAN session 1 to monitor multiple source interfaces and to configure the destination RSPAN VLAN and the reflector-port.

Switch(config)# monitor session 1 source interface fastEthernet 0/10 tx
Switch(config)# monitor session 1 source interface fastEthernet 0/2 rx
Switch(config)# monitor session 1 source intierface port-channel 102 rx
Switch(config)# monitor session 1 destination remote vlan 901 reflector-port fastEthernet 0/1

Misconceptions:

None

Related Commands:

None


Command:

police

Mode:

Switch(config-pmap-c)#

Syntax:

police rate-bps burst-byte [exceed-action {drop | dscp dscp-value}]

no police rate-bps burst-byte [exceed-action {drop | dscp dscp-value}]

Syntax Description:

rate-bps | Specify average traffic rate in bits per second (bps). For 10/100 ports, the range is 1000000 to 100000000, and the granularity is 1 Mbps. For Gigabit-capable Ethernet ports, the range is 8000000 to 1016000000, and the granularity is 8 Mbps.
burst-byte | Specify the normal burst size in bytes. For 10/100 ports, the burst size values are 4096, 8192, 16384, 32768, and 65536. For Gigabit-capable Ethernet ports, the burst size values are 4096, 8192, 16384, 32768, 65536, 131072, 262144, and 524288.
exceed-action drop | (Optional) When the specified rate is exceeded, specify that the switch drops the packet.
exceed-action dscp dscp-value | (Optional) When the specified rate is exceeded, specify that the switch changes the Differentiated Services Code Point (DSCP) of the packet to the specified dscp-value and then sends the packet.

Command Description:

Use the police policy-map class configuration command to define a policer for classified traffic. Use the no form of this command to remove an existing policer.

You can configure up to six policers on ingress Fast Ethernet ports.

You can configure up to 60 policers on ingress Gigabit-capable Ethernet ports.

Policers cannot be configured on egress Fast Ethernet and Gigabit-capable Ethernet ports.

To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.

Example:

This example shows how to configure a policer that sets the DSCP value to 46 if traffic does not exceed a 1-Mbps average rate with a burst size of 65536 bytes and drops packets if traffic exceeds these conditions:

Switch(config)#policy-map policy1
Switch(config-pmap)#class class1
Switch(config-pmap-c)#set ip dscp 46
Switch(config-pmap-c)#police 1000000 65536 exceed-action drop
Switch(config-pmap-c)#exit

Misconceptions:

None.

Related Commands

policy-map

show policy-map

© Cisco Systems, Inc. 2001, 2002


 Command:

port group

Mode:

Switch(config-if)#

Syntax:

port group group-number [distribution {source | destination}]

no port group

Syntax Description:

group-number

Port group number to which the port belongs. The range is
from 1 to 6.

distribution {source | destination}

(Optional) Forwarding method for the port group.

  • source—Set the port to forward traffic to a port group based on the packet source address. This is the default forwarding method
  • destination—Set the port to forward traffic to a port group based on the packet destination address.

Command Description:

Use the port group interface configuration command to assign a port to a Fast EtherChannel or Gigabit EtherChannel port group. Up to six port groups can be created on a switch. Up to eight ports can belong to a source-based or destination-based port group. Use the no form of this command to remove a port from a port group.

The following restrictions apply for all ports:

  • Do not group Fast Ethernet and gigabit ports together.
  • No port group member can be configured for Switched Port Analyzer (SPAN) port monitoring.
  • No port group member can be enabled for port security.
  • You can create up to six port groups of all source-based, all destination-based, or a combination of source-based and destination-based port groups. A source-based port group can have up to eight ports in its group. A destination-based port group can also have only eight ports in its group. You cannot mix source-based and destination-based ports in the same group.
  • Port group members must belong to the same set of VLANs and must be all static-access or all trunk ports.

When a group is first formed, the switch automatically sets the following parameters to be the same on all ports:

  • VLAN membership of ports in the group
  • VLAN mode (static or trunk) of ports in the group
  • Encapsulation method of the trunk
  • Native VLAN configuration if the trunk uses IEEE 802.1Q
  • Allowed VLAN list configuration of the trunk port
  • Spanning Tree Protocol (STP) Port Fast option
  • STP port priority
  • STP path cost
  • Protected port

Configuration of the first port added to the group is used when setting the above parameters for other ports in the group. After a group is formed, changing any parameter in the above list changes the parameter on all other ports.

Use the distribution keyword to customize the port group to your particular environment. The forwarding method you choose depends on how your network is configured. However, source-based forwarding works best for most network configurations.

Example:

The following example shows how to add a port to a port group by using the default source-based forwarding:

Switch(config-if)#port group 1

The following example shows how to add a port to a group by using destination-based forwarding:

Switch(config-if)#port group 2 distribution destination

You can verify the previous commands by entering the show port group command in privileged EXEC mode.

Misconceptions:

None

Related Commands:
None


Command:

port secure  (Catalyst 1900)

Mode:

Switch(config-if)#

Syntax:

port secure [max-mac-count count]

no port secure [max-mac-count]

Syntax Description:

max-mac-count

Maximum number of addresses allowed on port.

count

Number from 1 to 132.

Default

The default is 132.

Command Description:

Use the port secure interface configuration command to enable addressing security. Use the no port secure command to disable addressing security or to set the maximum number of addresses allowed on the interface to the default value.

Example:

The following example shows how to set the maximum MAC address count to 100.

hostname(config-if)# port secure max-mac-count 100

The following example shows how to disable port security.

hostname(config-if)# no port secure

The following example shows how to set the MAC address count maximum to the default 132.

hostname(config-if)# no port secure max-mac-count

Misconceptions:

None.

Related Commands:

interface

port (block)

port secure (clear)

show (interfaces)

show (mac-address-table security).


 Command:

port security

Mode:

Switch(config-if)#

Syntax:

port security [action {shutdown | trap} | max-mac-count addresses]

no port security

Syntax Description:

action {shutdown | trap}

(Optional) Action to take when an address violation occurs on this port.

  • shutdown—Disable the port when a security violation occurs.
  • trap—Generate an SNMP trap when a security violation occurs

max-mac-count addresses

(Optional) The maximum number of secure addresses that this port can support. The range is from 1 to 132.

Command Description:

Use the port security interface configuration command to enable port security on a port and restrict the use of the port to a user-defined group of stations. Use the no form of this command to return the port to its default value.

If you specify trap, use the snmp-server host command to configure the SNMP trap host to receive traps.

The following restrictions apply to secure ports:

  • A secure port cannot belong to a Fast EtherChannel or Gigabit EtherChannel port group.
  • A secure port cannot have Switched Port Analyzer (SPAN) port monitoring enabled on it.
  • A secure port cannot be a dynamic-access port or a trunk port.

Example:

The following example shows how to enable port security and what action the port takes in case of an address violation (shutdown).

Switch(config-if)#port security action shutdown

The following example shows how to set the maximum number of addresses that the port can learn to 8.

Switch(config-if)#port security max-mac-count 8

You can verify the previous commands by entering the show port security command in privileged EXEC mode.

Misconceptions:

None

Related Commands:
None


 Command:

spanning-tree

Mode:

Switch(config)#

Syntax:

spanning-tree [vlan stp-list]

no spanning-tree [vlan stp-list]

Syntax Description:

vlan stp-list

(Optional) List of spanning-tree instances. Each spanning-tree instance is
associated with a VLAN ID. Valid IDs are from 1 to 1001. Enter each VLAN ID separated by a space. Do not enter leading zeroes. Ranges are not supported.

Command Description:

Use the spanning-tree global configuration command to enable Spanning Tree Protocol (STP) on a VLAN. Use the no form of the command to disable STP on a VLAN.

Disabling STP causes the VLAN or list of VLANs to stop participating in STP. Ports that are administratively down remain down. Received Bridge Protocol Data Units (BPDUs) are forwarded like other multicast frames. The VLAN does not detect and prevent loops when STP is disabled.

You can disable STP on a VLAN that is not currently active, and verify the change by using the privileged EXEC show running-config or the show spanning-tree vlan stp-list command. The setting takes effect when the VLAN is activated.

If the variable stp-list is omitted, the command applies to the STP instance associated with VLAN 1.

You can enable STP on a VLAN that has no ports assigned to it.
Example:

The following example shows how to disable STP on VLAN 5:

Switch(config)#no spanning-tree vlan 5

You can verify the previous command by entering the show spanning-tree command in privileged EXEC mode. In this instance, VLAN 5 does not appear in the list.
Misconceptions:
For 2950 series of switches.

Related commands:
show spanning-tree
spanning-tree forward-time
spanning-tree port-priority


 Command:

spanning-tree cost

Mode:

Switch(config-if)#

Syntax:

spanning-tree [vlan stp-list] cost cost

no spanning-tree [vlan stp-list] cost

Syntax Description:

vlan stp-list

(Optional) List of spanning-tree instances. Each spanning-tree instance is associated with a VLAN ID. Valid IDs are from 1 to 1001. Enter each VLAN ID separated by a space. Do not enter leading zeroes. Ranges are not supported.

cost

Path cost can range from 1 to 65535, with higher values indicating higher costs. This range applies whether or not the IEEE STP has been specified

Command Description:

Use the spanning-tree cost interface configuration command to set the path cost for Spanning Tree Protocol (STP) calculations. In the event of a loop, spanning tree considers the path cost when selecting an interface to place into the forwarding state. Use the no form of this command to return to the default value.

If the variable stp-list is omitted, the command applies to the STP instance associated with VLAN 1.

You can set a cost for a port or on a VLAN that does not exist. The setting takes effect when the VLAN exists.
Example:

The following example shows how to set a path cost value of 64 for VLAN 1:

Switch(config-if)#spanning-tree vlan 1 cost 64

You can verify the previous command by entering the show spanning-tree command in privileged EXEC mode.
Misconceptions:
None

Related commands:
show spanning-tree
spanning-tree portfast
spanning-tree priority


 Command:

spanning-tree forward-time

Mode:

Switch(config)#

Syntax:

spanning-tree [vlan stp-list] forward-time seconds

no spanning-tree [vlan stp-list] forward-time

Syntax Description:

vlan stp-list

(Optional) List of spanning-tree instances. Each spanning-tree instance is associated with a VLAN ID. Valid IDs are from 1 to 1001. Enter each VLAN ID separated by a space. Do not enter leading zeroes. Ranges are not supported.

seconds

Forward-delay interval from 4 to 200 seconds.

Command Description:

Use the spanning-tree forward-time global configuration command to set the forwarding-time for the specified spanning-tree instances. The forwarding time determines how long each of the listening and learning states last before the port begins forwarding. Use the no form of this command to return to the default value.

If the variable stp-list is omitted, the command applies to the STP instance associated with VLAN 1.

You can set the forwarding-time on a VLAN that has no ports assigned to it. The setting takes effect when you assign ports to it.
Example:

The following example shows how to set the spanning-tree forwarding time to 18 seconds for VLAN 20:

Switch(config)#spanning-tree vlan 20 forward-time 18

You can verify the previous command by entering the show spanning-tree command in privileged EXEC mode.
Misconceptions:
None

Related commands:
show spanning-tree
spanning-tree port-priority


 Command:

spanning-tree hello-time

Mode:

Switch(config)#

Syntax:

spanning-tree [vlan stp-list] hello-time seconds

no spanning-tree [vlan stp-list] hello-time

Syntax Description:

vlan stp-list

(Optional) List of spanning-tree instances. Each spanning-tree instance is associated with a VLAN ID. Valid IDs are from 1 to 1001. Enter each VLAN ID separated by a space. Do not enter leading zeroes. Ranges are not supported.

seconds

Interval from 1 to 10 seconds.

Command Description:

Use the spanning-tree hello-time global configuration command to specify the interval between hello Bridge Protocol Data Units (BPDUs). Use the no form of this command to return to the default interval.

If the variable stp-list is omitted, the command applies to the STP instance associated with VLAN 1.

You can set the hello time on a VLAN that has no ports assigned to it. The setting takes effect when you assign ports to it.
Example:

The following example shows how to set the spanning-tree hello-delay time to 3 seconds for VLAN 20:

Switch(config)#spanning-tree vlan 20 hello-time 3

You can verify the previous command by entering the show spanning-tree command in privileged EXEC mode.
Misconceptions:
None

Related commands:
show spanning-tree
spanning-tree
spanning-tree port-priority


 Command:

spanning-tree max-age

Mode:

Switch(config)#

Syntax:

spanning-tree [vlan stp-list] max-age seconds

no spanning-tree [vlan stp-list] max-age

Syntax Description:

vlan stp-list

(Optional) List of spanning-tree instances. Each spanning-tree instance is associated with a VLAN ID. Valid IDs are from 1 to 1001. Enter each VLAN ID separated by a space. Do not enter leading zeroes. Ranges are not supported.

seconds

Interval the switch waits between receiving BPDUs from the root switch.
Enter a number from 6 to 200.

Command Description:

Use the spanning-tree max-age global configuration command to change the interval between messages the spanning tree receives from the root switch. If a switch does not receive a Bridge Protocol Data Unit (BPDU) message from the root switch within this interval, it recomputes the Spanning Tree Protocol (STP) topology. Use the no form of this command to return to the default interval.

The max-age setting must be greater than the hello-time setting.

If the variable stp-list is omitted, the command applies to the STP instance associated with VLAN 1.

You can set the max-age on a VLAN that has no ports assigned to it. The setting takes effect when you assign ports to the VLAN.
Examples:

The following example shows how to set spanning-tree max-age to 30 seconds for VLAN 20:

Switch(config)#spanning-tree vlan 20 max-age 30

The following example shows how to reset the max-age parameter to the default value for spanning-tree instances 100 through 102:

Switch(config)#no spanning-tree vlan 100 101 102 max-age

You can verify the previous commands by entering the show spanning-tree command in privileged EXEC mode.
Misconceptions:
None

Related commands:
show spanning-tree
spanning-tree forward-time
spanning-tree hello-time
spanning-tree port-priority


 Command:

spanning-tree portfast

Mode:

Switch(config-if)#

Syntax:

spanning-tree portfast

no spanning-tree portfast

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the spanning-tree portfast interface configuration command to enable the Port Fast feature on a port in all its associated VLANs. When the Port Fast feature is enabled, the port changes directly from a blocking state to a forwarding state without making the intermediate Spanning Tree Protocol (STP) status changes. Use the no form of this command to return the port to default operation.

Use this feature only on ports that connect to end stations.

This feature affects all VLANs on the port.

A port with the Port Fast feature enabled is moved directly to the spanning-tree forwarding state.
Example:

The following example shows how to enable the Port Fast feature.

Switch(config-if)#spanning-tree portfast

You can verify the previous commands by entering the show running-config in privilege EXEC mode.
Misconceptions:
None

Related commands:
show spanning-tree
spanning-tree port-priority


 Command:

spanning-tree port-priority

Mode:

Switch(config-if)#

Syntax:

spanning-tree [vlan stp-list] port-priority port-priority

no spanning-tree [vlan stp-list] port-priority

Syntax Description:

vlan stp-list

(Optional) List of spanning-tree instances. Each spanning-tree instance is
associated with a VLAN ID. Valid IDs are from 1 to 1001. Enter each VLAN ID
separated by a space. Do not enter leading zeroes. Ranges are not supported.

port-priority

Number from 0 to 255. The lower the number, the higher the priority.

Command Description:

Use the spanning-tree port-priority interface configuration command to configure a port priority, which is used when two switches tie for position as the root switch. Use the no form of this command to return to the default value.

If the variable stp-list is omitted, the command applies to the STP instance associated with VLAN 1.

You can set the port priority on a VLAN that has no ports assigned to it. The setting takes effect when you assign ports to the VLAN.
Example:

The following example shows how to increase the likelihood that the spanning-tree instance 20 is chosen as the root switch on port fa0/2:

Switch(config)#interface fa0/2

Switch(config-if)#spanning-tree vlan 20 port-priority 0

You can verify the previous commands by entering the show spanning-tree command in privileged EXEC mode.
Misconceptions:
None

Related commands:
show spanning-tree


 Command:

spanning-tree priority

Mode:

Switch(config)#

Syntax:

spanning-tree [vlan stp-list] priority bridge-priority

no spanning-tree [vlan stp-list] priority

Syntax Description:

vlan stp-list

(Optional) List of spanning-tree instances. Each spanning-tree instance is associated with a VLAN ID. Valid IDs are from 1 to 1001. Enter each VLAN ID separated by a space. Do not enter leading zeroes. Ranges are not supported.

bridge-priority

A number from 0 to 65535. The lower the number, the more likely the switch will be chosen as root.

Command Description:

Use the spanning-tree priority global configuration command to configure the switch priority for the specified spanning-tree instance. This changes the likelihood that the switch is selected as the root switch. Use the no form of this command to revert to the default value.

If the variable stp-list is omitted, the command applies to the STP instance associated with VLAN 1.

