End of Support

Support for Layer 3 MTU on 7280R3/7500R3/7800R3

7280R3/7500R3/7800R3 switches support Layer 3 Maximum Transmission Unit (MTU) with the following features:

These switches enforce the MTU for Layer 3 packets. You can set the MTU on any SVI. The switch enforces the MTU of that specific SVI when packets egress out of a trunk port. 7280E/R/R2 and 7500E/R/R2 line cards do not support this behavior.
The switch enforces the MTU after adding all encapsulation headers to the egress packet. For example, if you configure an interface with an MTU value of 1500 and the packet size exceeds 1500 after the switch adds all encapsulation headers, the switch considers the packet to have violated the MTU. The 7280E/R/R2 and 7500E/R/R2 line cards enforce the MTU before adding encapsulation headers.
The system configures the actual MTU in hardware as the MTU configured in the CLI plus 18 bytes. It adds 18 bytes to accommodate the L2 header. If the outgoing packet is untagged, the system configures the actual MTU in hardware as the MTU configured in the CLI plus four (4) bytes.

Layer 3 MTU Configuration

You configure Layer 3 MTU on Layer 3 interfaces and SVIs using the mtu command within interface configuration mode.

This command sets the MTU size of 1492 bytes on interface ethernet 1/1.

(config)# interface ethernet 1/1
(config-if-Et1/1)# mtu 1492

MTU is independently configurable on all routable interfaces. The switch supports MTU sizes ranging from 68 to 9214 bytes. The default MTU size is 1500 bytes.

The no mtu and default mtu commands restore the interface MTU to the default value by removing the corresponding mtu command from running-config.

Note: On platforms without per interface Layer 3 MTU enforcement, EOS disables the mtu command and it does not appear in the Interface Configuration Mode.

Layer 3 MTU Show Commands

The show interfaces command displays the MTU configured on the L3 interface (ethernet 1/1), as shown in the following example. The IP MTU represents the interface's Layer 3 MTU value.

Example

switch(config-if-Et9/1)# show interfaces ethernet 1/1
...
  IP MTU 1600 bytes , BW 100000000 kbit
  Full-duplex, 100Gb/s over 4 lanes, auto negotiation: off, uni-link: n/a
...

L3 MTU Considerations

The following considerations apply to support of Layer 3 MTU:

A switch supports only three (3) unique MTU values. If you configure more than three (3) unique MTU values, the switch will not enforce additional unique MTU definitions on an interface.
- When the number of unique MTU values becomes less than three (3) (after unconfiguring MTU on some interfaces), MTU on previously unprogrammed interfaces is not reprogrammed automatically. CLI commands no mtu followed by mtu must be called to program MTU on an interface.
When the startup configuration has more than three (3) unique MTU values defined on different switch interfaces, it is not guaranteed which unique MTU values will be active when the switch is rebooted.
Jericho2-based platforms do not enforce L3 MTU on Multicast packets.

VRRP and VARP

A virtual IP (VIP) address is an IP address that does not directly connect to a specific interface. Inbound packets sent to a Virtual IP address are redirected to a physical network interface. VIPs support connection redundancy by assigning the address to multiple switches. If one device becomes unavailable, packets sent to the address are still serviced by the functioning device.

Arista switches support virtual IP addresses through Virtual Router Redundancy Protocol, version 2 (VRRPv2), Virtual Router Redundancy Protocol, version 3 (VRRPv3), and Virtual-ARP (VARP). This chapter describes the Arista switch support of virtual IP addresses and contains these sections:

VRRP and VARP Conceptual Overview
VRRP and VARP Implementation Procedures
VRRP and VARP Implementation Examples
VRRP and VARP Configuration Commands

VRRP and VARP Conceptual Overview

This section review the following topics:

VRRPv2
VRRPv3
VARP

VRRPv2

A virtual router, also known as a virtual router group, is defined by a Virtual Router Identifier (VRID) and a virtual IP address. A virtual routers mapping of VRID and IP address must be consistent among all switches implementing the virtual router group. A virtual routers scope is restricted to a single LAN.

A LAN may contain multiple virtual routers for distributing traffic. Each virtual router on a LAN is assigned a unique VRID. A switch may be configured with virtual routers among multiple LANs.

VRRP uses priority ratings to assign Master or Backup roles for each VRRP router configured for a virtual router group. The Master router sends periodic VRRP Advertisement messages along the LAN and forwards packets received by the virtual router to their destination. Backup routers are inactive but are available to assume Master router duties when the current Master fails.

A VRRP can be configured to allow VRRP routers with higher priority to take over Master router duties. Alternatively, the group can be configured to prevent a router from preemptively assuming the Master role. A VRRP router is always assigned the Master of any virtual router configured with the address owned by the VRRP router, regardless of the preemption prevention setting.

On 7280R3, 7500R3 and 7800R3 series, maximally 14 unique VRRP groups can be configured along with VARP and MLAG Peer gateway virtual MAC capabilities.

VRRPv3

RFC 5798 defines version 3 of the Virtual Router Redundancy Protocol (VRRP) for both IPv4 and IPv6. It is based on version 2 of VRRP, as defined in RFC 3768.

VARP

Virtual VRRP (VARP) allows multiple switches to simultaneously route packets from a common IP address in an active-active router configuration. Each switch is configured with the same set of virtual IP addresses on corresponding VLAN interfaces and a common virtual MAC address. In MLAG configurations, VARP is preferred over VRRP because VARP does not require traffic to traverse the peer-link to the master router as VRRP would.

A maximum of 500 virtual IP addresses can be assigned to a VLAN interface. All virtual addresses on all VLAN interfaces resolve to the same virtual MAC address.

VARP functions by having each switch respond to ARP and GARP requests for the configured router IP address with the virtual MAC address. The virtual MAC address is only for inbound packets and never used in the source field of outbound packets.

When ip routing is enabled, packets to the virtual MAC address are routed to the next hop destination.

The following sections are included in this chapter:

VRRP and VARP Conceptual Overview
VRRP and VARP Implementation Procedures
VRRP and VARP Implementation Examples
VRRP and VARP Configuration Commands

VRRP and VARP Implementation Procedures

This section contains the following configuration instructions:

VRRP Configuration for IPv4
VRRP Configuration for IPv6
VARP Configuration

VRRP Configuration for IPv4

To implement a virtual router, it must be configured and enabled. A virtual router is typically configured before it is enabled; this ensures that the VRRP router operates as required before its priority settings immediately make it the master virtual router. Because assigning a primary address to a virtual router enables it, address assignment is normally performed after all other configuration tasks.

The no vrrp command removes all VRRP commands for the specified virtual router from running-config.

Virtual Router Configuration

Most configuration tasks are optional because all mandatory parameters have a default value. The following virtual router parameters are configurable:

VRRP version (default = version 2)
Router priority (default = 100)
Preemption option (default is enabled)
Advertisement timer (default = one second)
Description (optional parameter)
Peer authentication (optional parameter)
Secondary IP addresses (optional parameter)

VRRP Version

The vrrp ipv4 version command sets the version of VRRP for the corresponding IPv4 virtual router. IPv6 version is not configurable as it only supports version 3. The version selected in a VRRP group can either be same for all group members or independent of each other. By default, Arista switches use VRRP version 2, which supports only IPv4 environments. VRRP version 3 supports both IPv4 and IPv6 environments.