You can configure the switch priority on a VLAN that has no ports assigned to it. The setting takes effect when you assign ports to the VLAN.
Example:

The following example shows how to set the spanning-tree priority to 125 for a list of VLANs:

Switch(config)#spanning-tree vlan 20 100 101 102 priority 125

You can verify the previous command by entering the show spanning-tree command in privileged EXEC mode.
Misconceptions:
None

Related commands:
show spanning-tree
spanning-tree forward-time
spanning-tree hello-time


 Command:

spanning-tree uplinkfast

Mode:

Switch(config)#

Syntax:

spanning-tree uplinkfast [max-update-rate pkts-per-second]

no spanning-tree uplinkfast [max-update-rate pkts-per-second]

Syntax Description:

max-update-rate pkts-per-second

The number of packets per second at which stations address update packets are sent. The range is 0 to 1000.

Command Description:

Use the spanning-tree uplinkfast global configuration command to accelerate the choice of a new root port when a link or switch fails or when Spanning Tree Protocol (STP) reconfigures itself. Use the no form of this command to return to the default value.

When you enable UplinkFast, it is enabled for the entire switch and cannot be enabled for individual VLANs.

When you enable UplinkFast, the bridge priority of all VLANs is set to 49152, and the path cost of all ports and VLAN trunks is increased by 3000. This change reduces the chance that the switch will become the root switch.

When you disable UplinkFast, the bridge priorities of all VLANs and path costs are set to their default values.

Do not enable the root guard on ports that will be used by the UplinkFast feature. With UplinkFast, the backup ports (in the blocked state) replace the root port in the case of a failure. However, if root guard is also enabled, all the backup ports used by the UplinkFast feature are placed in the root-inconsistent state (blocked) and prevented from reaching the forwarding state.
Example:

The following command shows how to enable UplinkFast:

Switch(config)#spanning-tree uplinkfast

You can verify the previous command by entering the show spanning-tree command in privileged EXEC mode.
Misconceptions:
None

Related commands:
show spanning-tree


Command:

spanning-tree vlan

Mode:

Switch(config)#

Syntax:

spanning-tree vlan vlan-id {forward-time seconds | hello-time seconds | max-age seconds | priority priority | {root {primary | secondary} [diameter net-diameter [hello-time seconds]]}}

no spanning-tree vlan vlan-id [forward-time | hello-time | max-age | priority | root]

Syntax Description:

vlan-id | VLAN range associated with a spanning-tree instance. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094 when the enhanced software image (EI) is installed and 1 to 1005 when the standard software image (SI) is installed.
forward-time seconds | Set the forward-delay time for the specified spanning-tree instance. The forwarding time determines how long each of the listening and learning states last before the interface begins forwarding. The range is 4 to 30 seconds.
hello-time seconds | Set the interval between hello bridge protocol data units (BPDUs) sent by the root switch configuration messages. The range is 1 to 10 seconds.
max-age seconds | Set the interval between messages the spanning tree receives from the root switch. If a switch does not receive a BPDU message from the root switch within this interval, it recomputes the spanning-tree topology. The range is 6 to 40 seconds.
priority priority | Set the switch priority for the specified spanning-tree instance. This setting affects the likelihood that the switch is selected as the root switch. A lower value increases the probability that the switch is selected as the root switch. The range is 0 to 61440 in increments of 4096. Valid priority values are 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440. All other values are rejected.
root primary | Force this switch to be the root switch.
root secondary | Set this switch to be the root switch should the primary root switch fail.
diameter net-diameter | Set the maximum number of switches between any two end stations. The range is 2 to 7.

Command Description:

Use the spanning-tree vlan global configuration command to configure spanning tree on a per-VLAN basis. Use the no form of this command to return to the default setting.

Disabling the STP causes the VLAN to stop participating in the spanning-tree topology. Interfaces that are administratively down remain down. Received BPDUs are forwarded like other multicast frames. The switch does not detect and prevent loops in a VLAN if STP is disabled for that VLAN.

You can disable the STP on a VLAN that is not currently active and verify the change by using the show running-config or the show spanning-tree vlan vlan-id privileged EXEC command. The setting takes effect when the VLAN is activated.

When disabling or re-enabling the STP, you can specify a range of VLANs that you want to disable or enable.

When the STP is disabled and then enabled, all assigned VLANs continue to be its members. However, all spanning-tree bridge parameters are returned to their previous settings (the last setting before the VLAN was disabled).

You can enable spanning-tree options on a VLAN that has no interfaces assigned to it. The setting takes effect when you assign interfaces to it.

When setting the max-age seconds, if a switch does not receive BPDUs from the root switch within the specified interval, it recomputes the spanning-tree topology. The max-age setting must be greater than the hello-time setting.

The spanning-tree vlan vlan-id root command should be used only on backbone switches.

When you enter the spanning-tree vlan vlan-id root command, the software checks the switch priority of the current root switch for each VLAN. Because of the extended system ID support, the switch sets the switch priority for the specified VLAN to 24576 if this value will cause this switch to become the root for the specified VLAN. If any root switch for the specified VLAN has a switch priority lower than 24576, the switch sets its own priority for the specified VLAN to 4096 less than the lowest switch priority. (4096 is the value of the least-significant bit of a 4-bit switch priority value.)

When you enter the spanning-tree vlan vlan-id root primary command, the switch recalculates the forward-time, hello-time, max-age, and priority settings. If you previously configured these parameters, the switch overrides and recalculates them.

When you enter the spanning-tree vlan vlan-id root secondary command, because of support for the extended system ID, the software changes the switch priority from the default value (32768) to 28672. If the root switch should fail, this switch becomes the next root switch (if the other switches in the network use the default switch priority of 32768, and therefore, are unlikely to become the root switch).

Example:

This example shows how to disable the STP on VLAN 5:

Switch(config)#no spanning-tree vlan 5
You can verify your setting by entering the show spanning-tree privileged EXEC command. In this instance, VLAN 5 does not appear in the list.

This example shows how to set the spanning-tree forwarding time to 18 seconds for VLANs 20 and 25:

Switch(config)#spanning-tree vlan 20,25 forward-time 18
This example shows how to set the spanning-tree hello-delay time to 3 seconds for VLANs 20 to 24:

Switch(config)#spanning-tree vlan 20-24 hello-time 3
This example shows how to set spanning-tree max-age to 30 seconds for VLAN 20:

Switch(config)#spanning-tree vlan 20 max-age 30
This example shows how to reset the max-age parameter to the default value for spanning-tree instances 100 and 105 to 108 :

Switch(config)#no spanning-tree vlan 100,105-108 max-age
This example shows how to set the spanning-tree priority to 8192 for VLAN 20:

Switch(config)#spanning-tree vlan 20 priority 8192
This example shows how to configure the switch as the root switch for VLAN 10 with a network diameter of 4:

Switch(config)#spanning-tree vlan 10 root primary diameter 4
This example shows how to configure the switch as the secondary root switch for VLAN 10 with a network diameter of 4:

Switch(config)#spanning-tree vlan 10 root secondary diameter 4
You can verify your settings by entering the show spanning-tree vlan vlan-id privileged EXEC command.

Misconceptions:

None.

Related Commands:

spanning-tree cost
spanning-tree portfast
spanning-tree uplinkfast

© Cisco Systems, Inc. 2001, 2002


 Command:

spantree

Mode:

Switch(config)#

Syntax:

spantree {[bridge-group bridge-group...] | [vlan vlan-list...]}

no spantree {[bridge-group bridge-group...] | [vlan vlan-list...]}

Syntax Description:

bridge-group

Up to four numbers between 1 and 4 (separated by spaces).

vlan-list

Up to ten numbers specified by values between 1 and 1005 (separated by spaces).

Command Description:

Use the spantree global configuration command to enable the Spanning-Tree Protocol (STP) on up to four bridge groups or up to ten VLANs. Use the no spantree command to disable STP for the specified bridge groups or for the specified VLANs.

Examples:

This example shows how to disable STP on bridge group 4 and bridge group 2:

hostname(config)#no spantree bridge-group 4 2

This example shows how to enable STP for VLAN 16, 24, and 30:

hostname(config)#spantree vlan 16 24 30
Misconceptions:
For 1900 and 2820 series of switches.

Related commands:

None


 Command:

speed

Mode:

Switch(config-if)#

Syntax:

speed {10 | 100 | auto}

no speed

Syntax Description:

10

Configures the interface to transmit at 10 Mbps.

100

Configures the interface to transmit at 100 Mbps.

auto

Turns on the Fast Ethernet auto-negotiation capability. The interface automatically operates at 10 or 100 Mbps depending on environmental factors, such as the type of media and transmission speeds for the peer routers, hubs, and switches used in the network configuration.

Command Description:

To configure the speed for a Fast Ethernet interface, use the speed interface configuration command. Use the no form of this command to disable a speed setting.

The auto negotiation capability is turned on for the Fast Ethernet interface by either configuring the speed auto interface configuration command or the duplex auto interface configuration command.

Table describes the system's performance for different combinations of the duplex and speed modes. The specified duplex command configured with the specified speed command produces the resulting system action.

Table: Relationship between Duplex and Speed Commands
Duplex Command Speed Command Resulting System Action

duplex auto

speed auto

Auto negotiates both speed and duplex modes.

duplex auto

speed 100 or speed 10

Auto negotiates both speed and duplex modes.

duplex half or duplex full

speed auto

Auto negotiates both speed and duplex modes.

duplex half

speed 10

Forces 10 Mbps and half duplex.

duplex full

speed 10

Forces 10 Mbps and full duplex.

duplex half

speed 100

Forces 100 Mbps and half duplex.

duplex full

speed 100

Forces 100 Mbps and full duplex.

Example:

The following example shows the configuration options for the speed command:

switch#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.
switch(config)# interface fastethernet 0
switch(config-if)# speed ?

  10    Force 10 Mbps operation
  100   Force 100 Mbps operation
  auto  Enable AUTO speed configuration

Misconceptions:
None

Related commands:
duplex


 Command:

switchport access

Mode:

Switch(config-if)#

Syntax:

switchport access vlan {vlan-id | dynamic}

no switchport access

Syntax Description:

access vlan vlan-id

Configure the interface as a static-access port; valid values are from 1 to 1005.

access vlan dynamic

Specify that the access mode VLAN is dependent on the VLAN Membership Policy Server (VMPS) protocol. The port is assigned to a VLAN based on the source MAC address of a host (or hosts) connected to the port. The switch sends every new MAC address received to the VMPS server to obtain the VLAN name to which the dynamic-access port should be assigned. If the port already has a VLAN assigned and the source has already been approved by the VMPS, the switch forwards the packet to the VLAN.

Command Description:

Use the switchport access interface configuration command to configure a port as a static-access or dynamic-access port. If the mode is set to access, the port operates as a member of the configured VLAN. If set to dynamic, the port starts discovery of its VLAN assignment based on the incoming packets it receives. Use the no form of this command to reset the access mode to the default VLAN for the switch.

The no switchport access command resets the access mode VLAN to the appropriate default VLAN for the device.

The port must be in access mode before the switchport access vlan command can take effect. For more information, see the switchport mode command.

An access port can be assigned to only one VLAN.

The VMPS server (such as a Catalyst 6000 series switch) must be configured before a port is configured as dynamic.

These restrictions apply to dynamic-access ports:

  • The software implements the VLAN Query Protocol (VQP) client, which can query a VMPS such as a Catalyst 6000 series switch. The Catalyst 3550 switches are not VMPS servers. The VMPS server must be configured before a port is configured as dynamic.
  • Use dynamic-access ports only to connect end stations. Connecting them to switches or routers that use bridging protocols can cause a loss of connectivity.
  • Configure the network so that Spanning Tree Protocol (STP) does not put the dynamic-access port in an STP blocking state. The Port Fast feature is automatically enabled on dynamic-access ports.
  • Dynamic-access ports can only be in one VLAN and do not use VLAN tagging.
  • Dynamic-access ports cannot be configured as:
    • Members of an EtherChannel port group (dynamic-access ports cannot be grouped with any other port, including other dynamic ports).
    • Source or destination ports in a static address entry.
    • Monitor ports.
Example:

This example shows how to assign a port already in access mode to VLAN 2 (instead of the default VLAN 1):

Switch(config-if)#switchport access vlan 2

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command and examining information in the Administrative Mode and Operational Mode rows.
Misconceptions:
None

Related commands:
switchport mode
show interface


Command:

switchport block multicast

Mode:

Switch#

Syntax:

switchport block multicast

no switchport block mulitcast

Syntax Description:

This command has no arguments or keywords.

Command Description:

Block unknown multicast forwarding to the port.

Example:

The following is the switchport block mulitcast command:

Router# switchport block mulitcast

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

switchport block unicast

Mode:

Switch#

Syntax:

switchport block unicast

no switchport block unicast

Syntax Description:

This command has no arguments or keywords.

Command Description:

Block unknown unicast forwarding to the port.

Example:

The following is the switchport block unicast command:

Router# switchport block unicast

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

switchport mode

Mode:

Switch(config-if)#

Syntax:

switchport mode {access | trunk}

no switchport mode {access | trunk}

Syntax Description:

access | Set the port to access mode (static-access). The port operates as a nontrunking, single VLAN interface that transmits and receives nonencapsulated frames. An access port can be assigned to only one VLAN.
trunk | Set the port to a trunking VLAN Layer-2 interface. The port transmits and receives encapsulated (tagged) frames that identify the VLAN of origination. A trunk is a point-to-point link between two switches or between a switch and a router.

Command Description:

Use the switchport mode interface configuration command to configure the VLAN membership mode of a port. Use the no form of this command to reset the mode to the appropriate default for the device.

Configuration by using the access or trunk keywords takes affect only when the port is changed to the corresponding mode by using the switchport mode command. The static-access and trunk configurations are saved, but only one configuration is active at a time.

The no switchport mode form resets the mode to static access.

Examples:

The following example shows how to configure a port for access mode:

Switch(config-if)#switchport mode access

The following example shows how to configure a port for trunk mode:

Switch(config-if)#switchport mode trunk

Misconceptions:

None

Related commands:

None


Command:

switchport nonegotiate

Mode:

Switch(config-if)#

Syntax:

switchport nonegotiate

no switchport nonegotiate

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the switchport nonegotiate interface configuration command to specify that Dynamic Trunking Protocol (DTP) negotiation packets are not sent on the Layer 2 interface. The switch does not engage in DTP negotiation on this interface. Use the no form of this command to return to the default setting.

The no form of the switchport nonegotiate command removes nonegotiate status.

This command is valid only when the interface switchport mode is access or trunk (configured by using the switchport mode access or the switchport mode trunk interface configuration command). This command returns an error if you attempt to execute it in dynamic (auto or desirable) mode.

Internetworking devices that do not support DTP might forward DTP frames improperly and cause misconfigurations. To avoid this, you should turn off DTP by using the switchport nonegotiate command to configure the interfaces connected to devices that do not support DTP to not forward DTP frames.

When you enter the switchport nonegotiate command, DTP negotiation packets are not sent on the interface. The device does or does not trunk according to the mode parameter given: access or trunk.

If you do not intend to trunk across those links, use the switchport mode access interface configuration command to disable trunking.

To enable trunking ona device that does not support DTP, use the switchport mode trunk and switchport nonegotiate interface configuration commands to cause the interface to become a trunk but to not generate DTP frames.

Example:

This example shows how to cause an interface to refrain from negotiating trunking mode and to act as a trunk or access port (depending on the mode set):

Switch(config-if)# switchport nonegotiate

Misconceptions:

On GigaStack GBICs, dynamic trunking is supported only when one port of a GigaStack GBIC is being used. If trunking is required on a GigaStack GBIC where both ports are in use, use the switchport mode trunk and switchport nonegotiate interface configuration commands on both GBIC interfaces to cause the interfaces to become trunks.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


Command:

switchport port-secure

Mode:

Switch(config-if)#

Syntax:

switchport port-security [mac-addressmac-address] | [mac-address sticky [mac-address]] | [maximum value] | [violation {protect | restrict | shutdown}]

no switchport port-security [mac-address mac-address] | [mac-address sticky [mac-address]] | [maximum value] | [violation {protect | restrict | shutdown}]

Syntax Description:

mac-address mac-address

(Optional) Specify a secure MAC address for the port by entering a 48-bit MAC address. You can add additional secure MAC addresses up to the maximum value configured.

mac-address sticky [mac-address]

(Optional) Enable the interface for sticky learning by entering only the mac-address sticky keywords. When sticky learning is enabled, the interface adds all secure MAC addresses that are dynamically learned to the running configuration and converts these addresses to sticky secure MAC addresses.

Specify a sticky secure MAC address by entering the mac-address sticky mac-address keywords.

Note Although you can specify a sticky secure MAC address by entering the mac-address sticky mac-address keywords, we recommend using the mac-address mac-address interface configuration command to enter static secure MAC addresses.

maximum value

(Optional) Set the maximum number of secure MAC addresses for the interface. The range is from 1 to 132. The default is 1.

violation

(Optional) Set the security violation mode or the action to be taken if port security is violated. The default is shutdown.

protect

(Optional) Set the security violation protect mode. When the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. You are not notified that a security violation has occurred.

restrict

(Optional) Set the security violation restrict mode. When the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. In this mode, you are notified that a security violation has occurred. Specifically, an SNMP trap is sent, a syslog message is logged, and the violation counter increments.

shutdown

(Optional) Set the security violation shutdown mode. In this mode, a port security violation causes the interface to immediately become error-disabled and turns off the port LED. It also sends an SNMP trap, logs a syslog message, and increments the violation counter. When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.

Defaults

Port security is disabled.