Example

This command causes vlan 20 to use VRRP version 3.

switch(config)# interface vlan 20
switch(config-if-vl20)# vrrp 1 ipv4 version 3
switch(config-if-vl20)#

Master and Backup Router

The VRRP routers within a virtual router group determine the Master router through priority settings. Priority values range from 254 (highest priority) to 1 (lowest priority). Priority is either set by a CLI command or is assigned the default value of 100. A switch specifies priority settings for each of its virtual routers. Once set, VRRP priority level can also be changed by a tracked object. The vrrp tracked-object command configures the VRRP client process to track an object created by the track command and react if its status changes to down.

Preemption mode determines when a VRRP router with a higher priority rating becomes the Master router. If preemption is enabled, the VRRP router with the highest priority immediately becomes the Master router. If preemption is disabled, a VRRP router with a higher priority value does not become the Master router unless the current Master becomes unavailable; this is applicable when a new VRRP router becomes available on the LAN or VRRP routers priority value changes for the virtual router.

The vrrp priority-level command configures the switchs priority setting for the specified virtual router.

Example

This command sets the priority value of 250 for the virtual router with VRID 15 on VLAN 20.

switch(config-if-vl20)# vrrp 15 priority-level 250
switch(config-if-vl20)#

The vrrp preempt command controls the preempt mode setting of the specified virtual router. By default, preempt mode is enabled.

Examples

This command disables preempt mode for the virtual router 15 on vlan 20.
```
switch(config-if-vl20)# no vrrp 15 preempt
switch(config-if-vl20)#
```
This command enables preempt mode for the virtual router 30 on vlan 20.
```
switch(config-if-vl20)#vrrp 30 preempt
switch(config-if-vl20)#
```

The vrrp preempt delay command configures a period between an event that elevates a switch to master VRRP router status and the switch's assumption of master VRRP router role. Command options configure delays during normal operation and after a switch reboot.

Advertisement Interval

The Master router sends periodic VRRP Advertisement messages to other VRRP routers. The vrrp advertisement interval command specifies the interval between successive advertisement message transmissions.

The advertisement interval also defines the timeout that determines when the switch assumes the Master router role. This timeout interval is three times the advertisement interval.

Example

This command sets the advertisement interval of 10 seconds for virtual router 35 on vlan 100.

switch(config-if-vl100)# vrrp 35 advertisement interval 10
switch(config-if-vl100)#

Description

The vrrp session description command associates a text string to the specified virtual router. The maximum string length is 80 characters. The string has no functional impact on the virtual router.

Example

This command associates the text string Laboratory Router to virtual router 15 on vlan 20.

switch(config-if-vl20)# vrrp 15 session description Laboratory Router
switch(config-if-vl20)#

Peer Authentication

VRRP peer authentication validates VRRP advertisement packets that the switch receives from other VRRP routers in a specified virtual router group. When a virtual router uses authentication, all VRRP routers in the group must use the same authentication parameters.

The vrrp peer authentication command configures virtual router authentication parameters for the specified virtual router.

Example

This command implements plain-text authentication, using 12345 as the key, for virtual router 40 on vlan 100.

switch(config-if-vl100)#vrrp 40 peer authentication text 12345
switch(config-if-vl100)#

Secondary Addresses

The vrrp ipv4 secondary command assigns a secondary IP address to a virtual router. Secondary addresses are optional; a virtual routers configuration may include more than one secondary address command. The primary and secondary address list must be identical for all switches in a virtual router group.

A primary IP address is assigned to a virtual router with the vrrp ipv4 command (Virtual Router Enabling and the Primary IP address).

Example

This command assigns the IP address of 10.2.4.5 as the secondary IP address for the virtual router 15 on vlan 20.

switch(config-if-vl20)# vrrp 15 ipv4 10.2.4.5 secondary
switch(config-if-vl20)#

Virtual Router Enabling and the Primary IP address

The vrrp ipv4 command configures the primary IP address of the specified virtual router and enables the virtual router if the primary address is contained within the configuration mode interfaces IP address subnet. A virtual routers configuration may contain only one primary IP address assignment command; subsequent vrrp ipv4 commands reassign the virtual routers primary IP address.

Example

This command enables virtual router group 15 (VRID) on vlan 20 and assigns 10.1.1.5 as the virtual routers primary address.

switch(config-if-vl20)# vrrp 15 ipv4 10.1.1.5
switch(config-if-vl20)#

Disabling VRRP

The vrrp disabled command places the switch in stopped state for the specified virtual router. While in stopped state, the switch cannot act as a Master or backup router for the virtual router group. The no vrrp disabled command changes the switchs virtual router state to backup or master if the virtual router is properly configured.

VRRP can also be shut down when the status of a tracked object configured by the vrrp tracked-object command changes to down.

Examples

This command places the switch in stopped mode for virtual router 24 on vlan 20.
```
switch(config-if-vl20)# vrrp 24 disabled
switch(config-if-vl20)#
```
This command moves the switch out of stopped mode for virtual router 24 on vlan 20.
```
switch(config-if-vl20)# no vrrp 24 disabled
switch(config-if-vl20)#
```
This command configures the switch to enter stopped mode for virtual router 24 on vlan 20 if the status of tracked-object interfaceE6/48 changes to down.
```
switch(config-if-vl20)# vrrp 24 tracked-object interfaceE6/48 shutdown
switch(config-if-vl20)#
```

The no vrrp and no vrrp ipv4 commands delete the specified virtual IP address from the interface. Additionally, the no vrrp command removes all residual VRRP commands for the virtual router.

Examples

This command removes all VRRP configuration commands for virtual router 10 on vlan 15.
```
switch(config-if-vl15)# no vrrp 10
switch(config-if-vl15)#
```
This command disables virtual router 25 on vlan20 and removes the primary IP address from its configuration.
```
switch(config-if-vl20)# no vrrp 25 ipv4 10.1.1.5  
switch(config-if-vl20)#
```

VRRP Configuration for IPv6

The no vrrp command removes all VRRP commands for the specified virtual router from running-config.

Configuring VRRP for IPv6

Specify the VRRP Version

The vrrp ipv4 version command sets the version of VRRP used on an interface. The version selected in a VRRP group must be the same for all group members. By default, Arista switches use VRRP version 2, which is not compatible with IPv6.

Example

This command causes vlan 20 to use VRRP version 3.

switch(config)# interface vlan 20
switch(config-if-vl20)# vrrp 1 ipv4 version 3
switch(config-if-vl20)#

Create a VRRP Group and Configure a Virtual IPv6 Address

The vrrp ipv6 command assigns an IPv6 address to the interface being configured and creates a VRRP group.

Example

These commands create VRRP group 3 and configure a virtual IPv6 address for the VRRP group on the vlan 20 interface.

switch(config)# interface vlan 20
switch(config-if-vl20)# vrrp 3 ipv6 2001:db8:0:1::1
switch(config-if-vl20)#

Configure Tracking

The vrrp tracked-object command configures the VRRP client process to track an object created by the track command and react if its status changes to down.

Example

This command causes interface vlan 20 to disable VRRP when tracked object ETH8 changes state.

switch(config-if-vl20)# vrrp 1 tracked-object ETH8 shutdown
switch(config-if-vl20)#

Configure the Priority Level

The vrrp priority-level command configures the switchs priority setting for the specified virtual router.

Example

This command sets the priority value of 250 for the virtual router with VRID 15 on vlan 20.

switch(config-if-vl20)# vrrp 15 priority-level 250
switch(config-if-vl20)#

Configure the Preemption Mode

The vrrp preempt command controls the preempt mode setting of the specified virtual router. By default, preempt mode is enabled.

Example

This command enables preempt mode for the virtual router 30 on vlan 20.

switch(config-if-vl20)# vrrp 30 preempt

Configure the VRRP Advertisement Interval

The ip virtual-router mac-address advertisement-interval command specifies the interval between advertisement packets sent by the master router to the VRRP group members.

Example

This command configures a MAC address advertisement interval of one minute (60 seconds).

switch(config)# interface vlan 20
switch(config-if-vl20)# ip virtual-router mac-address advertisement-interval 60
switch(config-if-vl20)#

Verify VRRP IPv6 Configurations

Use the following commands to display the VRRP configurations and status.

Show VRRP Group

The show vrrp command displays information about the Virtual Router Redundancy Protocol (VRRP) groups configured on a specified interface.

Example

This command displays a table of information for VRRP groups on the switch.

switch# show vrrp interface vlan 3060 brief
Interface Id  Ver Pri Time  State   VrIps
Vlan3060  1   3   100 3609  Master  2001::2
                                    2001::3
Vlan3060  2   3   100 3609  Master  2002::2
                                    2002::3
switch#

VARP Configuration

Implementing VARP consists of assigning virtual IP addresses to VLAN interfaces and configuring a virtual MAC address.

Virtual IP Addresses

The ip virtual-router address command assigns a virtual IP address to the VLAN interface being configured. Unlike VRRP, the virtual IP address does not have to be in the same subnet as the physical interface.

A virtual IPv4 address may optionally be configured with a subnet, but doing so modifies the behavior of ARP requests sent from the router. When the router sends an ARP request for an IPv4 address in a virtual subnet, the ARP request uses the virtual IPv4 address as the source IP address and the virtual MAC address as the source MAC address inside the ARP header. For virtual IP addresses configured without the subnet option, no modifications are made to outgoing ARP requests.

Examples

These commands configure a Switch Virtual Interface (SVI) and a virtual IP address for VLAN 10.

switch(config)# interface vlan 10
switch(config-if-Vl10)# ip address 10.0.0.2/24
switch(config-if-Vl10)# ip virtual-router address 10.0.0.6
switch(config-if-Vl10)# ipv6 address 2001::1/64
switch(config-if-Vl10)# ipv6 virtual-router address 2001::2
switch(config-if-Vl10)# exit
switch(config)#

These commands configure a Switch Virtual Interface (SVI) and a virtual IPv4 address with a subnet for vlan 10. A static route is added to indicate that the virtual subnet is reachable through vlan 10.

switch(config)# ip route 192.0.0.0/24 vlan 10
switch(config)# interface vlan 10
switch(config-if-Vl10)# ip address 10.0.0.2/24
switch(config-if-Vl10)# ip virtual-router address 192.0.0.6/24
switch(config-if-Vl10)# exit
switch(config)#

Virtual MAC Address

The ip virtual-router mac-address command assigns a virtual MAC address to the switch. The switch maps all virtual router IP addresses to this MAC address. The address is receive-only; the switch never sends packets with this address as the source.

When the destination MAC of a packet destined to a remote network matches the virtual MAC address, the MLAG peer forwards the traffic to the next hop destination. Each MLAG peer must have the same routes available, either through static configuration or learned through a dynamic routing protocol.

Example

This command configures a virtual MAC address.

switch(config)# ip virtual-router mac-address 001c.7300.0099
switch(config)#

Show Virtual MAC Address

To display the virtual router MAC and IP addresses, enter the show ip virtual-router command.

Example

This command displays the virtual router addresses assigned on the switch.

switch# show ip virtual-router
IP virtual router is configured with MAC address: 24cd.5a29.cc31
Interface  IP Address        Virtual IP Address   Status            Protocol
Vlan15     10.1.1.3/24       10.1.1.15            up                up
Vlan15     10.1.1.3/24       10.1.1.16            up                up
Vlan15     10.1.1.3/24       10.1.1.17            up                up
Vlan20     10.12.1.6/24      10.1.1.51            up                up
Vlan20     10.12.1.6/24      10.1.1.53            up                up
Vlan20     10.12.1.6/24      10.1.1.55            up                up
switch#

Show IPv6 Virtual-Router

The show ipv6 virtual-router command displays the virtual MAC address assigned to the switch and all virtual IPv6 addresses assigned to each VLAN interface.

Example

This command displays a table of information for IPv6 VRRP groups on the switch.

switch# show ipv6 virtual-router
IP virtual router is configured with MAC address: 001c.7300.0099
MAC address advertisement interval: 30 seconds
Interface Vlan4094
  State is up
  Protocol is up
  IPv6 address
    2001:b8:2001::1011/64
  Virtual IPv6 address
    2001:db8:ac10:fe01::
switch#

VRRP and VARP Implementation Examples

This section contains the following example set:

VRRP Examples
VARP Example

VRRP Examples

This section provides code that implements three VRRP configurations:

Example 1 configures two switches in a single virtual router group. This implementation protects the LAN against the failure of one router.
Example 2 configures two switches into two virtual routers within a single LAN. This implementation protects the LAN against the failure of one router and balances traffic between the routers.
Example 3 configures three switches to implement virtual routers on two LANs. Each LAN contains two virtual routers. One switch is configured into four virtual routers – two on each LAN.

VRRP Example 1: One Virtual Router on One LAN

The network diagram displays the Example 1 network. Two switches are configured as VRRP routers to form one virtual router.

Figure 2. VRRP Example 1 Network Diagram

The following code configures the first switch (Router A) as the master router and the second switch (Router B) as a backup router for virtual router 10 on vlan 50. Router A becomes the Master virtual router by setting its priority at 200; Router B maintains the default priority of 100. The advertisement interval is three seconds on both switches. Priority preemption is enabled by default.

Switch Code that Implements Router A on the First Switch

switch-A(config)# interface vlan 50
switch-A(config-if-vl50)# ip address 10.10.4.1/24
switch-A(config-if-vl50)# no vrrp 10
switch-A(config-if-vl50)# vrrp 10 priority 200
switch-A(config-if-vl50)# vrrp 10 advertisement interval 3
switch-A(config-if-vl50)# vrrp 10 ip 10.10.4.10
switch-A(config-if-vl50)# exit

Switch Code that Implements Router B on the Second Switch

switch-B(config)# interface vlan 50
switch-B(config-if-vl50)# ip address 10.10.4.2/24
switch-B(config-if-vl50)# no vrrp 10
switch-B(config-if-vl50)# vrrp 10 advertisement interval 3
switch-B(config-if-vl50)# vrrp 10 ip 10.10.4.10
switch-B(config-if-vl50)# exit

VRRP Example 2: Two Virtual Routers on One LAN

The network diagram displays Example 2. Two switches are configured as VRRP routers to form two virtual routers on one LAN. Using two virtual routers distributes the LAN traffic between the switches.

Figure 3. VRRP Example 2 Network Diagram

The following code configures two switches as a master and a backup router for two virtual routers on vlan 50.

Router A is the master for virtual router 10 and backup for virtual router 20.
Router B is the master for virtual router 20 and backup for virtual router 10.
VRRP advertisement interval is 3 seconds on virtual router 10 and 5 seconds on virtual router 20.
Priority preemption is enabled by default for both virtual routers.