When port security is enabled, if no keywords are entered, the default maximum number of secure MAC addresses is 1.

Sticky learning is disabled.

The default violation mode is shutdown.

Command Description:

Use the switchport port-security interface configuration command without keywords to enable port security on an interface. Use the keywords to configure secure MAC addresses, a maximum number of secure MAC addresses, or the violation mode. Use the no form of this command to disable port security or to set the parameters to their default states.

A secure port can have from 1 to 132 associated secure addresses. The total number of available secure addresses on the switch is 1024.

After you have set the maximum number of secure MAC addresses allowed on a port, you can add secure addresses to the address table by manually configuring them, by allowing the port to dynamically configure them, or by configuring some MAC addresses and allowing the rest to be dynamically configured.

You can delete dynamic secure MAC addresses from the address table by entering the clear port-security dynamic privileged EXEC command.

You can enable sticky learning on an interface by using the switchport port-security mac-address sticky interface configuration command. When you enter this command, the interface converts all the dynamic secure MAC addresses, including those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses. It adds all the sticky secure MAC addresses to the running configuration.

You can delete a sticky secure MAC addresses from the address table by using the clear port-security sticky mac-addr privileged EXEC command. To delete all the sticky addresses on an interface, use the clear port-security sticky interface-id privileged EXEC command.

If you disable sticky learning, the sticky secure MAC addresses are converted to dynamic secure addresses and are removed from the running configuration.

If you save the sticky secure MAC addresses in the configuration file, when the switch restarts or the interface shuts down, the interface does not need to relearn these addresses. If you do not save the configuration, they are lost.

If you specify restrict or shutdown, use the snmp-server host global configuration command to configure the Simple Network Management Protocol (SNMP) trap host to receive traps.

It is a security violation when one of these situations occurs:

· The maximum number of secure MAC addresses have been added to the address table, and a station whose MAC address is not in the address table attempts to access the interface.

· An address learned or configured on one secure interface is seen on another secure interface in the same VLAN.

When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.

A secure port has these limitations:

· Port security can only be configured on static access ports.

· A secure port cannot be a dynamic port, a dynamic access port or a trunk port.

· A secure port cannot be a destination port for Switched Port Analyzer (SPAN).

· A secure port cannot belong to a Fast EtherChannel or Gigabit EtherChannel port group.

· You cannot configure static secure or sticky secure MAC addresses on a voice VLAN.

· When you enable port security on an interface that is also configured with a voice VLAN, you must set the maximum allowed secure addresses on the port to at least two. If any type of port security is enabled on the access VLAN, dynamic port security is automatically enabled on the voice VLAN. You cannot configure port security on a per-VLAN basis.

· When a voice VLAN is configured on a secure port that is also configured as a sticky secure port, all addresses detected on the voice VLAN are learned as dynamic secure addresses while all addresses detected on the access VLAN (to which the port belongs) are learned as sticky secure addresses.

· To enable port security on an 802.1X port, you must first enable the 802.1X multiple-hosts mode on the port (for switches running the EI software).

· The switch does not support port security aging of sticky secure MAC addresses.

Example:

This example shows how to enable port security:

Switch(config-if)#switchport port-security

This example shows how to set the action that the port takes when an address violation occurs:

Switch(config-if)#switchport port-security violation shutdown

This example shows how to set the maximum number of addresses that a port can learn to 20.

Switch(config-if)#switchport port-security maximum 20

This example shows how to enable sticky learning and to enter two sticky secure MAC addresses:

Switch(config-if)#switchport port-security mac-address sticky
Switch(config-if)#switchport port-security mac-address sticky0000.0000.4141
Switch(config-if)#switchport port-security mac-address sticky 0000.0000.000f

You can verify your settings by entering the show port-security privileged EXEC command.

Misconceptions:

None.

Related Commands:

clear port-security dynamic
clear port-security sticky
show port-security


 Command:

switchport trunk allowed vlan

Mode:

Switch(config-if)#

Syntax:

switchport trunk allowed vlan {add vlan-list | all | except vlan-list | remove vlan-list}

no switchport trunk allowed vlan

Syntax Description:

add vlan-list

List of VLAN IDs to add. Valid IDs are from 1 to 1001. Separate nonconsecutive VLAN IDs with a comma and no spaces; use a hyphen to designate a range of IDs. Do not enter leading zeroes.

all

Add all VLAN IDs to the list.

except vlan-list

List of exception VLAN IDs VLANs are added except the ones specified. Valid IDs are from 1 to 1001. Separate nonconsecutive VLAN IDs with a comma and no spaces; use a hyphen to designate a range of IDs. Do not enter leading zeroes.

remove vlan-list

List of VLAN IDs to remove. Valid IDs are from 1 to 1001. Separate nonconsecutive VLAN IDs with a comma and no spaces; use a hyphen to designate a range of IDs. Do not enter leading zeroes.

Command Description:

Use the switchport trunk allowed vlan interface configuration command to control which VLANs can receive and transmit traffic on the trunk. Use the no form of this command to reset the allowed list to the default value.

When the no switchport trunk allowed vlan form is used, the allowed list is reset to the default list, which includes all VLANs.

In the variable vlan-list, separate nonconsecutive VLAN IDs with a comma; use a hyphen to designate a range of IDs. You cannot remove VLAN 1 or 1002 to 1005 from the list.

A trunk port cannot be a secure port or a monitor port. However, a static-access port can monitor a VLAN on a trunk port. The VLAN monitored is the one associated with the static-access port.
Example:

The following example shows how to add VLANs 1, 2, 5, and 6 to the allowed list:

Switch(config-if)#switchport trunk allowed vlan add 1,2,5,6
You can verify the previous command by entering the show interface interface-id switchport command in privileged EXEC mode.

Misconceptions:

None

Related commands:
switchport mode


 Command:

switchport trunk pruning

Mode:

Switch(config-if)#

Syntax:

switchport trunk pruning vlan {add vlan-list | all | except vlan-list | remove vlan-list}

no switchport trunk pruning

Syntax Description:

add vlan-list

List of VLAN IDs to add. Valid IDs are from 2 to 1001. Separate nonconsecutive VLAN IDs with a comma and no spaces; use a hyphen to designate a range of IDs. Do not enter leading zeroes.

all

Add all VLAN IDs to the list.

except vlan-list

List of exception VLAN IDs (VLANs are added except the specified ones). Valid IDs are from 2 to 1001. Separate nonconsecutive VLAN IDs with a comma and no spaces; use a hyphen to designate a range of IDs. Do not enter leading zeroes.

remove vlan-list

List of VLAN IDs to remove. Valid IDs are from 2 to 1001. Separate nonconsecutive VLAN IDs with a comma and no spaces; use a hyphen to designate a range of IDs. Do not enter leading zeroes.

no

Set the pruning list to the default.

Command Description:

Use the switchport trunk pruning interface configuration command to configure the VLAN pruning-eligible list for ports in trunking mode. Use the no form of this command to return the pruning list to the default setting. The pruning-eligible list applies only to trunk ports. Each trunk port has its own eligibility list. If you do not want a VLAN to be pruned, remove it from the pruning-eligible list. VLANs that are pruning-ineligible receive flooded traffic.

Example:

The following example shows how to remove VLANs 3 and 10-15 from the pruning-eligible list:

Switch(config-if)#switchport trunk pruning vlan remove 3,10-15

You can verify the previous command by entering the show interface interface-id switchport command in privileged EXEC mode.
Misconceptions:
None

Related commands:
vtp pruning


 Command:

switchport trunk

Mode:

Switch(config-if)#

Syntax:

switchport trunk encapsulation {isl | dot1q}

no switchport trunk encapsulation

Syntax Description:

isl

Set the encapsulation format to Inter-Switch Link (ISL). The switch encapsulates all received and transmitted packets with an ISL header. The switch filters native frames received from an ISL trunk port.

dot1q

Set the tagging format to IEEE 802.1Q. With this format, the switch supports simultaneous tagged and untagged traffic on a port.

Command Description:

Use the switchport trunk encapsulation interface configuration command to set the encapsulation format on the trunk port. Use the no form of this command to reset the format to the default. This command is available only in the Enterprise Edition Software.

You cannot configure one end of the trunk as an 802.1Q trunk and the other end as an ISL or nontrunk port. However, you can configure one port as an ISL trunk and another port on the same switch as a 802.1Q trunk.

This command is only applicable on switch platforms and port hardware that support both formats.
Example:

The following example shows how to configure the encapsulation format to 802.1Q:

Switch(config-if)#switchport trunk encapsulation dot1q

You can verify the previous command by entering the show interface interface-id switchport command in privileged EXEC mode.
Misconceptions:
None

Related commands:

None


Command:

switchport voice vlan

Mode:

Switch(config)#

Syntax:

switchport voice vlan {vlan-id | dot1p | none | untagged}
no switchport voice vlan

Syntax Description:

vlan-id | VLAN used for voice traffic. Valid IDs are from 1 to 4094 when the enhanced software image (EI) is installed and 1 to 1001 when the standard software image (SI) is installed. Do not enter leading zeros.
dot1p | The telephone uses priority tagging and uses VLAN 0 (the native VLAN). By default, the Cisco IP phone forwards the voice traffic with an 802.1P priority of 5.
none | The telephone is not instructed through the CLI about the voice VLAN. The telephone uses the configuration from the telephone key pad.
untagged | The telephone does not tag frames and uses VLAN 4095. The default for the telephone is untagged.

Command Description:

Use the switchport voice vlan interface configuration command to configure voice VLAN on the port. Use the no form of this command to return to the default setting.

The switch default is not to automatically configure the telephone (none).

The telephone default is not to tag frames.

You should configure voice VLAN on access ports.

If you enable port security on a voice VLAN port and if there is a PC connected to the IP phone, you should set the maximum allowed secure addresses on the port to more than 1.

You cannot configure static secure MAC addresses in the voice VLAN.

The Port Fast feature is automatically enabled when voice VLAN is configured. When you disable voice VLAN, the Port Fast feature is not automatically disabled.

Example:

This example shows how to configure VLAN 2 as the voice VLAN:

Switch(config-if)# switchport voice vlan 2

Misconceptions:

None

Related Commands:

None


 Command:

vlan

Mode:

Switch(vlan)#

Syntax:

vlan vlan-id [name vlan-name] [media {ethernet | fddi | fdi-net | tokenring | tr-net}]
[state {suspend | active}] [said said-value] [mtu mtu-size] [ring ring-number]
[bridge bridge-number | type {srb | srt}] [parent parent-vlan-id]
[stp type {ieee | ibm | auto}] [are are-number] [ste ste-number]
[backupcrf {enable | disable}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id]

no vlan vlan-id [name vlan-name] [media {ethernet | fddi | fdi-net | tokenring | tr-net}]
[state {suspend | active}] [said said-value] [mtu mtu-size] [ring ring-number]
[bridge bridge-number | type {srb | srt}] [parent parent-vlan-id]
[stp type {ieee | ibm | auto}] [are are-number] [ste ste-number]
[backupcrf {enable | disable}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id]

Catalyst 2950 switches support only Ethernet ports. You can configure only FDDI and Token Ring media-specific characteristics for VLAN Trunking Protocol (VTP) global advertisements to other switches. These VLANs are locally suspended.

Syntax Description:

Table 1 lists the valid syntax for each media type.

Table 1: Valid Syntax for Different Media Types
Media Type Valid Syntax

Ethernet

vlan vlan-id [name vlan-name] media ethernet [state {suspend | active}]
[said said-value] [mtu mtu-size] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id]

FDDI

vlan vlan-id [name vlan-name] media fddi [state {suspend | active}]
[said said-value] [mtu mtu-size] [ring ring-number] [parent parent-vlan-id] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id]

FDDI-NET

vlan vlan-id [name vlan-name] media fdi-net [state {suspend | active}]
[said said-value] [mtu mtu-size] [bridge bridge-number]
[stp type {ieee | ibm | auto}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id]

If VTP V2 mode is disabled, do not set the stp type to auto.

Token Ring

VTP V2 mode is disabled.

vlan vlan-id [name vlan-name] media tokenring [state {suspend | active}]
[said said-value] [mtu mtu-size] [ring ring-number] [parent parent-vlan-id]
[tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id]

Token Ring concentrator relay function (TRCRF)

VTP V2 mode is enabled.

vlan vlan-id [name vlan-name] media tokenring [state {suspend | active}]
[said said-value] [mtu mtu-size] [ring ring-number] [parent parent-vlan-id]
[bridge type {srb | srt}] [are are-number] [ste ste-number]
[backupcrf {enable | disable}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id]

Token Ring-NET

VTP V2 mode is disabled.

vlan vlan-id [name vlan-name] media tr-net [state {suspend | active}]
[said said-value] [mtu mtu-size] [bridge bridge-number]
[stp type {ieee | ibm}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id]

Token Ring bridge relay function (TRBRF)

VTP V2 mode is enabled.

vlan vlan-id [name vlan-name] media tr-net [state {suspend | active}]
[said said-value] [mtu mtu-size] [bridge bridge-number]
[stp type {ieee | ibm | auto}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id]

VLAN Configuration Rules

Table 2 describes the rules for configuring VLANs.

Table 2: VLAN Configuration Rules
Configuration Rule

VTP V2 mode is enabled, and you are configuring a TRCRF VLAN media type.

Specify a parent VLAN ID of a TRBRF that already exists in the configuration.

Specify a ring number. Do not leave this field blank.

Specify unique ring numbers when TRCRF VLANs have the same parent VLAN ID. Only one backup concentrator relay function (CRF) can be enabled.

VTP V2 mode is enabled, and you are configuring VLANs other than TRCRF media type.

Do not specify a backup CRF.

VTP V2 mode is enabled, and you are configuring a TRBRF VLAN media type.

Specify a bridge number. Do not leave this field blank.

VTP V2 mode is disabled.

No VLAN can have an STP type set to auto.

This rule applies to Ethernet, FDDI, FDDI-NET, Token Ring, and Token Ring-NET VLANs.

Add a VLAN that requires translational bridging (values are not set to zero).

The translational bridging VLAN IDs that are used must already exist in the configuration.

The translational bridging VLAN IDs that a configuration points to must also contain a pointer to the original VLAN in one of the translational bridging parameters (for example, Ethernet points to FDDI, and FDDI points to Ethernet).

The translational bridging VLAN IDs that a configuration points to must be different media types than the original VLAN (for example, Ethernet can point to Token Ring).

If both translational bridging VLAN IDs are configured, these VLANs must be different media types (for example, Ethernet can point to FDDI and Token Ring).

vlan-id

ID of the configured VLAN. Valid IDs are from 1 to 1001 and must be unique within the administrative domain. Do not enter leading zeroes.

name

(Optional) Keyword to be followed by the VLAN name.

vlan-name

ASCII string from 1 to 32 characters that must be unique within the administrative domain.

media

(Optional) Keyword to be followed by the VLAN media type.

ethernet

Ethernet media type.

fddi

FDDI media type.

fdi-net

FDDI network entity title (NET) media type.

tokenring

Token Ring media type if the VTP V2 mode is disabled.

TRCRF media type if the VTP V2 mode is enabled.

tr-net

Token Ring network entity title (NET) media type if the VTP V2 mode is disabled.

TRBRF media type if the VTP V2 mode is enabled.

state

(Optional) Keyword to be followed by the VLAN state.

active

VLAN is operational.

suspend

VLAN is suspended. Suspended VLANs do not pass packets.

said

(Optional) Keyword to be followed by the security association identifier (SAID) as documented in IEEE 802.10.

said-value

Integer from 1 to 4294967294 that must be unique within the administrative domain.

mtu

(Optional) Keyword to be followed by the maximum transmission unit (packet size in bytes).

mtu-size

Packet size in bytes from 1500 to 18190 that the VLAN can use.

ring

(Optional) Keyword to be followed by the logical ring for an FDDI, Token Ring, or TRCRF VLAN.

ring-number

Integer from 1 to 4095.

bridge

(Optional) Keyword to be followed by the logical distributed source-routing bridge. This bridge that interconnects all logical rings having this VLAN as a parent VLAN in FDDI-NET, Token Ring-NET, and TRBRF VLANs.

bridge-number

Integer from 0 to 15.

type

Keyword to be followed by the bridge type. Applies only to TRCRF VLANs.

srb

Source-route bridging VLAN.

srt

Source-route transparent bridging VLAN.

parent

(Optional) Keyword to be followed by the parent VLAN of an existing FDDI, Token Ring, or TRCRF VLAN. This parameter identifies the TRBRF to which a TRCRF belongs and is required when defining a TRCRF.

parent-vlan-id

Integer 0 to 1001.

stp type

(Optional) Keyword to be followed by the spanning-tree type for FDDI-NET, Token Ring-NET, or TRBRF VLAN.

ieee

IEEE Ethernet STP running source-route transparent (SRT) bridging.

ibm

IBM STP running source-route bridging (SRB).

auto

STP running a combination of source-route transparent bridging (IEEE) and source-route bridging (IBM).

are

Keyword to be followed by the number of all-routes explorer (ARE) hops. This keyword applies only to TRCRF VLANs.

are-number

Integer from 0 to 13 that defines the maximum number of ARE hops for thisVLAN.

ste

Keyword to be followed by the number of spanning-tree explorer (STE) hops. This keyword applies only to TRCRF VLANs.

ste-number

Integer from 0 to 13 that defines the maximum number of STE hops for this VLAN.

backupcrf

Keyword to be followed by the backup CRF mode. This keyword applies only to TRCRF VLANs.

enable

Enable backup CRF mode for this VLAN.

disable

Disable backup CRF mode for this VLAN.

tb-vlan1 and tb-vlan2

(Optional) Keyword to be followed by the first and second VLAN to which this VLAN is translationally bridged. Translational VLANs translate FDDI or Token Ring to Ethernet, for example.

tb-vlan1-id and tb-vlan2-id

Integer from 0 to 1001.