Switch Code that Implements Router A on the First Switch

switch-A(config)# interface vlan 50
switch-A(config-if-vl50)# ip address 10.10.4.1/24
switch-A(config-if-vl50)# no vrrp 10
switch-A(config-if-vl50)# vrrp 10 priority 200
switch-A(config-if-vl50)# vrrp 10 advertisement interval 3
switch-A(config-if-vl50)# vrrp 10 ip 10.10.4.10
switch-A(config-if-vl50)# no vrrp 20
switch-A(config-if-vl50)# vrrp 20 advertisement interval 5
switch-A(config-if-vl50)# vrrp 20 ip 10.10.4.20
switch-A(config-if-vl50)# exit

Switch Code that Implements Router B on the Second Switch

switch-B(config)# interface vlan 50
switch-B(config-if-vl50)# ip address 10.10.4.2/24
switch-B(config-if-vl50)# no vrrp 10
switch-B(config-if-vl50)# vrrp 10 advertisement interval 3
switch-B(config-if-vl50)# vrrp 10 ip 10.10.4.10
switch-B(config-if-vl50)# no vrrp 20
switch-B(config-if-vl50)# vrrp 20 priority 200
switch-B(config-if-vl50)# vrrp 20 advertisement interval 5
switch-B(config-if-vl50)# vrrp 20 ip 10.10.4.20
switch-B(config-if-vl50)# exit

VRRP Example 3: Two Virtual Routers on Two LANs

The network diagram displays Example 3. Three switches are configured as VRRP routers to form four virtual router groups two groups on each of two LANs.

Figure 4. VRRP Example 3 Network Diagram

The following code configures the three switches as follows:

Router A is the master for virtual router 10 and backup for virtual router 20 on vlan 100.
Router A is the master for virtual router 30 and backup for virtual router 40 on vlan 150.
Router B is the master for virtual router 20 and backup for virtual router 10 on vlan 100.
Router C is the master for virtual router 40 and backup for virtual router 30 on vlan 150.
VRRP advertisement interval is set to one second on all virtual routers.
Priority preemption is disabled on all virtual routers.

Switch Code that Implements Router A on the First Switch

switch-A(config)# interface vlan 100
switch-A(config-if-vl100)# ip address 10.10.4.1/24
switch-A(config-if-vl100)# no vrrp 10
switch-A(config-if-vl100)# vrrp 10 priority 200
switch-A(config-if-vl100)# no vrrp 10 preempt
switch-A(config-if-vl100)# vrrp 10 ip 10.10.4.10
switch-A(config-if-vl100)# vrrp 10 advertisement interval 1
switch-A(config-if-vl100)# no vrrp 20
switch-A(config-if-vl100)# no vrrp 20 preempt
switch-A(config-if-vl100)# vrrp 20 ip 10.10.4.20
switch-A(config-if-vl100)# interface vlan 150
switch-A(config-if-vl150)# ip address 40.10.5.7/24
switch-A(config-if-vl150)# no vrrp 30
switch-A(config-if-vl150)# vrrp 30 priority 200
switch-A(config-if-vl150)# no vrrp 30 preempt
switch-A(config-if-vl150)# vrrp 30 ip 40.10.5.31
switch-A(config-if-vl100)# vrrp 30 advertisement interval 1
switch-A(config-if-vl150)# no vrrp 40
switch-A(config-if-vl150)# no vrrp 40 preempt
switch-A(config-if-vl150)# vrrp 40 ip 40.10.5.32
switch-A(config-if-vl150)# exit

Switch Code that Implements Router B on the Second Switch

switch-B(config)# interface vlan 100
switch-B(config-if-vl100)# ip address 10.10.4.2/24
switch-B(config-if-vl100)# no vrrp 10
switch-B(config-if-vl100)# no vrrp 10 preempt
switch-B(config-if-vl100)# vrrp 10 ip 10.10.4.10
switch-B(config-if-vl100)# no vrrp 20
switch-B(config-if-vl100)# vrrp 20 priority 200
switch-B(config-if-vl100)# no vrrp 20 preempt
switch-B(config-if-vl100)# vrrp 20 ip 10.10.4.20
switch-A(config-if-vl100)# vrrp 20 advertisement interval 1
switch-B(config-if-vl100)# exit

Switch Code that Implements Router C on the Third Switch

switch-C(config)# interface vlan 150
switch-C(config-if-vl150)# ip address 40.10.5.8/24
switch-C(config-if-vl150)# no vrrp 30
switch-C(config-if-vl150)# no vrrp 30 preempt
switch-C(config-if-vl150)# vrrp 30 ip 40.10.5.31
switch-C(config-if-vl150)# no vrrp 40
switch-C(config-if-vl150)# vrrp 40 priority 200
switch-C(config-if-vl150)# no vrrp 40 preempt
switch-C(config-if-vl150)# vrrp 40 ip 40.10.5.32
switch-A(config-if-vl100)# vrrp 40 advertisement interval 1
switch-C(config-if-vl150)# exit

VARP Example

This section provides code that implements a VARP configuration. The network diagram displays the Example 1 network. Two switches in an MLAG domain are configured as VARP routers.

The following code configures 10.10.4.10 as the virtual IP address for VLAN 50, 10.24.4.1 as the virtual IP address for VLAN 70, and 001c.7300.0999 as the virtual MAC address on both switches.

Switch Code that Implements VARP on the First Switch

switch-A(config)# ip virtual-router mac-address 001c.7300.0999
switch-A(config)# interface vlan 50
switch-A(config-if-vl50)# ip address 10.10.4.1/24
switch-A(config-if-vl50)# ip virtual-router address 10.10.4.10
switch-A(config-if-vl50)# interface vlan 70
switch-A(config-if-vl70)# ip address 10.24.4.17/24
switch-A(config-if-vl70)# ip virtual-router address 10.24.4.1
switch-A(config-if-vl70)# exit

Switch Code that Implements VARP on the Second Switch

switch-B(config)# ip virtual-router mac-address 001c.7300.0999
switch-B(config)# interface vlan 50
switch-B(config-if-vl50)# ip address 10.10.4.2/24
switch-B(config-if-vl50)# ip virtual-router address 10.10.4.10
switch-B(config-if-vl50)# interface vlan 70
switch-B(config-if-vl70)# ip address 10.24.4.18/24
switch-B(config-if-vl70)# ip virtual-router address 10.24.4.1
switch-B(config-if-vl70)# exit

VRRP and VARP Configuration Commands

This section contains descriptions of CLI commands that support VRRP and VARP.

ip fhrp accept-mode

The ip fhrp accept-mode command configures the switch to permit SSH access to the VRRP Master and VARP Master router. All routers within a VRRP or VARP group should be configured consistently. By default, SSH access to the VRRP and VARP Master routers is not permitted.

The no ip fhrp accept-mode and default ip fhrp accept-mode commands restores the default SSH access availability by removing the ip fhrp accept-mode command from running-config.

Command Mode

Global Configuration

Command Syntax

ip fhrp accept-mode

no ip fhrp accept-mode

default ip fhrp accept-mode

Example

This command configures the switch to permit SSH access to the VRRP and VARP Master routers.

switch(config)# ip fhrp accept-mode
switch(config)# show running-config

!
ip fhrp accept-mode
!

switch(config)#

ip virtual-router address

The ip virtual-router address command assigns a virtual IPv4 address to the VLAN interface being configured. (To assign a virtual IPv6 address to a VLAN interface, use the ipv6 virtual-router address command.) Unlike VRRP, the virtual IP address does not have to be in the same subnet as the physical interface.

A virtual IP address may optionally be configured with a subnet, but doing so will modify the behavior of ARP requests sent from the router. When the router sends an ARP request for an IP address in a virtual subnet, the ARP request will use the virtual IP address as the source IP address and the virtual MAC address as the source MAC address inside the ARP header. For virtual IP addresses configured without the subnet option, no modifications are made to outgoing ARP requests.

A maximum of 500 virtual IP addresses can be assigned to a VLAN interface. All virtual addresses on all VLAN interfaces resolve to the same virtual MAC address configured through the ip virtual-router mac-address command.