Command Description:

Use the vlan VLAN configuration command to configure VLAN characteristics. Use the no form of this command to delete a VLAN and its configured characteristics.

When the no vlan vlan-id form is used, the VLAN is deleted. Deleting a VLAN automatically resets to zero any other parent VLANs and translational bridging parameters that refer to the deleted VLAN.

When the no vlan vlan-id name vlan-name form is used, the VLAN name returns to the default name (VLANxxxx, where xxxx represent four numeric digits [including leading zeroes] equal to the VLAN ID number).

When the no vlan vlan-id media form is used, the media type returns to the default (ethernet). Changing the VLAN media type (including the no form) resets the VLAN MTU to the default MTU for the type (unless the mtu keyword is also present in the command). It also resets the VLAN parent and translational bridging VLAN to the default (unless the parent, tb-vlan1, or tb-vlan2 keywords are also present in the command).

When the no vlan vlan-id state form is used, the VLAN state returns to the default (active).

When the no vlan vlan-id said form is used, the VLAN SAID returns to the default (100,000 plus the VLAN ID).

When the no vlan vlan-id mtu form is used, the VLAN MTU returns to the default for the applicable VLAN media type. You can also modify the MTU by using the media keyword.

When the no vlan vlan-id ring form is used, the VLAN logical ring number returns to the default (0).

When the no vlan vlan-id bridge form is used, the VLAN source-routing bridge number returns to the default (0). The vlan vlan-id bridge command is only used for FDDI-NET and Token Ring-NET VLANs and is ignored in other VLAN types.

When the no vlan vlan-id parent form is used, the parent VLAN returns to the default (0). The parent VLAN resets to the default if the parent VLAN is deleted or if the media keyword changes the VLAN type or the VLAN type of the parent VLAN.

When the no vlan vlan-id stp type form is used, the VLAN spanning-tree type returns to the default (ieee).

When the no vlan vlan-id tb-vlan1 or no vlan vlan-id tb-vlan2 form is used, the VLAN translational bridge VLAN (or VLANs, if applicable) returns to the default (0). Translational bridge VLANs must be a different VLAN type than the affected VLAN, and if two are specified, the two must be different VLAN types from each other. A translational bridge VLAN resets to the default if the translational bridge VLAN is deleted, if the media keyword changes the VLAN type, or if the media keyword changes the VLAN type of the corresponding translational bridge VLAN.

Examples:

This example shows how to add an Ethernet VLAN with default media characteristics. The default includes a vlan-name of VLANxxx, where xxxx represents four numeric digits (including leading zeroes) equal to the VLAN ID number. The default media option is ethernet; the state option is active. The default said-value variable is 100,000 plus the VLAN ID; the mtu-size variable is 1500; the stp-type option is ieee. The VLAN is added if it did not already exist; otherwise, this command does nothing.

Switch(vlan)#vlan 2

This example shows how to modify an existing VLAN by changing its name and MTU size:

Switch(vlan)#no vlan name engineering mtu 1200

You can verify your settings by entering the show vlan privileged EXEC command.
Misconceptions:
None

Related commands:
show vlan (IOS)


Command:

vlan access-map

Mode:

Switch(config)#

Syntax:

vlan access-map name [seq#]

no vlan access-map name [seq#]

Syntax Description:

name | VLAN access-map tag.
seq# | (Optional) Map sequence number; valid values are from 0 to 65535.

Command Description:

To enter the VLAN access-map command mode to create a VLAN access map, use the vlan access-map command. To remove a mapping sequence or the entire map, use the no form of this command.

If you enter the sequence number of an existing map sequence, you enter VLAN access-map mode. If you do not specify a sequence number, a number is automatically assigned. You can enter one match clause and one action clause per map sequence. If you enter the no vlan access-map name [seq#] command without entering a sequence number, the whole map is removed. Once you enter VLAN access-map mode, the following commands are available:
action--Sets the action to be taken (forward or drop)
default--Returns a command to its default settings
end--Exits from configuration mode
exit--Exits from VLAN access-map configuration mode
match--Sets the values to match (IP address or MAC address)
no--Negates a command or reset its defaults

Example:

This example shows how to enter the VLAN access-map mode:

Switch(config)#vlan access-map cisco

Misconceptions:

None

Related Commands:

None


 Command:

vlan database

Mode:

Switch#

Syntax:

vlan database

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the vlan database privileged EXEC command to enter VLAN configuration mode from the command-line interface (CLI). From the CLI, you can add, delete, and modify VLAN configurations and globally propagate these changes by using the VLAN Trunking Protocol (VTP).

To return to the privileged EXEC mode from the VLAN configuration mode, enter the exit command.
Example:

This example shows how to enter the VLAN configuration mode from the privileged EXEC mode:

Switch#vlan database
Switch(vlan)#

Misconceptions:

This command mode is different from other modes because it is session-oriented. When you add, delete, or modify VLAN parameters, the changes are not applied until you exit the session by entering the apply or exit commands. When the changes are applied, the VTP configuration version is incremented. To exit the session without applying any of the changes made, use abort.

Related commands:

vlan


Command:

vlan filter

Mode:

Switch(config)#

Syntax:

vlan filter map-name {vlan-list vlan-list}

no vlan filter map-name {vlan-list [vlan-list]}

Syntax Description:

map-name | VLAN access-map tag.
vlan-list vlan-list | VLAN list; see "Usage Guidelines" for valid values.

Command Description:

To apply a VLAN access map, use the vlan filter command. To clear the VLAN access maps from VLANs or interfaces, use the no form of this command.

If your system is configured with a Supervisor Engine 1, valid values for vlan-id are from 1 to 1005. If your system is configured with a Supervisor Engine 2, valid values for vlan-id are from 1 to 4094. Extended-range VLANs are not supported on systems configured with a Supervisor Engine 1.

When configuring an action clause in a VLAN access map, note the following:

You can apply the VLAN access map to one or more VLANs.
The vlan-list parameter can be a single VLAN ID or a list of VLAN IDs or VLAN ID ranges (vlan-id-vlan-id). Multiple entries are separated by (-) (hyphen) or (,) (comma).
You can apply only one VLAN access map to each VLAN.

When entering the no form of this command, the vlan-list parameter is optional (but the keyword vlan-list is required). If you do not enter the vlan-list parameter, the VACL is removed from all VLANs where the map-name parameter is applied.

Example:

This example shows how to apply a VLAN access map on VLANs 7 through 9:

Switch(config)#vlan filter ganymede vlan-list 7-9

Misconceptions:

None

Related Commands:

None


Command:

vlan static (Catalyst 1900)

Mode:

Switch(config)#

Syntax:

vlan static [vlan number]

Syntax Description:

vlan number Number of VLAN to which the port will be assigned.

Command Description:

To statically assign a switchport to a particular vlan, use the vlan static command.

Example:

Enter the following commands to statically assign a port to a vlan.

Switch#config t
Switch(config)#interface Ethernet 0/2
Switch(config-if)#vlan static 2
Switch(config)#end

Misconceptions:

None.

Related Commands:

None.

© Cisco Systems, Inc. 2001, 2002


 Command:

vtp

Mode:

Switch(vlan)#

Syntax:

vtp {server | client | transparent}

no vtp {server | client | transparent}

Syntax Description:

server

Place the switch in VTP server mode. A switch in VTP server mode is enabled for VTP and sends advertisements. You can configure VLANs on it. The switch can recover all the VLAN information in the current VTP database from nonvolatile storage after reboot.

client

Place the switch in VTP client mode. A switch in VTP client mode is enabled for VTP, can send advertisements, but does not have enough nonvolatile storage to store VLAN configurations. You cannot configure VLANs on it. When a VTP client starts up, it does not transmit VTP advertisements until it receives advertisements to initialize its VLAN database.

transparent

Place the switch in VTP transparent mode. A switch in VTP transparent mode is disabled for VTP, does not transmit advertisements or learn from advertisements sent by other devices, and cannot affect VLAN configurations on other devices in the network. The switch receives VTP advertisements and forwards them on all trunk ports except the one on which the advertisement was received. The configuration of multi-VLAN ports causes the switch to automatically enter transparent mode.

Command Description:

Use the vtp VLAN database command to configure the VLAN Trunk Protocol (VTP) mode. Use the no form of this command to return to the default setting.

The no vtp client and no vtp transparent forms of the command return the switch to VTP server mode.

The vtp server command is the same as no vtp client or no vtp transparent except that it does not return an error if the switch is not in client or transparent mode.

Example:

The following example shows how to place the switch in VTP transparent mode:

Switch(vlan)#vtp transparent

You can verify the previous commands by entering the show vtp status command in privileged EXEC mode.

Misconceptions:
The Catalyst 2950 switches support up to 64 VLANs.

Related commands:

vtp domain

vtp password
vtp pruning


 Command:

vtp domain

Mode:

Switch(vlan)#

Syntax:

vtp domain domain-name

Syntax Description:

domain-name

ASCII string from 1 to 32 characters that identifies the VTP administrative domain for the switch. The domain name is case sensitive.

Command Description:

Use the vtp domain VLAN configuration command to configure the VLAN Trunking Protocol (VTP) administrative domain.

The switch is in the no-management-domain state until you configure a domain name. While in the no-management-domain state, the switch does not send any VTP advertisements even if changes occur to the local VLAN configuration. The switch leaves the no-management-domain state after receiving the first VTP summary packet on any port that is trunking or after you configure a domain name by using the vtp domain command. If the switch receives its domain from a summary packet, it resets its configuration revision number to zero. After the switch leaves the no-management-domain state, it cannot be configured to reenter it until you clear the nonvolatile RAM (NVRAM) and reload the software.

Domain names are case sensitive.

After you have configured a domain name, it cannot be removed. You can only reassign it to a different domain.
Example:

This example shows how to set the administrative domain for the switch:

Switch(vlan)#vtp domain OurDomainName

Misconceptions:
None

Related commands:
vtp password


 Command:

vtp password

Mode:

Switch(vlan)#

Syntax:

vtp password password-value

no vtp password password-value

Syntax Description:

password

Set the password for the generation of the 16-byte secret value used in MD5 digest calculation to be sent in VTP advertisements and to validate received VTP advertisements.

password-value

ASCII string from 8 to 64 characters. The password is case sensitive.

Command Description:

Use the vtp password VLAN configuration command to configure the VLAN Trunking Protocol (VTP) administrative domain password. Use the no form of this command to remove the password.

Passwords are case sensitive. Passwords should match on all switches in the same domain.

When the no vtp password form of the command is used, the switch returns to the no-password state.
Example:

This example shows how to configure the VTP domain password:

Switch(vlan)#vtp password ThisIsOurDomain'sPassword

Misconceptions:
None

Related commands:
vtp domain


 Command:

vtp pruning

Mode:

Switch(vlan)#

Syntax:
vtp pruning

no vtp pruning

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the vtp pruning VLAN database command to enable pruning in the VLAN Trunk Protocol (VTP) administrative domain. Use the no form of this command to disable pruning.

If you enable pruning on the VTP server, it is enabled for the entire management domain.

Only VLANs included in the pruning-eligible list can be pruned.

VLANs 2 through 1001 are pruning-eligible on 2900 XL and 3500 XL trunk ports.

Pruning is supported with VTP version 1 and version 2.
Example:

The following example shows how to enable pruning in the proposed new VLAN database:

Switch(vlan)# vtp pruning
You can verify the previous commands by entering the show vtp status command in privileged EXEC mode.

Misconceptions:
None

Related commands:
switchport trunk pruning


Command:

vmps server

Mode:

Switch(config)#

Syntax:

vmps server ipaddress [primary]

no vmps server [ipaddress]

Syntax Description:

ipaddress | IP address or host name of the primary or secondary VMPS servers. If you specify a host name, the Domain Name System (DNS) server must be configured.
primary | (Optional) Determines whether primary or secondary VMPS servers are being configured.

Command Description:

Use the vmps server global configuration command to configure the primary VLAN Membership Policy Server (VMPS) and up to three secondary servers. Use the no form of this command to remove a VMPS server

The first server entered is automatically selected as the primary server whether or not the primary keyword is entered. The first server address can be overridden by using primary in a subsequent command.

If a member switch in a cluster configuration does not have an IP address, the cluster does not use the VMPS server configured for that member switch. Instead, the cluster uses the VMPS server on the command switch, and the command switch proxies the VMPS requests. The VMPS server treats the cluster as a single switch and uses the IP address of the command switch to respond to requests.

When using the no form without specifying the ipaddress, all configured servers are deleted. If you delete all servers when dynamic-access ports are present, the switch cannot forward packets from new sources on these ports because it cannot query the VMPS.

Example:

This example shows how to configure the server with IP address 191.10.49.20 as the primary VMPS server. The servers with IP addresses 191.10.49.21 and 191.10.49.22 are configured as secondary servers.

Switch(config)# vmps server 191.10.49.20 primary

Switch(config)# vmps server 191.10.49.21

Switch(config)# vmps server 191.10.49.22

This example shows how to delete the server with IP address 191.10.49.21:

Switch(config)#no vmps server 191.10.49.21

Misconceptions:

None

Related Commands:

None


Command:

cablelength long

Mode:

Router(config-if)#

Router(config-controller)#

Syntax:

cablelength long dbgain-value dbloss-value
no cablelength long

Syntax Description:

dbgain-value Number of decibels (dB) by which the receiver signal is increased. Use one of the following values:

gain26
gain36

The default is 26 dB.

dbloss-value Number of decibels by which the transmit signal is decreased. Use one of the following values:

0db
-7.5db
-15db
-22.5db

The default is 0 dB.

Command Description:

To increase the pulse of a signal at the receiver and decrease the pulse from the transmitter using pulse equalization and line build-out for a T1 cable, use the cablelength long command in controller configuration or interface configuration mode. To return the pulse equalization and line build-out values to their default settings, use the no form of this command.

By default, the receiver gain of 26 dB and transmitter loss of 0 dB.

Cisco AS5200 Access Server, Cisco AS5800 Universal Access Server, and Cisco MC3810 Multiservice Access Concentrator

Use this command for configuring the controller T1 interface on the Cisco AS5200 access server, on the Cisco AS5800 universal access server, or on the Cisco MC3810 multiservice access concentrator. The cablelength long command is used to configure DS1 links (meaning, to build CSU/DSU links) when the cable length is no longer than 655 feet.

On the Cisco MC3810, this command is supported on T1 controllers only and applies to Voice-over-Frame Relay, Voice-over-ATM, and Voice-over-HDLC.

A pulse equalizer regenerates a signal that has been attenuated and filtered by a cable loss. Pulse equalization does not produce a simple gain, but it filters the signal to compensate for complex cable loss. A gain26 receiver gain compensates for a long cable length equivalent to 26 dB of loss, while a gain36 compensates for 36 dB of loss.

The lengthening or building out of a line is used to control far-end crosstalk. Line build-out attenuates the stronger signal from the customer installation transmitter so that the transmitting and receiving signals have similar amplitudes. A signal difference of less than 7.5 dB is ideal. Line build-out does not produce simple flat loss (also known as resistive flat loss). Instead, it simulates a cable loss of 7.5 dB, 15 dB, or 22.5 dB so that the resulting signal is handled properly by the receiving equalizer at the other end.

Cisco 2600 and Cisco 3600 Series Routers

This command is supported on T1 long-haul links only. If you enter the cablelength long command on a DSX-1 (short haul) interface, the command is rejected.

The transmit attenuation value is best obtained by experimentation. If the signal received by the far-end equipment is too strong, reduce the transmit level by entering additional attenuation.

Example:

Cisco AS5200 Access Server, Cisco AS5800 Universal Access Server, and Cisco MC3810 Multiservice Access Concentrator

The following example increases the receiver gain by 26 decibels and decreases the transmitting pulse by 7.5 decibels for a long cable on a Cisco AS5200:

AS5200(config)# controller t1 0
AS5200(config-controller)# cablelength long gain26 -7.5db

The following example increases the receiver gain by 36 decibels and decreases the transmitting pulse by 15 decibels for a long cable on a Cisco AS5800:

AS5800(config)# controller t1 0
AS5800(config-controller)# cablelength long gain36 -15db

The following example configures the cable length for controller T1 0 on a Cisco MC3810 to a decibel pulse gain of 36 decibels and a decibel pulse rate of -22.5 decibels:

MC3810(config)# controller t1 0
MC3810(config-controller)# cablelength long gain36 -22.5db

Cisco 2600 and Cisco 3600 Series Routers

On a Cisco 2600 or 3600 series router, the following example specifies a pulse gain of 36 decibels and a decibel pulse rate of -7.5 decibels:

Router(config)# interface atm 0/2
Router(config-controller)#  cablelength long gain36 -7.5db

Misconceptions:

On the Cisco MC3810, you cannot use the cablelength long command on a DSX-1 interface only. The cablelength long command can be only used on CSU interfaces.