This command is typically used in MLAG configurations to create identical virtual routers on switches connected to the MLAG domain through an MLAG.

The no ip virtual-router address and default ip virtual-router address commands remove the specified virtual IP address from the configuration mode interface by deleting the corresponding ip virtual-router address command from running-config. If the command does not specify an address, all virtual IPv4 addresses are removed from the interface.

Command Mode

Interface-VLAN Configuration

Command Syntax

ip virtual-router address ipv4_addr

no ip virtual-router address [ipv4_addr]

default ip virtual-router address [ipv4_addr]

Parameter

ipv4_addr IP address of router. Dotted decimal notation.

Examples

These commands configure a Switch Virtual Interface (SVI) and a virtual IP address for vlan 10.

switch(config)# interface vlan 10
switch(config-if-Vl10)# ip address 10.0.0.2/24
switch(config-if-Vl10)# ip virtual-router address 10.0.0.6
switch(config-if-Vl10)# exit

These commands configure a Switch Virtual Interface (SVI) and a virtual IP address with a subnet for vlan 10. A static route is added to indicate that the virtual subnet is reachable through vlan 10.

switch(config)# ip route 192.0.0.0/24 vlan 10
switch(config)# interface vlan 10
switch(config-if-Vl10)# ip address 10.0.0.2/24
switch(config-if-Vl10)# ip virtual-router address 192.0.0.6/24
switch(config-if-Vl10)# exit

ip virtual-router mac-address

The ip virtual-router mac-address command assigns a virtual MAC address to the switch. The switch maps all virtual router IP addresses to this MAC address. The address is receive-only; the switch never sends packets with this address as the source. The virtual router is not configured on the switch until this virtual mac-address is assigned.

This command is typically used in MLAG configurations to create identical virtual routers on switches connected to the MLAG domain through an MLAG. When the destination MAC of a packet destined to a remote network matches the virtual MAC address, the MLAG peer forwards the traffic to the next hop destination. Each MLAG peer must have the same routes available, either through static configuration or learned through a dynamic routing protocol.

The no ip virtual-router mac-address command removes a virtual MAC address from the interface by deleting the corresponding ip virtual-router mac-address command from running-config.

Command Mode

Global Configuration

Command Syntax

ip virtual-router mac-address [mac_addr]

no ip virtual-router mac address [mac_addr]

Parameter

mac_addr MAC IP address (dotted hex notation). Select an address does not appear on the switch.

Example

This command configures a virtual MAC address.

switch(config)# ip virtual-router mac-address 001c.7300.0099
switch(config)#

ip virtual-router mac-address advertisement-interval

The ip virtual-router mac-address advertisement interval command specifies the period between the transmission of consecutive gratuitous ARP requests that contain the virtual router mac address for each virtual-router IP address configured on the switch. The default period is 30 seconds.

The no ip virtual-router mac-address advertisement-interval command restores the default period of 30 seconds by removing the ip virtual-router mac-address advertisement-interval command from running-config.

Command Mode

Global Configuration

Command Syntax

ip virtual-router mac-address advertisement-interval period

no ip virtual-router mac-address advertisement-interval

default ip virtual-router mac-address advertisement-interval

Parameter

period advertisement interval (seconds). Values range from 0 to 86400. Default is 30.

Example

This command configures a MAC address advertisement interval of one minute (60 seconds).

switch(config)# ip virtual-router mac-address advertisement-interval 60
switch(config)#

ipv6 virtual-router address

The ipv6 virtual-router address command assigns a virtual IPv6 address to the VLAN interface being configured. (To assign a virtual IPv4 address to a VLAN interface, use the ip virtual-router address command.) Unlike VRRP, the virtual IP address does not have to be in the same subnet as the physical interface.

This command is typically used in MLAG configurations to create identical virtual routers on switches connected to the MLAG domain through an MLAG.

The no ipv6 virtual-router address and default ipv6 virtual-router address commands remove the specified virtual IPv6 address from the configuration mode interface by deleting the corresponding ipv6 virtual-router address command from running-config. If the command does not specify an address, all virtual IPv6 addresses are removed from the interface.

Command Mode

Interface-VLAN Configuration

Command Syntax

ipv6 virtual-router address net_addr

no ipv6 virtual-router address [net_addr]

default ipv6 virtual-router address [net_addr]

Parameter

net_addr network IPv6 address.

Example

These commands configure a Switch Virtual Interface (SVI) and a virtual IPv6 address for vlan 10.

switch(config)# interface vlan 10
switch(config-if-Vl10)# ipv6 address 2001:0DB8:0:1::1/64
switch(config-if-Vl10)# ipv6 virtual-router address 2001:0DB8:0:1::2
switch(config-if-Vl10)# exit

no vrrp

The no vrrp command removes all VRRP configuration commands for the specified virtual router on the configuration mode interface. The default vrrp command also reverts VRRP configuration parameters to default settings by removing the corresponding vrrp commands.

Commands removed by the no vrrp command include:

vrrp advertisement interval
vrrp disabled
vrrp ipv4
vrrp ipv4 secondary
vrrp peer authentication
vrrp preempt
vrrp preempt delay
vrrp priority-level
vrrp session description

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

no vrrp group

default vrrp group

Parameter

group Virtual Router Identifier (VRID). Values range from 1 to 255.

Example

This command removes all VRRP configuration commands for virtual router group 10 on vlan 15.

switch(config)# interface vlan 15
switch(config-if-vl15)# no vrrp 10
switch(config-if-vl15)#

show ip virtual-router

The show ip virtual-router command displays the virtual MAC address assigned to the switch and all virtual IP addresses assigned to each VLAN interface.

Command Mode

EXEC

Command Syntax

show ip virtual-router

Messages

IP virtual router is not configured a virtual MAC address is not assigned to the switch.
No interface with virtual IP address no virtual IP addresses are assigned to any VLAN interfaces.

Examples

This command displays a table of information for VRRP groups on the switch.

switch# show ip virtual-router
IP virtual router is configured with MAC address: 24cd.5a29.cc31
Interface  IP Address        Virtual IP Address   Status            Protocol
Vlan15     10.1.1.3/24       10.1.1.15            up                up
Vlan15     10.1.1.3/24       10.1.1.16            up                up
Vlan15     10.1.1.3/24       10.1.1.17            up                up
Vlan20     10.12.1.6/24      10.1.1.51            up                up
Vlan20     10.12.1.6/24      10.1.1.53            up                up
Vlan20     10.12.1.6/24      10.1.1.55            up                up
switch#

This command generates a response that indicates a virtual MAC address is not assigned to the switch.
```
switch# show ip virtual-router
IP virtual router is not configured
switch#
```

show ipv6 virtual-router

The show ipv6 virtual-router command displays the virtual MAC address assigned to the switch and all virtual IPv6 addresses assigned to each VLAN interface.

Command Mode

EXEC

Command Syntax

show ipv6 virtual-router

Messages

IPv6 virtual router is not configured a virtual MAC address is not assigned to the switch.
No interface with virtual IPv6 address no virtual IPv6 addresses are assigned to any VLAN interfaces.

Example

This command displays a table of information for IPv6 VRRP groups on the switch.

switch# show ipv6 virtual-router
IP virtual router is configured with MAC address: 001c.7300.0099
MAC address advertisement interval: 30 seconds
Interface Vlan4094
  State is up
  Protocol is up
  IPv6 address
    2001:b8:2001::1011/64
  Virtual IPv6 address
    2001:db8:ac10:fe01::
switch#

show vrrp

The show vrrp command displays information about the Virtual Router Redundancy Protocol (VRRP) groups configured on a specified interface. Parameter options control the amount and formatting of the displayed information.

Command Mode

Privileged EXEC

Command Syntax

show vrrp [INFO_LEVEL] [STATES]

show vrrp INTF GROUP_NUM [INFO_LEVEL] [STATES]

show vrrp GROUP_NUM INTF_GROUP [INFO_LEVEL] [STATES]

Parameters

INTF specifies the VRRP groups for which the command displays status. When the parameter is omitted or specifies only an interface, the group list is filtered by the STATES parameter.
- no parameter specified groups on all interfaces.
- interface ethernet e_num specified groups on Ethernet interface.
- interface loopback l_num specified groups on loopback interface.
- interface management m_num specified groups on management interface.
- interface port-channel p_num specified groups on port channel interface.
- interface vlan v_num specified groups on VLAN interface.
- interface VXLAN vx_num specified groups on VXLAN interface.
GROUP_NUM the VRRP ID number of the group for which the command displays status.
- no parameter all groups on specified interface.
- vrid_num Virtual Router Identifier (VRID). Value ranges from 1 to 255.
INFO_LEVEL Specifies format and amount of displayed information. Options include:
- no parameter displays a block of data for each VRRP group.
- brief displays a single table that lists information for all VRRP groups.
STATES Specifies the groups, by VRRP router state, that are displayed. Options include:
- no parameter displays data for groups in the master or backup states.
- all displays all groups, including groups in the stopped and interface down states.

Examples

This command displays a table of information for VRRP groups on the switch.

switch# show vrrp brief
Interface Id  Ver Pri Time  State   VrIps
Vlan1006  3   2   100 3609  Master  127.38.10.2
Vlan1006  4   3   100 3609  Master  127.38.10.10
Vlan1010  1   2   100 3609  Master  128.44.5.3
Vlan1014  2   2   100 3609  Master  127.16.14.2

This command displays data blocks for all VRRP groups on vlan 46, regardless of the VRRP state.

switch# show vrrp interface vlan 1006 all
Vlan1010 - Group 1
  VRRP Version 2
  State is Stopped
  Virtual IPv4 address is 128.44.5.3
  Virtual MAC address is 0000.5e00.0101
  Mac Address Advertisement interval is 30s
  VRRP Advertisement interval is 1s
  Preemption is enabled
  Preemption delay is 0s
  Preemption reload delay is 0s
  Priority is 100
  Master Router is 0.0.0.0
  Master Advertisement interval is 1s
  Skew time is 0.609s
  Master Down interval is 3.609s

This command displays data for all VRRP group 2 on vlan 1014.

switch# show vrrp interface vlan 1014 group 2
Vlan1006 - Group 2
  VRRP Version 2
  State is Master
  Virtual IPv4 address is 127.38.10.2
  Virtual MAC address is 0000.5e00.0103
  Mac Address Advertisement interval is 30s
  VRRP Advertisement interval is 1s
  Preemption is enabled
  Preemption delay is 0s
  Preemption reload delay is 0s
  Priority is 100
  Master Router is 127.38.10.1 (local), priority is 100
  Master Advertisement interval is 1s
  Skew time is 0.609s
  Master Down interval is 3.609s

vrrp advertisement interval

The vrrp advertisement interval command configures the interval between successive advertisement messages that the switch sends to VRRP routers in the specified virtual router group. The switch must be the groups Master virtual router to send advertisement messages. The advertisement interval must be configured identically on all physical routers in the virtual router group.

The advertisement interval also influences the timeout interval that defines when the virtual router becomes the master virtual router. When preemption is enabled, the virtual router becomes the master when three times the advertisement interval elapses after the switch detects master router priority conditions.

The no vrrp advertisement interval and default vrrp advertisement interval commands restore the default advertisement interval of one second for the specified virtual router by removing the corresponding vrrp advertisement interval command from running-config. The no vrrp command also removes the vrrp advertisement interval command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group advertisement interval adv_time

no vrrp group advertisement interval

default vrrp group advertisement interval

Parameters

group Virtual Router Identifier (VRID). Values range from 1 to 255.
adv_time advertisement interval (seconds). Values range from 1 to 255. Default value is 1.

Example

This command sets the advertisement interval of five seconds for the virtual router 35 on vlan 100.

switch(config)# interface vlan 100
switch(config-if-vl100)# vrrp 35 advertisement interval 5
switch(config-if-vl100)#

vrrp disabled

The vrrp disabled command places the switch in stopped state for the specified virtual router. While in stopped state, the switch cannot act as a master or backup router for the virtual router group.

The no vrrp disabled and default vrrp disabled commands remove the corresponding vrrp disabled command from running-config. This changes the switch's virtual router state to backup or master if the virtual router is properly configured.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group disabled

no vrrp group disabled

default vrrp group disabled

Parameter

group Virtual Router IDentifier (VRID). Values range from 1 to 255.

Examples

These commands place the switch in stopped mode for virtual router 24 on vlan 20.

switch(config)# interface vlan 20
switch(config-if-vl20)# vrrp 24 disabled
switch(config-if-vl20)#

This command moves the switch out of stopped mode for virtual router 24 on vlan 20.
```
switch(config-if-vl20)# no vrrp 24 disabled
switch(config-if-vl20)#
```

vrrp ipv4

The vrrp ipv4 command configures the primary IP address for the specified VRRP virtual router. The command also activates the virtual router if the primary address is contained in the interfaces subnet. A VRRP virtual routers configuration may contain only one primary IP address assignment command; subsequent vrrp ipv4 commands replace the existing primary address assignment.

The vrrp ipv4 secondary command assigns a secondary IP address to the VRRP virtual router.

The no vrrp ipv4and default vrrp ipv4 commands disable the VRRP virtual router and deletes the primary IP address by removing the corresponding vrrp ipv4 statement from running-config. The no vrrp command also removes the vrrp ipv4 command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group ipv4 ipv4_address

no vrrp group ipv4 ipv4_address

default vrrp group ipv4 ipv4_address

Parameters

group Virtual Router IDentifier (VRID). Values range from 1 to 255.
ipv4_address IPv4 address of the virtual router.

Related Command

vrrp ipv4 secondary

Example

This command enables virtual router 15 on vlan 20 and designates 10.1.1.5 as the virtual routers primary address.

switch(config)# interface vlan 20
switch(config-if-vl20)# vrrp 15 ipv4 10.1.1.5
switch(config-if-vl20)#

vrrp ipv4 checksum pseudo-header exclude

This command excludes the pseudo-header in IPv4 VRRPv3 checksum calculation on the VRRP group on the configuration mode interface of the switch and supports IPv4 VRRPv3 interoperability.

The no form of the command deletes the vrrp ipv4 checksum pseudo-header exclude configuration from the Ethernet interface on the switch.

The exit command returns the switch to global configuration mode.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group ipv4 checksum pseudo-header exclude

no vrrp group ipv4 checksum pseudo-header exclude

Parameter

group Virtual Router IDentifier (VRID). Values range from 1 to 255.

Example

This command excludes the pseudo-header in IPv4 VRRPv3 checksum calculation on VRRP group 1 on interface ethernet 1.

switch(config-if-Et1)# vrrp 1 ipv4 checksum pseudo-header exclude

vrrp ipv4 secondary

The vrrp ipv4 secondary command assigns a secondary IP address to the specified virtual router. Secondary IP addresses are an optional virtual router parameter. A virtual router may contain multiple secondary address commands. The IP address list must be identical for all VRRP routers in a virtual router group.

The virtual router is assigned a primary IP address with the vrrp ipv4 command.