Related Commands:

cablelength short


Command:

cablelength short

Mode:

Router(config-if)#

Router(config-controller)#

Syntax:

cablelength short length

no cablelength short

Syntax Description:

length Specifies a cable length. Use one of the following values to specify this value:

133-Specifies a cable length from 0 to 133 feet.
266-Specifies a cable length from 134 to 266 feet.
399-Specifies a cable length from 267 to 399 feet.
533-Specifies a cable length from 400 to 533 feet.
655-Specifies a cable length from 534 to 655 feet.

Command Description:

To set a cable length 655 feet or shorter for a DS1 link on the Cisco MC3810 or Cisco 2600 and 3600 series routers, use the cablelength short command in controller configuration or interface configuration mode. This command is supported on T1 controllers only. To delete the cablelength short value, use the no form of this command. To set cable lengths longer than 655 feet, use the cablelength long command.

The default is 133 feet for the Cisco AS5200 access server, Cisco AS5800 universal access server, and Cisco MC3810 multiservice access concentrator.

There is no default value or behavior for the Cisco 2600 and Cisco 3600 series routers.

Cisco AS5200 Access Server, Cisco AS5800 Universal Access Server, and Cisco MC3810 Multiservice Access Concentrator

On the Cisco MC3810, the cablelength short command is used to configure DSX-1 links when the cable length is 655 feet or less than 655 feet. On the Cisco MC3810, this command is supported on T1 controllers only.

Cisco 2600 and Cisco 3600 Series Routers

This command is supported on T1 short-haul links only. If you enter the cablelength short command on a long-haul interface, the command is rejected.

Example:

Cisco AS5200 Access Server, Cisco AS5800 Universal Access Server, and Cisco MC3810 Multiservice Access Concentrator

In the following example, the cable length is set to 266 for the T1 controller in slot 0 on dial shelf 0:

Router# configure terminal
Router(config)# controller t1 1/1/0
Router(config-controller)# cablelength short 266
Router(config-controller)# exit
Router(config)# exit
Router#

Cisco 2600 and Cisco 3600 Series Routers

On a Cisco 2600 or 3600 series router, the following example specifies a cable length from 0 to 133 feet:

Router(config)# interface atm 0/2
Router(config-if)# cablelength short 133

Misconceptions:

On the Cisco MC3810, you cannot enter the cablelength short command on a CSU interface. The cablelength short command can be used only on DSX-1 interfaces.

Related Commands:

cablelength long


Command:

channel-group

Mode:

Switch(config)#

Syntax:

channel-group channel-group-number mode {auto [non-silent] | desirable [non-silent] | on}

no channel-group

Syntax Description:

channel-group-number | Specify the channel group number. The range is 1 to 64.
mode | Specify the EtherChannel Port Aggregation Protocol (PAgP) mode of the interface.
auto Enable PAgP only if a PAgP device is detected.

Auto mode places an interface into a passive negotiating state, in which the interface responds to PAgP packets it receives but does not initiate PAgP packet negotiation. A channel is formed only with another port group in desirable mode. This setting is the default.

desirable Unconditionally enable PAgP.

Desirable mode places an interface into an active negotiating state, in which the interface initiates negotiations with other interfaces by sending PAgP packets. A channel is formed with another port group in either the desirable or auto mode.

non-silent | (Optional) Used with the auto or desirable keyword when traffic is expected from the other device.
on Force the interface to channel without PAgP.

With the on mode, a usable EtherChannel exists only when an interface group in the on mode is connected to another interface group in the on mode.

Command Description:

Use the channel-group interface configuration command to assign an Ethernet interface to an EtherChannel group. Use the no form of this command to remove the channel group configuration from the interface.

You do not have to create a port-channel interface before assigning a physical interface to a channel group. A port-channel interface is created automatically when the channel group gets its first physical interface.

You do not have to disable the IP address that is assigned to a physical interface that is part of a channel group, but we highly recommend that you do so.

Any configuration or attribute changes you make to the port-channel interface are propagated to all interfaces within the same channel group as the port channel (for example, configuration changes are also propagated to the physical interfaces that are not part of the port channel, but are part of the channel group).

If you do not specify non-silent with the auto or desirable mode, silent is assumed. The silent mode is used when the switch is connected to a device that is not PAgP-capable and seldom, if ever, transmits packets. A example of a silent partner is a file server or a packet analyzer that is not generating traffic. In this case, running PAgP on a physical port prevents that port from ever becoming operational; however, it allows PAgP to operate, to attach the interface to a channel group, and to use the interface for transmission. Both ends of the link cannot be set to silent.

Caution You should exercise care when setting the mode to on (manual configuration). All ports configured in the on mode are bundled in the same group and are forced to have similar characteristics. If the group is misconfigured, packet loss or Spanning Tree Protocol (STP) loops might occur.

Example:

This example shows how to add an interface to the EtherChannel group specified as channel group 1:

Switch(config)# interface gigabitethernet0/1

Switch(config-if)# channel-group 1 mode on

Misconceptions:

None

Related Commands:

None


Command:

t1 clock source

Mode:

Router(config-controller)#

Syntax:

t1 channel clock source {internal | line}

Syntax Description:

channel | Number between 1 and 28 that indicates the T1 channel.
internal | Specifies that the internal clock source is used. This is the default.
line | Specifies that the network clock source is used.

Command Description:

To specify where the clock source is obtained for use by each T1 channel on the Channelized T3 Interface Processor (CT3IP) in Cisco 7500 series routers, use the t1 clock source controller configuration command.

If you do not specify the t1 clock source command, the default clock source of internal is used by all the T1s on the CT3IP.

You can also set the clock source for the CT3IP by using the clock source (CT3IP) controller configuration command.

Example:

The following example sets the clock source for T1 6 and T1 8 on the CT3IP to line:

Router(config)#controller t3 9/0/0
Router(config-controller)#t1 6 clock source line
Router(config-controller)#t1 8 clock source line

Misconceptions:

None.

Related Commands:

None.


Command:

protocol (VPDN)

Mode:

Router(config-vpdn)#

Syntax:

protocol {l2f | l2tp | pppoe | any}

no protocol

Syntax Description:

l2f | Layer 2 Forwarding (L2F) tunnels.
l2tp | Layer 2 Transport Protocol (L2TP) tunnels.
pppoe | Enables the VPDN subgroup to establish PPPoE sessions.
any | Either L2F or L2TP tunnels.

Command Description:

To specify the Layer 2 Tunneling Protocol (L2TP) that the virtual private dialup network (VPDN) subgroup will use, use the protocol command in VPDN configuration mode. To remove the protocol-specific configurations from a VPDN subgroup, use the no form of this command.

This command is required for all four of the VPDN subgroups. L2TP is the only protocol that can be used for dialout. Changing the protocol will remove all the commands from the VPDN subgroup and any protocol-specific commands from the VPDN group configuration.

Example:

The following example configures VPDN group 1 to accept dial-in calls using L2F and request dialout calls using L2TP:

vpdn-group 1
accept-dialin
protocol l2f
virtual-template 1
request-dialout
protocol l2tp
pool-member 1
local name reuben
terminate-from hostname cerise
initiate-to ip 10.3.2.1
l2f ignore-mid-sequence
l2tp ip udp checksum

Misconceptions:

None.

Related Commands

None.

© Cisco Systems, Inc. 2001, 2002


Command:

request-dialin

Mode:

Router(config-vpdn)#

Syntax:

request-dialin

Syntax Description:

This command has no arguments or keywords.

Command Description:

Creates a request-dialin VPDN subgroup.

Example:

The following is the sample configuration of the request-dialin command:

Router(config-vpdn)# request-dialin

Misconceptions:

None.

Related Commands

None.

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

vpdn enable

Mode:

Router(config)#

Syntax:

vpdn enable

no vpdn enable

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable virtual private dialup networking on the router and inform the router to look for tunnel definitions in a local database and on a remote authorization server (home gateway), if one is present, use the vpdn enable command in global configuration mode.

Example:

Router(config)#vpdn enable

Misconceptions:

None

Related commands:

vpdn outgoing

vpdn profile

vpdn source-ip

vpdn incoming

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

vpdn incoming

Mode:

Router(config)#

Syntax:

vpdn incoming remote-name local-name virtual-template number

no vpdn incoming remote-name local-name virtual-template number

Syntax Description:

remote-name | Case-sensitive name of the remote host (the network access server) requesting the connection.
local-name | Case-sensitive local name (of the home gateway) to use when authenticating back to the remote host.
virtual-template number | Virtual template to use for building interfaces for incoming calls.

Command Description:

To specify the local name to use for authenticating and the virtual template to use for building interfaces for incoming connections when a Level 2 Forwarding (tunnel) connection is requested from a certain remote host, use the vpdn incoming command in global configuration mode.

Example:

Router(config)#vpdn incoming nas-access homegate virtual-template 1

Misconceptions:

None

Related commands:

vpdn outgoing

vpdn enable

vpdn source-ip

vpdn profile

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

vpdn outgoing

Mode:

Router(config)#

Syntax:

vpdn outgoing {dnis dialed-number | domain-name} local-name ip ip-address

no vpdn outgoing {dnis dialed-number | domain-name} local-name ip ip-address

Syntax Description:

dnis dialed-number | Dialed number to be used for selecting a specific tunnel to be used for forwarding traffic to a home gateway.
domain-name | Case-sensitive name of the domain to forward traffic to.
local-name | Case-sensitive local name to use when authenticating the tunnel to the remote host.
ip ip-address | IP address of the remote host (home gateway).

Command Description:

To specify use of Dialed Number Information Service (DNIS) or use of a domain name when selecting a tunnel for forwarding traffic to the remote host (the home gateway) on a Virtual Private Dialup Network (VPDN), use the vpdn outgoing command in global configuration mode.

Example:

        Router(config)# vpdn outgoing hp.com hp-gw ip 1.1.1.4

Misconceptions:

None

Related commands:

vpdn enable

vpdn enable

vpdn profile

vpdn incoming

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

vpdn profile

Mode:

Router(config)#

Syntax:

vpdn profile name

no vpdn profile name

Syntax Description:

name

Name of the VPDN profile.

Command Description:

To combine session counting over Virtual Private Dialup Network (VPDN) groups, use the vpdn profile command in customer profile configuration mode. Use the no form of this command to remove a VPDN profile from a customer profile.

Example:

Router(config)# vpdn profile myprofile

Misconceptions:

None

Related commands:

vpdn outgoing

vpdn enable

vpdn source-ip

vpdn incoming

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

vpdn source-ip

Mode:

Router(config)#

Syntax:

vpdn source-ip address

Syntax Description:

address

IP address of the network access server.

Command Description:

To set the source IP address of the network access server, use the vpdn source-ip command in global configuration mode.

Example:

Router(config)#vpdn source-ip 10.0.0.1

Misconceptions:

None

Related commands:

vpdn outgoing

vpdn enable

vpdn profile

vpdn incoming

© Cisco Systems, Inc. 2001, 2002


%command%

Command:

vpdn-group

Mode:

Router(config)#

Syntax:

vpdn-group name

no vpdn-group name

Syntax Description:

name

Name of the VPDN group.

Command Description:

To associate a virtual private dialup network (VPDN) group to a customer or VPDN profile, use the vpdn-group command in customer profile or VPDN profile configuration mode. To remove the VPDN group from a customer profile or VPDN profile, use the no form of this command.

Example:

Router(config)#vpdn-group group1

Misconceptions:

None

Related commands:

None

© Cisco Systems, Inc. 2001, 2002


 Command:

ip http authentication

Mode:

Router(config)#

Syntax:

ip http authentication {aaa | enable | local | tacacs}

no ip http authentication {aaa | enable | local | tacacs}

Syntax Description:

aaa

Indicates that the AAA facility is used for authentication.

enable

Indicates that the enable password method, which is the default method of HTTP server user authentication, is used for authentication.

local

Indicates that the local user database as defined on the Cisco router or access server is used for authentication.

tacacs

Indicates that the TACACS or XTACACS server is used for authentication.

Command Description:

Use the ip http authentication global configuration command to specify a particular authentication method for HTTP server users. Use the no form of this command to disable a configured authentication method.

The ip http authentication command enables you to specify a particular authentication method for HTTP server users. The HTTP server uses the enable password method to authenticate a user at privilege level 15. The ip http authentication command now lets you specify enable, local, TACACS, or AAA HTTP server user authentication.
Example:

The following example specifies TACACS as the method of HTTP server user authentication:

Router(config)#ip http authentication tacacs
Misconceptions:
None

Related Commands:
ip http server


 Command:

ip http port

Mode:

Router(config)#

Syntax:

ip http port number

no ip http port

Syntax Description:
number    Port number for use by Clickstart or the Cisco Web Browser Interface

Command Description:

To specify the port to be used by the Cisco IOS ClickStart software or the Cisco Web browser interface, use the ip http port global configuration command. To use the default port, use the no form of this command.

Example:

The following example changes the http port to be 81.

Router(config)#ip http port 81

Misconceptions:
None

Related Commands:
ip http server


 Command:

ip http server

Mode:

Router(config)#

Syntax:

ip http server

no ip http server

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable a Cisco router to be configured from a browser using the Cisco IOS ClickStart software, and to enable any router to be monitored or have its configuration modified from a browser using the Cisco Web browser interface, use the ip http server global configuration command. To disable this feature, use the no form of this command.

This feature is enabled on Cisco 1003, Cisco 1004, and Cisco 1005 routers that have not yet been configured. For Cisco 1003, Cisco 1004, and Cisco 1005 routers that have already been configured, and for all other routers, this feature is disabled.
Example:

The following example configures the router so that you can use the Cisco Web browser interface to issue commands to it:

Router(config)#ip http server
Misconceptions:
None

Related Commands:

ip http port

ip http authentication


 Command:

x25 address

Mode:

Router(config-if)#

Syntax:

x25 address x121-address

Syntax Description:
x121-address

The variable-length X.121 address assigned to this interface by the X.25 network service provider.

Command Description:

To set the X.121 address of a particular network interface, use the x25 address interface configuration command.

When an X.25 interface on a router is connected to an X.25 network, the network administrator assigns it an X.121 address. X.25 interfaces that perform X.25 switching only do not require an X.121 address.
Example:

The following example sets the X.121 address for the interface:

Router(config)#interface serial 0
Router(config-if)#encapsulation x25
Router(config-if)#x25 address 00000123005

The address must match that assigned by the X.25 network service provider.
Misconceptions:
None

Related commands:

None


 Command:

x25 default

Mode:

Router(config-if)#

Syntax:

x25 default protocol

no x25 default protocol

Syntax Description:
protocol

Specifies the protocol to assume; may be ip or pad .

Command Description:

To set a default protocol, use the x25 default interface configuration command. To remove the default protocol specified, use the no form of this command.

This command specifies the protocol assumed by the Cisco IOS software for incoming calls with unknown or missing protocol identifier in the call user data (CUD). If you do not use the x25 default interface configuration command, the software clears any incoming calls with unrecognized CUD.

Example:

The following example establishes IP as the default protocol for X.25 calls:

Router(config)#interface serial 0
 Router(config-if)# x25 default ip

Misconceptions:
None

Related commands:
x25 map


 Command:

x25 hic

Mode:

Router(config-if)#

Syntax:

x25 hic circuit-number

Syntax Description:
circuit-number

VC number from 1 to 4095, or 0 if there is no incoming-only VC range.

Command Description:

To set the highest incoming-only virtual circuit (VC) number, use the x25 hic interface configuration command.

Usage Guidelines

When X.25 calls are placed across the interface between an X.25 DTE and the X.25 network, virtual circuits (VC) are established to carry the data associated with the calls. These VCs fall into the following categories: Permanent Virtual Circuits (PVCs), incoming-only, both-way, and outgoing-only. All VCs are numbered, and each of these categories occupies a consecutive range. All PVCs must be numerically lower than all incoming-only VCs, which in turn must be lower than all both-way VCs, which in turn must be lower than all outgoing-only VCs.

Example:

The following example sets a valid incoming-only VC range of 1 to 5:

Router(config)#interface serial 0/0
 Router(config-if)#x25 lic 1
 Router(config-if)#x25 hic 5
Misconceptions:
None

Related commands:
x25 lic
x25 hoc
x25 htc
x25 loc
x25 ltc


 Command:

x25 hoc

Mode:

Router(config-if)#

Syntax:

x25 hoc circuit-number

Syntax Description:
circuit-number

VC number from 1 to 4095, or 0 if there is no incoming-only VC range.

Command Description:

To set the highest outgoing-only virtual circuit (VC) number, use the x25 hoc interface configuration command.

When X.25 calls are placed across the interface between an X.25 DTE and the X.25 network, virtual circuits (VC) are established to carry the data associated with the calls. These VCs fall into the following categories: Permanent Virtual Circuits (PVCs), incoming-only, two-way, and outgoing-only. All VCs are numbered, and each of these categories occupies a consecutive range. All PVCs must be numerically lower than all incoming-only VCs, which in turn must be lower than all two-way VCs, which in turn must be lower than all outgoing-only VCs.
Example:

The following example sets a valid outgoing-only VC range of 2000 to 2005:

Router(config-if)#interface serial 0/0
Router(config-if)#x25 loc 2000
Router(config-if)#x25 hoc 2005
Misconceptions:
None

Related commands:
x25 loc


 Command:

x25 htc

Mode:

Router(config-if)#

Syntax:

x25 htc circuit-number

Syntax Description:
circuit-number

VC number from 1 to 4095, or 0 if there is no two-way VC range.

Command Description:

To set the highest two-way virtual circuit (VC) number, use the x25 htc interface configuration command.

Usage Guidelines

When X.25 calls are placed across the interface between an X.25 DTE and the X.25 network, virtual circuits (VC) are established to carry the data associated with the calls. These VCs fall into the following categories: Permanent Virtual Circuits (PVCs), incoming-only, two-way, and outgoing-only. All VCs are numbered, and each of these categories occupies a consecutive range. All PVCs must be numerically lower than all incoming-only VCs, which in turn must be lower than all two-way VCs, which in turn must be lower than all outgoing-only VCs.
Example:

The following example sets a valid two-way VC range of 5 to 25:

Router(config)#interface serial 0/0
 Router(config-if)#x25 ltc 5
 Router(config-if)#x25 htc 25
Misconceptions:
None

Related commands:
x25 lic
x25 hic
x25 hoc
x25 loc
x25 ltc


 Command:

x25 ips

Mode:

Router(config-if)#

Syntax:

x25 ips bytes

Syntax Description:
bytes

Byte count. It can be one of the following values: 16, 32, 64, 128, 256, 512, 1024, 2048, or 4096.

Command Description:

To set the interface default maximum input packet size to match that of the network, use the x25 ips interface configuration command.

Usage Guidelines

X.25 network connections have a default maximum input packet size set by the network administrator. Larger packet sizes require less overhead processing. To send a packet larger than the X.25 packet size over an X.25 virtual circuit, the Cisco IOS software must break the packet into two or more X.25 packets with the more data bit (M-bit) set. The receiving device collects all packets with the Mbit set and reassembles the original packet.

Set the x25 ips and x25 ops commands to the same value unless your network supports asymmetric input and output packet sizes.
Example:

The following example sets the default maximum packet sizes to 512:

Router(config)#interface serial 1
Router(config-if)#x25 ips 512
Router(config-if)#x25 ops 512
Misconceptions:
Nones

Related commands:
x25 ops


 Command:

x25 lic

Mode:

Router(config-if)#

Syntax:

x25 lic circuit-number

Syntax Description:
circuit-number

VC number from 1 to 4095, or 0 if there is no incoming-only VC range.

Command Description:

To set the lowest incoming-only virtual circuit (VC) number, use the x25 lic interface configuration command.

Usage Guidelines

When X.25 calls are placed across the interface between an X.25 DTE and the X.25 network, virtual circuits (VC) are established to carry the data associated with the calls. These VCs fall into the following categories: Permanent Virtual Circuits (PVCs), incoming-only, both-way, and outgoing-only. All VCs are numbered, and each of these categories occupies a consecutive range. All PVCs must be numerically lower than all incoming-only VCs, which in turn must be lower than all both-way VCs, which in turn must be lower than all outgoing-only VCs.
Example:

The following example sets a valid incoming-only VC range of 1 to 5, and sets the lowest two-way VC number:

Router(config)#interface serial 0/0
 Router(config-if)#x25 lic 1
 Router(config-if)#x25 hic 5
 Router(config-if)#x25 ltc 6
Misconceptions:
None

Related commands:
x25 hic
x25 hoc
x25 htc
x25 loc
x25 ltc


 Command:

x25 loc

Mode:

Router(config-if)#

Syntax:

x25 loc circuit-number

Syntax Description:

circuit-number

VC number from 1 to 4095, or 0 if there is no outgoing-only VC range.

Command Description:

To set the lowest outgoing-only virtual circuit (VC) number, use the x25 loc interface configuration command.

When X.25 calls are placed across the interface between an X.25 DTE and the X.25 network, virtual circuits (VC) are established to carry the data associated with the calls. These VCs fall into the following categories: Permanent Virtual Circuits (PVCs), incoming-only, both-way, and outgoing-only. All VCs are numbered, and each of these categories occupies a consecutive range. All PVCs must be numerically lower than all incoming-only VCs, which in turn must be lower than all both-way VCs, which in turn must be lower than all outgoing-only VCs.
Example:

The following example sets a valid outgoing-only virtual circuit range of 2000 to 2005:

Router(config)#interface serial 0/0
 Router(config-if)#x25 loc 2000
 Router(config-if)#x25 hoc 2005
Misconceptions:
None

Related commands:
x25 lic
x25 hic
x25 hoc
x25 htc
x25 ltc


 Command:

x25 ltc

Mode:

Router(config-if)#

Syntax:

x25 ltc circuit-number

Syntax Description:

circuit-number

VC number from 1 to 4095, or 0 if there is no two-way VC range.

Command Description:

To set the lowest two-way virtual circuit (VC) number, use the x25 ltc interface configuration command.

When X.25 calls are placed across the interface between an X.25 DTE and the X.25 network, virtual circuits (VC) are established to carry the data associated with the calls. These VCs fall into the following categories: Permanent Virtual Circuits (PVCs), incoming-only, both-way, and outgoing-only. All VCs are numbered, and each of these categories occupies a consecutive range. All PVCs must be numerically lower than all incoming-only VCs, which in turn must be lower than all both-way VCs, which in turn must be lower than all outgoing-only VCs.
Example:

The following example sets a valid two-way virtual circuit range of 5 to 25:

Router(config)#interface serial 0/0
 Router(config-if)#x25 ltc 5
 Router(config-if)#x25 htc 25
Misconceptions:
None

Related commands:
x25 lic
x25 hoc
x25 htc
x25 loc
x25 hic


Command:

x25 map compressedtcp

Mode:

Router(config-if)#

Syntax:

x25 map compressedtcp ip-address [protocol2 address2 [...[protocol9address9]]]
x121-address [option]

no x25 map compressedtcp address [protocol2 address2 [...[protocol9address9]]]
x121-address

Syntax Description:

ip-address

IP address.

protocol

(Optional) The upper layer protocol to be associated with the X.121 address specified in this map. To specify a protocol, use the protocol's keyword as listed in the table below. As many as nine protocol and address pairs can be specified in one command line.

address

(Optional) Protocol address.

x121-address

X.121 address.

option

(Optional) The same options as those for the x25 map command; see Table earlier in this chapter.

Command Description:

To map compressed TCP traffic to an X.121 address, use the x25 map compressedtcp interface configuration command. To delete a TCP/IP header compression map for the link, use the no form of this command.

Cisco supports RFC 1144 TCP/IP header compression (THC) on serial lines using HDLC and X.25 encapsulation. THC encapsulation is only slightly different from other encapsulation traffic, but these differences are worth noting. The implementation of compressed TCP over X.25 uses one virtual circuit to pass the compressed packets. Any IP traffic (including standard TCP) is separate from TCH traffic; it is carried over separate IP encapsulation virtual circuits or identified separately in a multiprotocol virtual circuit.

Note If you specify both ip and compressedtcp in the same x25 map compressedtcp command, they must both specify the same IP address.

The nvc map option cannot be used for TCP/IP header compression, because only one virtual circuit can carry compressed TCP/IP header traffic to a given host.

Example:

The following example establishes a map for TCP/IP header compression on serial interface 4:

Router(config)#interface serial 4
Router(config-if)#ip tcp header-compression
Router(config-if)#x25 map compressedtcp 172.20.2.5 000000010300

Misconceptions:

None

Related commands:

x25 map


 Command:

x25 map

Mode:

Router(config-if)#

Syntax:

x25 map protocol address [protocol2 address2[...[protocol9
address9]]] x121-address [option]

no x25 map protocol address x121-address

Syntax Description:

protocol

The upper layer protocol to be associated with the X.121 address specified in this map. To specify a protocol, use the protocol's keyword as listed in the table below. As many as nine protocol and address pairs can be specified in one command line.

address

Protocol address.

x121-address

X.121 address of the remote host.

option

(Optional) Additional functionality that can be specified for originated calls. Can be any of the options listed in Table.

Command Description:

To set up the LAN protocols-to-remote host mapping, use the x25 map interface configuration command. To remove an existing x25 map, use the no form of this command with the appropriate network protocol(s) and X.121 address arguments.

Routers use connections across X.25 networks to provide a transport path for higher layer protocols. To ensure that these connections are established to the correct destinations, the routers must be configured with the X.121 address of the X.25 destination for a given higher layer protocol. The x25 map command is used to do this, as well as specify other options and parameters that the router must use when connecting to the specified destination.

Two methods are available to encapsulate traffic; Cisco's traditional encapsulation method, and the IETF standard defined in RFC 1356. The IETF method allows for a single virtual circuit to be used by multiple higher layer protocols. Cisco's traditional encapsulation method is used by default. Include the method option keyword to specify an alternative encapsulation technique.

When you configure multiprotocol maps, you can specify a maximum of nine protocol and address pairs in an x25 map command. However, you can specify a protocol only once. For example, you can specify the IP protocol and an IP address, but you cannot specify another IP address. If compressedtcp and ip are both specified, the same IP address must be used.

Bridging is supported only if you are using Cisco's traditional encapsulation method. For correct operation, bridging maps must specify the broadcast option.

Since most datagram routing protocols rely on broadcasts or multicasts to send routing information to their neighbors, the broadcast keyword is needed to run such routing protocols over X.25.

Encapsulation maps might also specify that traffic between the two hosts should be compressed, thus increasing the effective bandwidth between them at the expense of memory and computation time. Because each compression virtual circuit requires memory and computation resources, compression must be used with care and monitored to maintain acceptable resource usage and overall performance.

OSPF treats a nonbroadcast, multiaccess network such as X.25 in much the same way as it treats a broadcast network by requiring the selection of a designated router. In previous releases, this required manual assignment in the OSPF configuration using the neighbor router configuration command. When the x25 map command is included in the configuration with the broadcast, and the ip ospf network command (with the broadcast keyword) is configured, there is no need to configure any neighbors manually. OSPF will now run over the X.25 network as a broadcast network. (Refer to the ip ospf network interface configuration command for more detail.)

Note The OSPF broadcast mechanism assumes that IP class D addresses are never used for regular traffic over X.25.

You can modify the options of an x25 map command by restating the complete set of protocols and addresses specified for the map, followed by the desired options. To delete a map command, you must also specify the complete set of protocols and addresses. The options can be omitted.

Once defined, a map's protocols and addresses cannot be changed. This requirement exists because the Cisco IOS software cannot determine whether you want to add to, delete from, or modify an existing map's protocol and address specification, or simply mistyped the command. To change a map's protocol and address specification, you must delete it and create a new map.

A given protocol-address pair cannot be used in more than one map on the same interface.

Table below lists the protocols supported by X.25.

Table: Protocols Supported by X.25
Keyword Protocol

apollo

Apollo Domain

appletalk

AppleTalk

bridge

Bridging1

clns

ISO Connectionless Network Service

compressedtcp

TCP/IP header compression

decnet

DECnet

ip

IP

ipx

Novell IPX

pad

PAD links 2

qllc

System Network Architecture (SNA) encapsulation in X.253

vines

Banyan VINES

xns

XNS

1 Bridging traffic is supported only for Cisco's traditional encapsulation method, so a bridge map cannot specify other protocols. 2Packet Assembly/Disassembly (PAD) maps are used to configure session and protocol translation access, therefore, this protocol is not available for multiprotocol encapsulation. 3Qualified Logical Link Control (QLLC) is not available for multiprotocol encapsulation.

Note The CMNS map form is obsolete; its function is replaced by the enhanced x25 route command.

Table lists the map options supported by X.25 using the x25 map command.

Table: x25 map Options
Option Description

compress

Specifies that X.25 payload compression be used for mapping the traffic to this host. Each virtual circuit established for compressed traffic uses a significant amount of memory (for a table of learned data patterns) and for computation (for compression and decompression of all data). Cisco recommends that compression be used with careful consideration to its impact on overall performance.

method {cisco | ietf | snap | multi}

Specifies the encapsulation method. The choices are as follows:

  • cisco—Cisco's traditional encapsulation method; not available if more than one protocol is to be carried. If the method option is not specified then Cisco encapsulation is used.
  • ietf—Standard RFC 1356 operation: protocol identification uses the standard encoding, which is compatible with RFC 877. Multiprotocol virtual circuits are used only if needed.
  • snap—RFC 1356 operation where IP is identified with SNAP rather than the standard IETF method. SNAP encapsulation is NOT compatible with RFC 877.
  • multi—Forces a map that specifies a single protocol to set up a multiprotocol virtual circuit when a call is originated; also forces a single-protocol PVC to use multiprotocol data identification methods for all datagrams sent and received.

no-incoming

Use the map only to originate calls.

no-outgoing

Do not originate calls when using the map.

idle minutes

Specifies an idle timeout for calls other than the interface default; 0 minutes disables the idle timeout.

reverse

Specifies reverse charging for outgoing calls.

accept-reverse

Causes the Cisco IOS software to accept incoming reverse-charged calls. If this option is not present, the Cisco IOS software clears reverse-charged calls unless the interface accepts all reverse-charged calls.

broadcast

Causes the Cisco IOS software to direct any broadcasts sent through this interface to the specified X.121 address. This option also simplifies the configuration of OSPF; see "Usage Guidelines" for more detail.

cug group-number

Specifies a closed user group number (from 1 to 9999) for the mapping in an outgoing call.

nvc count

Sets the maximum number of virtual circuits for this map or host. The default count is the x25 nvc setting of the interface. A maximum number of eight virtual circuits can be configured for each map. Compressed TCP may use only 1 virtual circuit.

packetsize in-size out-size

Proposes maximum input packet size (in-size) and maximum output packet size (out-size) for an outgoing call. Both values typically are the same and must be one of the following values: 16, 32, 64, 128, 256, 512, 1024, 2048, or 4096.

windowsize in-size out-size

Proposes the packet count for input window (in-size) and output window (out-size) for an outgoing call. Both values typically are the same, must be in the range 1 to 127, and must be less than the value set by the x25 modulo command.

throughput in out

Sets the requested throughput class values for input (in) and output (out) throughput across the network for an outgoing call. Values for in and out are in bits per second (bps) and range from 75 to 48000 bps.

transit-delay milliseconds

Specifies the transit delay value in milliseconds (0 to 65534) for an outgoing call, for networks that support transit delay.

nuid username password

Specifies that a network user ID (NUID) facility be sent in the outgoing call with the specified Terminal Access Controller Access Control System (TACACS) username and password (in a format defined by Cisco). This option should be used only when connecting to another Cisco router. The combined length of the username and password should not exceed 127 characters. This option only works if the router is configured as an X.25 DTE.

nudata string

Specifies the network user identification in a format determined by the network administrator (as allowed by the standards). This option is provided for connecting to non-Cisco equipment that requires an NUID facility. The string should not exceed 130 characters and must be enclosed in quotation marks ("") if there are any spaces present. This option only works if the router is configured as an X.25 DTE.

roa name

Specifies the name defined by the x25 roa command for a list of transit Recognized Operating Agencies (ROAs, formerly called Recognized Private Operating Agencies, or RPOAs) to use in outgoing Call Request packets.

passive

Specifies that the X.25 interface should send compressed outgoing TCP datagrams only if they were already compressed when they were received. This option is available only for compressed TCP maps.

Examples:

The following example maps IP address 172.20.2.5 to X.121 address 000000010300. The broadcast keyword directs any broadcasts sent through this interface to the specified X.121 address.

Router(config)#interface serial 0/0
 Router(config-if)#x25 map ip 171.20.2.5 000000010300 broadcast

The following example specifies an ROA name to be used for originating connections:

Router(config)#x25 roa green_list 23 35 36
Router(config)#interface serial 0/0
 Router(config-if)#x25 map ip 172.20.170.26 10 roa green_list

The following example specifies a network user ID (NUID) facility to send on calls originated for the address map:

Router(config)#interface serial 0/0
 Router(config-if)#x25 map ip 172.20.174.32 2 nudata "Network User ID 35"

Strings can be quoted, but quotation marks are not required unless embedded blanks are present.
Misconceptions:
None

Related commands:
x25 map compressedtcp


 Command:

x25 modulo

Mode:

Router(config-if)#

Syntax:

x25 modulo modulus

Syntax Description:
modulus

Either 8 or 128. The value of the modulo parameter must agree with that of the device on the other end of the X.25 link.

Command Description:

To set the window modulus, use the x25 modulo interface configuration command.

Usage Guidelines

X.25 supports flow control with a sliding window sequence count. The window counter restarts at zero upon reaching the upper limit, which is called the window modulus. Modulo 128 operation is also referred to as extended packet sequence numbering, which allows larger packet windows.
Example:

The following example sets the window modulus to 128:

Router(config)#interface serial 0
Router(config-if)#x25 modulo 128
Misconceptions:
None

Related commands:
x25 win
x25 wout


 Command:

x25 ops

Mode:

Router(config-if)#

Syntax:

x25 ops bytes

Syntax Description:
bytes

Byte count that is one of the following: 16, 32, 64, 128, 256, 512, 1024, 2048, or 4096.