The no vrrp ipv4 secondary and default vrrp ipv4 secondary commands remove the secondary IP address for the specified VRRP virtual router by deleting the corresponding vrrp ipv4 secondary statement from running-config. The no vrrp command also removes all vrrp ipv4 secondary commands for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group ipv4 ipv4_addr secondary

no vrrp group ipv4 ipv4_addr secondary

default vrrp group ipv4 ipv4_addr secondary

Parameters

group Virtual Router IDentifier (VRID). Values range from 1 to 255.
ipv4_addr secondary IPv4 address of the virtual router.

Related Command

vrrp ipv4

Example

This command assigns the IP address of 10.2.4.5 as the secondary IP address for the virtual router with VRID of 15 on vlan 20.

switch(config)# interface vlan 20
switch(config-if-vl20)# vrrp 15 ipv4 10.2.4.5 secondary
switch(config-if-vl20)#

vrrp ipv4 version

The vrrp ipv4 version command enables VRRP on the configuration mode interface and configures the VRRP version for the specified VRRP virtual router.

The no vrrp ipv4 version and default vrrp ipv4 version commands restore the default VRRP version to VRRPv2 by removing the corresponding vrrp ipv4 version statement from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group ipv4 version VERSION_NUMBER

no vrrp group ipv4 version

default vrrp group ipv4 version

Parameters

group Virtual Router IDentifier (VRID). Values range from 1 to 255.
VERSION_NUMBER Specifies VRRP version that the switch uses. Default value is 2 (VRRPv2) Options include:
- 2 VRRP v2 supports IPv4 environment.
- 3 VRRP v3 supports IPv4 and IPv6 environment.

Examples

This command enables VRRPv3 for IPv6 on interface ethernet 3.

switch(config)# interface ethernet 3
switch#(config-if-Et3)# vrrp 1 ipv4 version 3

This command removes VRRPv3 from interface ethernet 3 and reverts to the default VRRPv2.
```
switch(config)# interface ethernet 3
switch(config-if-Et3)# no vrrp 1 ipv4 version
```

vrrp ipv6

The vrrp ipv6 command configures the IPv6 address for the specified VRRP virtual router. The command also activates the virtual router if the primary address is contained in the interfaces subnet.

The no vrrp ipv6 and default vrrp ipv6 commands disable the VRRP virtual router and deletes the IPv6 address by removing the corresponding vrrp ipv6 statement from running-config. The no vrrp command also removes the vrrp ipv6 command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group ip ipv6_address

no vrrp group ip ipv6_address

default vrrp group ip ipv6_address

Parameters

group Virtual Router IDentifier (VRID). Values range from 1 to 255.
ipv6_address IPv6 address of the virtual router.

Examples

This command enables address 2001:db8:0:1::1 for IPv6 VRRP on vlan 20.

switch(config)# interface vlan 20
switch(config-if-vl20)# vrrp 3 ipv6 2001:db8:0:1::1
switch(config-if-vl20)#

This command disables VRRPv3 on vlan 20 from virtual router 3.

switch(config)# interface vlan 20
switch(config-if-vl20)# no vrrp 3 ipv6 2001:db8:0:1::1
switch(config-if-vl20)#

vrrp mac-address advertisement-interval

The vrrp mac-address advertisement-interval command specifies the interval between advertisement packets sent by the master router to the VRRP group members.

The vrrp mac-address advertisement-interval 0, no vrrp mac-address advertisement-interval and default vrrp mac-address advertisement-interval commands disable the feature by removing the vrrp mac-address advertisement-interval command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group mac-address advertisement-interval period

no vrrp group mac-address

default vrrp group mac-address

Parameters

group Virtual Router IDentifier (VRID). Values range from 1 to 255.
period interval in which the master router sends advertisement packets (seconds). Value ranges from 0 to 3600. Selecting 0 as the interval disables this feature.

Examples

This command specifies the interval between advertisement packets sent to the members of VRRP group 3 on vlan 20.

switch(config)# interface vlan 20
switch(config-if-vl20)# vrrp 3 mac-address advertisement-interval 60
switch(config-if-vl20)#

This command disables the feature on vlan 20.

switch(config)# interface vlan 20
switch(config-if-vl20)# no vrrp 3 mac-address advertisement-interval
switch(config-if-vl20)#

vrrp peer authentication

The vrrp peer authentication command configures parameters the switch uses to authenticate virtual router packets it receives from other VRRP routers in the group.

The no vrrp peer authentication and default vrrp peer authentication commands disable VRRP peer authentication of packets from the specified virtual router by removing the corresponding vrrp peer authentication command from running-config . The no vrrp command also removes the vrrp peer authentication command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group peer authentication AUTH_PARAMETER

no vrrp group peer authentication

default vrrp group peer authentication

Parameters

group Virtual Router IDentifier (VRID). Values range from 1 to 255.
AUTH_PARAMETER encryption level and authentication key used by router. Options include:
- text text_key plain-text authentication, text_key is text.
- text_key plain-text authentication, text_key is text.
- ietf-md5 key-string 0 text_key IP authentication of MD5 key hash, text_key is text.
- ietf-md5 key-string text_key IP authentication of MD5 key hash, text_key is text.
- ietf-md5 key-string 7 coded_key IP authentication of MD5 key hash, coded_key is MD5 hash.

Guidelines

This command is applicable to VRRPv2 which supports IPv4 addresses only.

Examples

This command implements plain-text authentication, using 12345 as the key, for virtual router 40 on vlan 100.

switch(config)# interface vlan 100
switch(config-if-vl100)# vrrp 40 peer authentication text 12345
switch(config-if-vl100)#

This command implements ietf-md5 authentication, using 12345 as the key.

switch(config-if-vl100)# vrrp 40 peer authentication ietf-md5 key-string 0 12345
switch(config-if-vl100)#

This command implements ietf-md5 authentication, using 12345 as the key. The key is entered as the MD5 hash equivalent of the text string.
```
switch(config-if-vl100)# vrrp 40 peer authentication ietf-md5 key-string 7 
EA3TUPxdddFCLYT8mb+kxw==
switch(config-if-vl100)#
```

vrrp preempt

The vrrp preempt command controls a virtual routers preempt mode setting. When preempt mode is enabled, if the switch has a higher priority it will preempt the current master virtual router. When preempt mode is disabled, the switch can become the master virtual router only when a master virtual router is not present on the subnet, regardless of VRRP priority level settings. By default, preempt mode is enabled.

The no vrrp preemptcand default vrrp preemptccommands disable preempt mode for the specified virtual router; the default vrrp preempt command stores a corresponding no vrrp preempt statement in running-config. The vrrp preempt command enables preempt mode by removing the corresponding no vrrp preempt statement from running-config.

The no vrrp command also enables preempt mode by removing the no vrrp preempt command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group preempt

no vrrp group preempt

default vrrp group preempt

Parameter

group Virtual Router IDentifier (VRID). Values range from 1 to 255.

Related Command

vrrp preempt delay

Examples

This command disables preempt mode for virtual router 20 on vlan 40.

switch(config)# interface vlan 40
switch(config-if-vl40)# no vrrp 20 preempt
switch(config-if-vl40)#

This command enables preempt mode for virtual router 20 on vlan 40.

switch(config-if-vl40)# vrrp 20 preempt
switch(config-if-vl40)#

vrrp preempt delay

The vrrp preempt delay command specifies the interval between a VRRP preemption event and the point when the switch becomes the master VRRP router. A preemption event is any event that results in the switch having the highest virtual router priority setting while preemption is enabled. The vrrp preempt command enables preemption for a specified virtual router.