Command Description:

To set the interface default maximum output packet size to match that of the network, use the x25 ops interface configuration command.

X.25 networks use maximum output packet sizes set by the network administrator. Larger packet sizes are better because smaller packets require more overhead processing. To send a packet larger than the X.25 packet size over an X.25 virtual circuit, the Cisco IOS software must break the packet into two or more X.25 packets with the more data bit (M-bit) set. The receiving device collects all packets with the M-bit set and reassembles the original packet.

Set the x25 ips and x25 ops commands to the same value unless your network supports asymmetry between input and output packets.
Example:

The following example sets the default maximum packet sizes to 512:

Router(config)#interface serial 1
 Router(config-if)#x25 ips 512
 Router(config-if)#x25 ops 512

Misconceptions:

None

Related commands:
x25 ips


 Command:

x25 pvc

Mode:

Router(config-if)#

Syntax:

x25 pvc circuit protocol address [protocol2 address2[...[protocol9 address9]]] x121-address
[option]

no x25 pvc circuit

Syntax Description:

circuit

Virtual-circuit channel number, which must be less than the virtual circuits assigned to the switched virtual circuits (SVCs).

protocol

Protocol type, entered by keyword. Supported protocols are listed in the Table below. As many as nine protocol and address pairs can be specified in one command line.

address

Protocol address of the host at the other end of the PVC.

x121-address

X.121 address.

option

(Optional) Provides additional functionality or allows X.25 parameters to be specified for the PVC. Can be any of the options listed in Table.

Command Description:

To establish an encapsulation permanent
virtual circuit (PVC), use the encapsulating version of the x25 pvc interface
configuration command. To delete the PVC, use the no form of this command
with the appropriate channel number.

PVCs are not supported for ISO CMNS.

You no longer need to specify a datagram protocol-to-address mapping before
you can set up a PVC; a map is implied from the PVC configuration.
Configurations generated by the router will no longer specify a map for
encapsulating PVCs.

When configuring a PVC to carry CLNS traffic, use the X.121 address as the
subnetwork point of attachment (SNPA) to associate the PVC with a CLNS neighbor
configuration. When configuring a PVC to carry transparent bridge traffic, the
X.121 address is required to identify the remote host to the bridging function.
Other encapsulation PVCs do not require an X.121 address.

Table lists supported protocols.

Table: Protocols Supported by X.25 PVCs
Keyword Protocol

apollo

Apollo Domain

appletalk

AppleTalk

bridge

Bridging1

clns

OSI Connectionless Network Service

compressedtcp

TCP/IP header compression

decnet

DECnet

ip

IP

ipx

Novell IPX

qllc

SNA encapsulation in X.252

vines

Banyan VINES

xns

XNS

1Bridging traffic is supported only for Cisco's traditional encapsulation method, so a bridge PVC cannot specify other protocols.
2QLLC is not available for multiprotocol encapsulation.

Table below lists supported X.25 PVC options.

Table: x25 pvc Options
Option Description

broadcast

Causes the Cisco IOS software to direct any broadcasts sent through this interface to this PVC. This option also simplifies the configuration of OSPF.

method {cisco | ietf | snap | multi}

Specifies the encapsulation method. The choices are as follows:

  • cisco—Single protocol encapsulation; not available if more than one protocol is carried.
  • ietf—Default RFC 1356 operation; single-protocol encapsulation unless more than one protocol is carried, and protocol identification when more than one protocol is carried.
  • snap—RFC 1356 operation where IP is identified when more than one protocol is carried using the SNAP encoding.
  • multi—Multiprotocol encapsulation used on the PVC.

packetsize in-size out-size

Maximum input packet size (in-size) and output packet size (out-size) for the PVC. Both values are typically the same and must be one of the following values: 16, 32, 64, 128, 256, 512, 1024, 2048, or 4096.

passive

Specifies that transmitted TCP datagrams will be compressed only if they were received compressed. This option is available only for PVCs carrying compressed TCP/IP header traffic.

windowsize in-size out-size

Packet count for input window (in-size) and output window (out-size) for the PVC. Both values are typically the same, must be in the range 1 to 127, and must be less than the value set for the x25 modulo command.

Example:

The following example establishes a PVC on channel 2 to encapsulate VINES and IP with the far host:

Router(config)#interface serial 0
Router(config-if)#x25 ltc 5
Router(config-if)#x25 pvc 2 vines 60002A2D:0001 ip 172.20.170.91 11110001
Misconceptions:
None

Related commands:
x25 map


 Command:

x25 win

Mode:

Router(config-if)#

Syntax:

x25 win packets

Syntax Description:

packets

Packet count that can range from 1 to one less than the window modulus.

Command Description:

To change the default incoming window size to match that of the network, use the x25 win interface configuration command.

Usage Guidelines

This command determines the default number of packets a virtual circuit can receive before sending an X.25 acknowledgment. To maintain high bandwidth utilization, assign this limit the largest number that the network allows.

Set x25 win and x25 wout to the same value unless your network supports asymmetric input and output window sizes.

Example:

The following example specifies that 5 packets may be received before an X.25 acknowledgment is sent:

Router(config)#interface serial 1
Router(config-if)#x25 win 5
Misconceptions:
None

Related commands:
x25 modulo
x25 wout


Command:

x25 wout

Mode:

Router(config-if)#

Syntax:

x25 wout packets

Syntax Description:
packets

Packet count that can range from 1 to one less than the window modulus.

Command Description:

To change the default outgoing window size to match that of the network, use the x25 wout interface configuration command.

This command determines the default number of packets a virtual circuit can send before waiting for an X.25 acknowledgment. To maintain high bandwidth utilization, assign this limit the largest number that the network allows.

Set x25 win and x25 wout to the same value unless your network supports asymmetric input and output window sizes.

Example:

The following example specifies a default limit of 5 for the number of outstanding unacknowledged packets for virtual circuits:

Router(config)#interface serial 1
Router(config-if)#x25 wout 5

Misconceptions:

None

Related commands:

x25 modulo

x25 win


Command:

area-password

Mode:

Router(config-router)#

Syntax:

area-password password
no area-password [password]

Syntax Description:

password

Password you assign.

Command Description:

To configure the IS-IS area authentication password, use the area-password command in router configuration mode. To disable the password, use the no form of this command.

By default, no area password is defined, and area password authentication is disabled.

Using the area-password command on all routers in an area will prevent unauthorized routers from injecting false routing information into the link-state database.

This password is exchanged as plain text and thus this feature provides only limited security.

This password is inserted in Level 1 (station router level) protocol data unit (PDU) link-state packets (LSPs), complete sequence number PDUs (CSNPs), and partial sequence number PDUs (PSNP).

Example:

The following example assigns an area authentication password:

Router(config-router)# area-password angel

Misconceptions:

None

Related Commands:

domain-password
isis password


Command:

ip local policy route-map

Mode:

Router(config)#

Syntax:

ip local policy route-map map-tag
no ip local policy route-map map-tag

Syntax Description:

map-tag Name of the route map to use for local policy routing. The name must match a map-tag value specified by a route-map command.

Command Description:

To identify a route map to use for local policy routing, use the ip local policy route-map command in global configuration mode. To disable local policy routing, use the no form of this command.

Packets that are generated by the router are not normally policy routed. However, you can use this command to policy route such packets. You might enable local policy routing if you want packets originated at the router to take a route other than the obvious shortest path.

The ip local policy route-map command identifies a route map to use for local policy routing. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria--the conditions under which packets should be policy routed. The set commands specify the set actions—the particular policy routing actions to perform if the criteria enforced by the match commands are met. The no ip local policy route-map command deletes the reference to the route map and disables local policy routing.

By default, packets that are generated by the router are not policy routed.

Example:

The following example sends packets with a destination IP address matching that allowed by extended access list 131 to the router at IP address 172.130.3.20:

Router(config)#ip local policy route-map xyz

Router(config)#route-map xyz
Router(config-route-map)#match ip address 131
Router(config-route-map)#set ip next-hop 172.130.3.20

Misconceptions:

None

Related Commands:

match ip address
match length
route-map
set default interface
set interface
set ip default next-hop verify-availability
set ip next-hop
show ip local policy


Command:

lsp-refresh-interval (IS-IS)

Mode:

Router(config-router)#

Syntax:

lsp-refresh-interval seconds
no lsp-refresh-interval seconds

Syntax Description:

seconds Interval (in seconds) at which LSPs are refreshed.The range is 1 to 65535 seconds. The default value is 900 seconds (15 minutes).

Command Description:

To set the link-state packet (LSP) refresh interval, use the lsp-refresh-interval command in router configuration mode. To restore the default refresh interval, use the no form of this command.

The refresh interval determines the rate at which Cisco IOS software periodically transmits in LSPs the route topology information that it originates. This is done to keep the database information from becoming too old.

LSPs must be periodically refreshed before their lifetimes expire. The value set for the lsp-refresh-interval command should be less than the value set for the max-lsp-lifetime command; otherwise, LSPs will time out before they are refreshed. If you misconfigure the LSP lifetime to be too low compared to the LSP refresh interval, the software will reduce the LSP refresh interval to prevent the LSPs from timing out.

Reducing the refresh interval reduces the amount of time that undetected link state database corruption can persist at the cost of increased link utilization. (This is an extremely unlikely event, however, because there are other safeguards against corruption.) Increasing the interval reduces the link utilization caused by the flooding of refreshed packets (although this utilization is very small).

Example:

The following example configures the IS-IS LSP refresh interval to be 1080 seconds (18 minutes):

Router(config)# router isis
Router(config-router)# lsp-refresh-interval 1080

Misconceptions:

None

Related Commands:

max-lsp-lifetime (ISIS)


Command:

network (DHCP)

Mode:

Router(config-dhcp)#

Syntax:

network network-number [mask | prefix-length]
no network

Syntax Description:

network-number | The IP address of the DHCP address pool.
mask | (Optional) The bit combination that renders which portion of the address of the DHCP address pool refers to the network or subnet and which part refers to the host.
prefix-length | (Optional) Specifies the number of bits that comprise the address prefix. The prefix is an alternative way of specifying the network mask of the client. The prefix length must be preceded by a forward slash (/).

Command Description:

To configure the subnet number and mask for a Dynamic Host Configuration Protocol (DHCP) address pool on a Cisco IOS DHCP Server, use the network DHCP pool configuration command. To remove the subnet number and mask, use the no form of this command.

This command is valid for DHCP subnetwork address pools only. If the mask or prefix length is not specified, the class A, B, or C natural mask is used. The DHCP Server assumes that all host addresses are available. The system administrator can exclude subsets of the address space by using the ip dhcp excluded-address command.

You can not configure manual bindings within the same pool that is configured with the network command.

Example:

The following example configures 172.16.0.0/16 as the subnetwork number and mask of the DHCP pool:

Router(config-dhcp)# network 172.16.0.0/16

Misconceptions:

None

Related Commands:

ip dhcp excluded-address
ip dhcp pool


Command:

show clock

Mode:

Router#
Router>

Syntax:

show clock [detail]

Syntax Description:

detail

(Optional) Indicates the clock source (NTP, VINES, hardware clock, and so on) and the current summer-time setting (if any).

Command Description:

To display the time and date from the system software clock, use the show clock EXEC command.

The software clock keeps an "authoritative" flag that indicates whether the time is authoritative (believed to be accurate). If the software clock has been set by a timing source (for example, via NTP), the flag is set. If the time is not authoritative, it will be used only for display purposes. Until the clock is authoritative and the "authoritative" flag is set, the flag prevents peers from synchronizing to the software clock.

The symbol that precedes the show clock display indicates the following:

Symbol

Description

*

Time is not authoritative.

(blank)

Time is authoritative.

.

Time is authoritative, but NTP is not synchronized.

Note In general, NTP synchronization takes approximately 15 to 20 minutes.

Example:

The following sample output shows that the current clock is authoritative and that the time source is NTP:

Router> show clock detail

15:29:03.158 PST Mon Mar 3 1999

Time source is NTP

The following example shows the current clock is authoritative, but NTP is not yet synchronized:

Router> show clock

.16:42:35.597 UTC Wed Nov 1 1999

Misconceptions:

This command does not provide a high level of network security. If you use this command, you should also take additional network security measures.
Related Commands:

clock set
show calendar


Command:

spanning-tree mode

Mode:

Switch(config)#

Syntax:

spanning-tree mode {mst | pvst | rapid-pvst}

no spanning-tree mode

Syntax Description:

mst | Enable MST. This keyword is available only if your switch is running the enhanced software image (EI).
pvst | Enable PVST.
rapid-pvst | Enable PVRST. This keyword is available only if your switch is running the EI.

Command Description:

Use the spanning-tree mode global configuration command to enable per-VLAN spanning-tree (PVST), per-VLAN rapid spanning-tree (PVRST), or multiple spanning tree (MST) on your switch. Use the no form of this command to return to the default setting. The switch must run all STP instances in one of these modes: PVST, PVRST, or MST. The switch cannot run PVST and MST or PVRST and MST at the same time.

Example:

This example shows to enable MST on the switch:

Switch(config)# spanning-tree mode mst

This example shows to enable PVRST on the switch:

Switch(config)# spanning-tree mode rapid-pvst

You can verify your setting by entering the show running-config privileged EXEC command.

Misconceptions:

None.

Related Commands:

None.


Command:

cgmp leave-processing

Mode:

Switch(config)#

Syntax:

cgmp leave-processing

no cgmp leave-processing

Syntax Description:

This command has no arguments or keywords.

Command Description:

Use the cgmp (leave-processing) global configuration command to enable Cisco Group Management Protocol (CGMP) Fast Leave processing. The no form of the command disables CGMP Fast Leave processing.

Fast Leave processing optimizes the use of network bandwidth by reducing the delay between members of a multicast group leaving the group and the actual pruning of multicast traffic to that segment.

Example:

This command enables CGMP Fast Leave processing.

Switch(config)#cgmp leave-processing

Misconceptions:

This command is available only if CGMP is enabled. Otherwise, the command is not recognized.

Related Commands:

cgmp

show cgmp


%command%

Command:

clear clns neighbors

Mode:

Router#

Syntax:

clear clns [tag] neighbors

Syntax Description:

tag

(Optional) Meaningful name for a routing process. For example, you could define a routing process named Finance for the Finance department, and another routing process named Marketing for the Marketing department. If not specified, a null tag is assumed. The tag argument must be unique among all CLNS router processes for a given router.

Command Description:

To remove CLNS neighbor information from the adjacency database, use the clear clns neighbors command in EXEC mode.

Example:

The following example removes the CLNS neighbor information from the adjacency database:

Router#clear clns neighbors

Misconceptions:

None

Related commands:

show clns neighbors


Command:

clear counters

Mode:

Router#

Syntax:

clear counters interface-type number

Syntax Description:

interface-type

Type of interface to be configured

number

This represents a port, connector, or interface card number. On a Cisco 4000 series router, it specifies the NPM number. The numbers are assigned at the factory at the time of installation or when added to a system, and can be displayed with the show interfaces command.

Command Description:

Many steps occur during the processing of a packet, and tests are performed at each step. The outcome of each step is recorded in an interface counter. Network administrators can analyze these interface counters to determine the reasons for sluggish router and network performance. This command is used to set all the counters of the specified interfaces to zero.

Example:

The following command resets all the counters of the ethernet 0 interface to zero.

Router#clear counters ethernet 0

Misconceptions:

None

Related Commands:

show interfaces


Credits

 Concept Design:

Dennis Frezzo

Lead Design:

Michael Wang

Lead Implementation:

Tony Deng

Tim Pyne

Programming:

Mark Chen

Tony Chen

Al Danklefsen

Tony Deng

Tim Pyne

Michael Wang

Daniel Wu

Kalven Wu

Editing:

John Chen

Tony Deng

Tim Pyne

Special Thanks:

WWE Review Team

QA Team

Cisco Documentation

Related Credits:

None


Command:

distribute-list

Mode:

Router(config-router)#

Syntax:

distribute-list {access-list number | gateway | prefix} in | out [type number]

no distribute-list {access-list number | gateway | prefix} in | out [type number]

Syntax Description:

in

Filters incoming updates

out

Filters outgoing updates

access-list number | prefix | gateway

A standard IP access list number. The access list defines which networks are to be received or sent (depending on whether the in or out parameter is used) and defines which networks are to be suppressed in routing updates. The keyword gateway filters incoming updates based on gateway. The keyword prefix filters based on prefixes contained in routing updates.

type

(Optional) Interface type. If no interface is specified, the access list will be applies to all incoming or outgoing updates (depending on whether the in or out parameter is used).

number

(Optional) Interface number on which the access list is applied to incoming or outgoing updates (depending on whether the in or out parameter is used).

Command Description:

The distribute-list command is used to filter networks received or transmitted in routing updates. A network is defined using a standard access list. The optional [type number] argument allows filtering on a specific interface.

Example:

Router(config-router)#distribute-list 5 in serial 0/0

Misconceptions:

The distribute-list command works with all routing protocols (unlike some other methods of controlling routing updates). However, with OSPF, routes cannot be filtered from entering the OSPF database. The distribute-list in command only filters routes from entering the routing table, but it does not prevent link-state packets from being propagated. The command distribute-list out works only on routes being redistributed by ASBRs into OSPF. The command can be applied to external type 2 and external type 1 routes, but not to intra-area and inter-area routes.

Related Commands:

access-list (IP standard)

access-list (IP extended)

passive-interface

redistribute


Command:

encapsulation dot1q

Mode:

Router(config-subif)#

Syntax:

encapsulation dot1q vlan-id [native]

no encapsulation dot1q

Syntax Description:

vlan-id

This represents a VLAN identifier that has an allowed range from 1 to 4095.

native

(Optional) Sets the PVID value of the port to the vlan-id value

Command Description:

To enable IEEE 802.1Q encapsulation of traffic on a specified subinterface in virtual LANs (VLANs), use the encapsulation dot1q subinterface configuration command.

IEEE 802.1Q encapsulation is configurable on Fast Ethernet interfaces. IEEE 802.1Q is a standard protocol for interconnecting multiple switches and routers and for defining VLAN topologies.

Example:

The following example sets subinterface fastethernet 4/1.100 for trunking protocol of dot.1q.

Router(config)#interface fastethernet 4/1.100
Router(config-subif)#encapsulation dot1q 100

Misconceptions:

None

Related Commands:

encapsulation isl


Command:

encapsulation isl

Mode:

Router(config-subif)#

Syntax:

encapsulation isl vlan-identifier

no encapsulation isl

Syntax Description:

vlan-identifier

This represents a VLAN identifier that has an allowed range from 1 to 1000.

Command Description:

To enable the Inter-Switch Link (ISL), use the encapsulation isl command in subinterface configuration mode.

ISL is a Cisco protocol for interconnecting multiple switches and routers, and for defining VLAN topologies.

ISL encapsulation is configurable on Fast Ethernet interfaces.

ISL encapsulation adds a 26-byte header to the beginning of the Ethernet frame. The header contains a 10-bit VLAN identifier that conveys VLAN membership identities between switches.

Example:

The following example sets subinterface fastethernet 2/1.20 for trunking protocol of ISL:

Router(config)#interface FastEthernet 2/1.20
Router(config-subif)#encapsulation isl 400

Misconceptions:

None

Related Commands:

encapsulation dot1q


Command:

fabric switching-mode allow

Mode:

Router(config)#

Syntax:

fabric switching-mode allow {bus-mode | {truncated [{threshold [mod]}]}}
no fabric switching-mode allow {bus-mode | {truncated [threshold]}}

Syntax Description:

bus-mode | Specifies bus-only mode.
truncated | Specifies truncated mode.
threshold mod | (Optional) Number of Switch Fabric Module-capable modules that are needed for truncated switching; see the "Usage Guidelines" section for additional information.

Command Description:

To enable truncated mode in the presence of two or more fabric-enabled switching modules, use the fabric switching-mode allow command. Use the no form of this command to disable truncated mode.

Bus mode--The switch uses this mode for traffic between nonfabric-enabled modules and for traffic between a nonfabric-enabled module and a fabric-enabled module. In this mode, all traffic passes between the local bus and the supervisor engine bus.

Truncated mode--The switch uses this mode for traffic between fabric-enabled modules when there are both fabric-enabled and nonfabric-enabled modules installed. In this mode, the switch sends a truncated version of the traffic (the first 64 bytes of the frame) over the switch fabric channel.

Compact mode--The switch uses this mode for all traffic when only fabric-enabled modules are installed. In this mode, a compact version of the DBus header is forwarded over the switch fabric channel, which provides the best possible performance.

To prevent use of nonfabric-enabled modules or to prevent fabric-enabled modules from using bus mode, enter the no fabric switching-mode allow bus-mode command.

The fabric switching-mode allow command affects switches configured with a minimum of two fabric-enabled modules.

You can enter the fabric switching-mode allow truncated command to unconditionally allow truncated mode.

You can enter the no fabric switching-mode allow truncated command to allow truncated mode if the threshold is met.

You can enter the no fabric switching-mode allow bus-mode command to prevent any module from running in bus-mode.

To return to the default truncated-mode threshold, enter the no fabric switching-mode allow truncated threshold command.

The valid value for mod is the threshold value.

Example:

This example shows how to specify truncated mode:

Router (config)# fabric switching-mode allow truncated

Misconceptions:

None

Related Commands:

fabric required


 Command:

group-range

Mode:

Router(config-if)#

Syntax:

group-range low-end-of-range high-end-of-range

no group-range interface

Syntax Description:
low-end-of-range

Beginning interface number to be made a member of the group interface.

high-end-of-range

Ending interface number to be made a member of the group interface.

Command Description:

To create a list of member asynchronous interfaces (associated with a group interface), use the group-range interface configuration command. Use the no form of the command to remove an interface from the member list.

Usage Guidelines

Using the group-range command, you create a group of asynchronous interfaces that are associated with a group asynchronous interface on the same device. This group interface is configured by using the interface group-async command. This one-to-many structure allows you to configure all associated member interfaces by entering one command on the group interface, rather than entering this command on each interface. You can customize the configuration on a specific interface by using the member command.
Example:

The following example defines interfaces 2, 3, 4, 5, 6, and 7 as members of asynchronous group interface 0:

Router(config)#interface group-async 0
Router(config-if)#group-range 2 7

Misconceptions:
None

Related Commands:
interface group-async


 Command:

help

Mode:

Router>
Router#
Router(config)#
Router(config-if)#
Router(config-line)#
Router(config-router)#

Syntax:

help

Syntax Description:

This command has no arguments or keywords.

Command Description:

To display a brief description of the help system, enter the help command.

Example:
Router#help
Help may be requested at any point in a command by entering
a question mark '?'.  If nothing matches, the help list will
be empty and you must backup until entering a '?' shows the
available options.
Two styles of help are provided:
1. Full help is available when you are ready to enter a
   command argument (e.g. 'show ?') and describes each possible
   argument.
2. Partial help is provided when an abbreviated argument is entered
   and you want to know what arguments match the input
   (e.g. 'show pr?'.)

Misconceptions:

None

Related Commands:
None


 Command:

ip domain-lookup

Mode:

Router(config)#

Syntax:

ip domain-lookup

no ip domain-lookup

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the IP Domain Naming System (DNS)-based host name-to-address translation, use the ip domain-lookup global configuration command. To disable the DNS, use the no form of this command.

Example:
Router(config)#ip domain-lookup

Misconceptions:
None

Related Commands:
ip domain-name


 Command:

ipx route-cache

Mode:

Router(config-if)#

Syntax:

ipx route-cache

no ipx route-cache

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable IPX fast switching, use the ipx route-cache interface configuration command. To disable fast switching, use the no form of this command. Fast switching allows higher throughput by switching packets using a cache created by previous transit packets. Fast switching is enabled by default on all interfaces that support fast switching, including Token Ring, Frame Relay, PPP, SMDS, and ATM. You might want to disable fast switching in two situations. One is if you want to save memory on the interface cards. Fast-switching caches require more memory than those used for standard switching. The second situation is to avoid congestion on interface cards when a high-bandwidth interface is writing large amounts of information to a low-bandwidth interface.

Example:

Router(config-if)#ipx route-cache

Misconceptions:
None

Related Commands:
clear ipx cache


 Command:

ipx router

Mode:

Router(config)#

Syntax:

ipx router {eigrp autonomous-system-number | nlsp [tag] | rip}

no ipx router {eigrp autonomous-system-number | nlsp [tag] | rip}

Syntax Description:
eigrp autonomous-system-number

Enables the EIGRP routing protocol. The argument autonomous-system-number is the EIGRP autonomous system number. It can be a number from 1 to 65535.

nlsp [tag]

Enables the NLSP routing protocol. The optional argument tag names the NLSP process to which you are assigning the NLSP protocol. If the router has only one process, defining a tag is optional. A maximum of three NLSP processes may be configured on the router at the same time. The tag can be any combination of printable characters.

rip

Enables the RIP routing protocol. It is on by default.

Command Description:

To specify the routing protocol to use, use the ipx router global configuration command. To disable a particular routing protocol on the router, use the no form of this command. RIP must be explicitly disabled by issuing the no ipx router rip command if this routing protocol is not to be used. Also, multiple EIGRP processes on a router can be configured. To do so, assign each a different autonomous system number.

Example:

Router(config)#ipx router eigrp  4
Router(config-ipx-router)#

Misconceptions:
None

Related Commands:
ipx routing
ip routing


 Command:

ipx routing

Mode:

Router(config)#

Syntax:

ipx routing node

no ipx routing

Syntax Description:

node

The node number is either user specified or the MAC address of the first Ethernet, Token or FDDI card.

Command Description:

To enable IPX routing, use the ipx routing global configuration command. To disable IPX routing, use the no form of this command. Node is a 48-bit value represented by a dotted triplet of four-digit hexadecimal numbers (xxxx.xxxx.xxxx). It must not be a multicast address. If you omit node, the Cisco IOS software uses the hardware MAC address currently assigned to it as its node address. This is the MAC address of the first Ethernet, Token Ring, or FDDI interface card. If no satisfactory interfaces are present in the router (such as only serial interfaces), you must specify node.

Example:
Router(config)#ipx routing

Misconceptions:
None

Related Commands:
ip routing
ipx router


 Command:

ipx sap-incremental

Mode:

Router(config-if)#

Syntax:

ipx sap-incremental eigrp autonomous-system-number rsup-only

no ipx sap-incremental eigrp autonomous-system-number rsup-only

Syntax Description:
eigrp autonomous-system-number: IPX EIGRP autonomous system number. It can be a number from 1 to 65535.
rsup-only: (Optional) Indicates that the system uses EIGRP on this interface to carry reliable SAP update information only. RIP routing updates are used, and EIGRP routing updates are ignored.

Command Description:

To send Service Advertising Protocol (SAP) updates only when a change occurs in the SAP table, use the ipx sap incremental interface configuration command. To send periodic SAP updates, use the no form of this command.

Example:

The following example sends SAP updates on Ethernet interface 0 only when there is a change in the SAP table:
Router(config)#interface ethernet 0
Router(config-if)#ipx sap-incremental eigrp 200

Misconceptions:

None

Related Commands:
None


 Command:

lock

Mode:

Router#

Syntax:

lockable

no lockable

Syntax Description:

This command has no arguments or keywords.

Command Description:

To enable the lock EXEC command, use the lockable global configuration command. This allows a user to lock a privileged exec session using the lock command. A locked session allows the user to leave a privilege exec session and not leave it available for someone to change. When a lock command is issued, the user will be prompted for a password and a conformation of that password. When the password and confirmation is entered, the session is locked. The user must press the Enter key and enter this password to resume the session.

Example:

The following example is the dialog of the use of the lockable and lock commands

Router#conf t
Router(config)#line console  0
Router(config-line)#lock
Router(config-line)#lockable
Router(config-line)#^z
Router#lock

Password:

Again:

Locked

Misconceptions:
None

Related Commands:
lockable
line


 Command:

login (switch)

Mode:

Switch(config-line)#

Syntax:

login [local | tacacs]

no login

Syntax Description:

local

(Optional) Select local password checking. Authentication is based on the username specified with the username global configuration command.

tacacs

(Optional) Select the Terminal Access Controller Access Control System (TACACS)-style user ID and password-checking mechanism.

Command Description:

Use the login line configuration command to enable password checking at login. Use the no form of this command to disable password checking and to allow connections without a password.

If you specify the login command without the local or tacacs option, authentication is based on the password specified with the line configuration password command.
Example:

The following example shows how to set the password letmein on
virtual terminal line 4:

Switch(config-line)# line vty 4
Switch(config-line)# password letmein
Switch(config-line)# login

The following example shows how to enable the TACACS-style user ID and
password-checking mechanism:

Switch(config-line)# line 0
Switch(config-line)# password <mypassword>
Switch(config-line)# login tacacs

You can verify the previous commands by entering the show running-config
command in privileged EXEC mode.
Misconceptions:

This command cannot be used with authentication, authorization, and accounting (AAA)
and TACACS+. Use the login authentication command instead.

Related Commands:
None


 Command:
no ip domain-lookup

Mode:
Router(config)#

Syntax:
no ip domain-lookup

Syntax Description:
None

Command Description:
Use this command to disable the router from looking up the
ip address of a host when an incorrect command is entered.
This is the no form of the command ip domain-lookup.
See under ip domain-lookup under related commands.

Example:
Router(config)#no ip domain-lookup

Misconceptions:
None

Related Commands:
ip domain-lookup


 Command:

no logging console

Mode:

Router(config)#

Syntax:

no logging console

Syntax Description:
None

Command Description:
Use this command to prevent router information to be outputed onto screen.
This is the no form of the command logging console. See logging console under related commands.

Example:
Router(config)#no logging console

Misconceptions:
None

Related Commands:
logging console


 Command:

no shutdown

Mode:

Router(config-if)#

Syntax:

no shutdown

Syntax Description:

none

Command Description:

To disable an interface, use the shutdown configuration command. To restart a disabled interface, use the no form of this command

Example:

Router(config-if)#no shutdown
Misconceptions:
None

Related Commands:
interface


show spantree (IOS)

Command:

show spantree (IOS)

Mode:

Router#

Syntax:

show spantree [vlan] [active]
show spantree mod/port

Syntax Description:

vlan | (Optional) Number of the VLAN; valid values are from 1 to 1001 and from 1025 to 4094.
active | (Optional) Displays only the active ports.
mod/port | Number of the module and the port on the module.

Command Description:

To display spanning-tree information for a VLAN or port, use the show spantree command in privileged EXEC mode.

If you do not specify the VLAN number, VLAN 1 is displayed.

If you are in Multiple Instances of Spanning Tree (MISTP) mode, instance information is not displayed.

The maximum length of the channel port list can be 47. The space in the Port(s) column might not be enough to display the entire list in one line. If this is the case, the port list is split into multiple lines. For example, in the following display, ports 6/5-8, 6/13, 6/15, 6/17, 6/19 are channeling:

  .
  .
  .
  Port(s) Vlan Port-State Cost Prio Portfast Channel_id
  ------------------------ ---- ------------- --------- ---- -------- ----------
  6/5-8,6/13,6/15,6/17,6/1 1 not-connected 2684354 32 disabled 0
  9
  .
  .
  .
The Link Aggregation Control Protocol (LACP) channel protocol does not support half-duplex links. If a port is in active/passive mode and becomes half duplex, the port is suspended (and a syslog message is generated). The port is shown as "connected" using the show port command and as "not connected" using the show spantree command. This discrepancy is because the port is physically connected but never joined between spanning tree. To get the port to join spanning tree, either set the duplex to full or set the channel mode to off for that port.

Example:

The following example shows how to display the active spanning tree port configuration for VLAN 1 while in Per VLAN Spanning Tree (PVST+ mode):

Router#show spantree 1 active
VLAN 1
Spanning tree mode PVST+
Spanning tree type ieee
Spanning tree enabled
Designated Root 00-60-70-4c-70-00
Designated Root Priority 16384
Designated Root Cost 19
Designated Root Port 2/3
Root Max Age 14 sec Hello Time 2 sec Forward Delay 10 sec
Bridge ID MAC ADDR 00-d0-00-4c-18-00
Bridge ID Priority 32768
Bridge Max Age 20 sec Hello Time 2 sec Forward Delay 15 sec
Port Vlan Port-State Cost Prio Portfast Channel_id
------------------------ ---- ------------- --------- ---- -------- ----------
2/3 1 forwarding 19 32 disabled 0
2/12 1 forwarding 19 32 disabled 0

The following example shows how to display the active spanning-tree port configuration for VLAN 1 (while in MISTP mode):

Router#show spantree 1 active
VLAN 1
Spanning tree mode MISTP
Spanning tree type ieee
Spanning tree enabled
VLAN mapped to MISTP Instance: 1
Port Vlan Port-State Cost Prio Portfast Channel_id
------------------------ ---- ------------- --------- ---- -------- ----------
2/3 1 forwarding 200000 32 disabled 0
2/12 1 forwarding 200000 32 disabled 0
Field | Description
VLAN | VLAN for which the spanning-tree information is shown.
Spanning tree | Status of whether Spanning Tree Protocol is enabled or disabled.
Designated Root | MAC address of the designated spanning-tree root bridge.
Designated Root Priority | Priority of the designated root bridge.
Designated Root Cost | Total path cost to reach the root.
Designated Root Port | Port through which the root bridge can be reached (shown only on nonroot bridges).
Root Max Age | Amount of time a bridge packet data unit (BPDU) packet should be considered valid.
Hello Time | Number of times the root bridge sends BPDUs.
Forward Delay | Amount of time the port spends in listening or learning mode.
Port | Port number.
Vlan | VLAN to which the port belongs.
Port-State | Spanning tree port state (disabled, inactive, not-connected, blocking, listening, learning, forwarding, bridging, or type-pvid-inconsistent).
Cost | Cost associated with the port.
Prio | Priority associated with the port.
Portfast | Status of whether the port is configured to use the PortFast feature.
Channel_id | Channel ID number.

Misconceptions:

None

Related commands:

show spantree backbonefast


 Command:

show status

Mode:

Router#

Syntax:

show status

Syntax Description:

This command has no arguments or keywords.

Command Description:

This command is used to display the status of the BRI channels.

Example:

Router#show status

Misconceptions:
None

Related commands:
show isdn active
show isdn status