The command configures two delay periods:

minimum time delays master VRRP takeover when VRRP is fully implemented.
reload time delays master VRRP takeover after VRRP is initialized following a switch reload (boot).

Note: If the switch senses that there are no other active switches in the virtual router group, it will bypass any configured preempt time delay and become the VRRP master after the standard master downtime interval (3*advertisement interval + skew time).

Running-config maintains separate delay statements for minimum and reload parameters. Commands may list both parameters. Commands that list one parameter do not affect the omitted parameter. Values range from 0 to 3600 seconds (one hour). The default delay is zero seconds for both parameters.

The no vrrp preempt delay and default vrrp preempt delay commands reset the specified delay to the default of zero seconds. Commands that do no list either parameter resets both periods to zero. The no vrrp command also removes all vrrp preempt delay commands for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group preempt delay [MINIMUM_INTERVAL] [RELOAD_INTERVAL]

no vrrp group preempt delay [DELAY_TYPE]

default vrrp group preempt delay [DELAY_TYPE]

Parameters

group Virtual Router IDentifier (VRID). Values range from 1 to 255.
MINIMUM_INTERVAL period between preempt event and takeover of master VRRP router role.
- no parameter minimum delay is not altered by command.
- minimum min_time delay during normal operation (seconds). Values range from 0 to 3600.
RELOAD_INTERVAL period after reboot-VRRP initialization and takeover of master VRRP router role.
- no parameter reload delay is not altered by command.
- reload reload_time delay after reboot (seconds). Values range from 0 to 3600.
DELAY_TYPE delay type that is reset to default value.
- no parameter reload and minimum delays are reset to default.
- minimum minimum delay is reset to default.
- reload reload delay is reset to default.

(DELAY_TYPE parameter is only used in no vrrp preempt delay and default vrrp preempt delay commands).

Related Command

vrrp preempt

Examples

This command sets the minimum preempt time of 90 seconds for virtual router 20 on vlan 40.

switch(config)# interface vlan 40
switch(config-if-vl40)# vrrp 20 preempt delay minimum 90
switch(config-if-vl40)#

This command sets the minimum and reload preempt time to 0 for virtual router 20 on vlan 40.
```
switch(config-if-vl40)# no vrrp 20 preempt delay
switch(config-if-vl40)#
```

vrrp priority-level

The vrrp priority-level command configures the switchs priority setting for a VRRP virtual router. Priority values range from 1 to 254. The default value is 100.

The router with the highest VRRP priority level setting for a group becomes the master virtual router for that group. The master virtual router controls the IP address and is responsible for forwarding traffic sent. The vrrp preempt command controls the time when a switch can become the master virtual router.

The no vrrp priority-level and default vrrp priority-level commands restore the default priority of 100 to the virtual router on the configuration mode interface by removing the corresponding vrrp priority-level command from running-config. The no vrrp command also removes the vrrp priority-level command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group priority-level level

no vrrp group priority-level level

default vrrp group priority-level level

Parameters

group Virtual Router IDentifier (VRID). Values range from 1 to 255.
level priority setting for the specified virtual router. Values range from 1 to 254.

Example

This command sets the virtual router priority value of 250 for virtual router group 45 on vlan 20.

switch(config)# interface vlan 20
switch(config-if-vl20)# vrrp 45 priority-level 250
switch(config-if-vl20)#

vrrp session description

The vrrp session description command associates a text string to a VRRP virtual router on the configuration mode interface. The string has no functional impact on the virtual router. The maximum length of the string is 80 characters.

The no vrrp session description and default vrrp session description commands remove the text string association from the VRRP virtual router by deleting the corresponding vrrp session description command from running-config. The no vrrp command also removes the vrrp session description command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group session description label_text

no vrrp group session description

default vrrp group session description

Parameters

group Virtual Router IDentifier (VRID). Values range from 1 to 255.
label_text text that describes the virtual router. Maximum string length is 80 characters.

Example

This command associates the text string Laboratory Router to virtual router 15 on vlan 20.

switch(config)# interface vlan 20
switch(config-if-vl20)# vrrp 15 session description Laboratory Router
switch(config-if-vl20)#

vrrp timers delay reload

The vrrp timers delay reload command delays the time for VRRP initialization after a system reboot.

The no vrrp timers delay reload and default vrrp timers delay reload commands restore the default value of 0 by deleting the vrrp timers delay reload statement from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group timers delay reload [INTERVAL]

no vrrp group timers delay reload

default vrrp group timers delay reload

Parameters

INTERVAL The number of seconds for the delay (seconds). Options include:

no parameter Default value of 0 seconds.
0 to 3600 seconds. Ranges between 0 to 60 minutes.

Examples

These commands configure the VRRP reload delay interval to 15 minutes.

switch(config)# interface vlan 100
switch(config-if-Vl100)# vrrp 2 timers delay reload 900
switch(config-if-Vl100)#

These commands removes the VRRP reload delay interval.

switch(config)# interface vlan 100
switch(config-if-Vl100)# no vrrp 2 timers delay reload
switch(config-if-Vl100)#

vrrp tracked-object

The vrrp tracked-object command configures the VRRP client process on the configuration mode interface to track the specified tracked object and react when its status changes to down. The tracked object is created by the track command.

The no vrrp tracked-object and default vrrp tracked-object commands cause the VRRP client process to stop tracking the specified tracked object by removing the corresponding vrrp tracked-object command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group tracked-object object_name ACTION amount

no vrrp group tracked-object object_name ACTION

default vrrp group tracked-object object_name ACTION

Parameters

group Virtual Router IDentifier (VRID). Values range from 1 to 255.
object_name name of tracked object.
amount amount to decrement VRRP priority level. Values range from 1 to 254.
ACTION The action that VRRP is to take when the tracked objects status changes to down. Options include:
- decrement decrease VRRP priority level by amount.
- shutdown shut down VRRP on the configuration mode interface.
- If both decrement and shutdown are configured on the same interface for the same VRRP group, then VRRP will be shut down on the interface if the tracked object is down.

Example

This command causes interface ethernet 5 to disable VRRP when tracked object eth8 changes state.

switch(config-if-Et5)# vrrp 1 tracked-object eth8 shutdown
switch(config-if-Et5)#

Ingress and Egress Per-Port for IPv4 and IPv6 Counters

This feature supports per-interface ingress and egress packet and byte counters for IPv4 and IPv6.

This section describes Ingress and Egress per-port for IPv4 and IPv6 counters, including configuration instructions and command descriptions.

Topics covered by this chapter include:

Configuration
Show Commands
Dedicated ARP Entry for TX IPv4 and IPv6 Counters
Considerations

Configuration

IPv4 and IPv6 ingress counters (count bridged and routed traffic, supported only on front-panel ports) can be enabled and disabled using the hardware counter feature ip in command:

[no] hardware counter feature ip in

For IPv4 and IPv6 ingress and egress counters that include only routed traffic (supported on Layer3 interfaces such as routed ports and L3 subinterfaces only), use the following commands:

Note: The DCS-7300X, DCS-7250X, DCS-7050X, and DCS-7060X platforms do not require configuration for IPv4 and IPv6 packet counters for only routed traffic. They are collected by default. Other platforms (DCS-7280SR, DCS-7280CR, and DCS-7500-R) need the feature enabled.

[no] hardware counter feature ip in layer3

[no] hardware counter feature ip out layer3

hardware counter feature ip

Use the hardware counter feature ip command to enable ingress and egress counters at Layer 3. The no and default forms of the command disables the feature. The feature is enabled by default.

Command Mode

Configuration mode

Command Syntax

hardware counter feature ip in|out layer3

no hardware counter feature ip in|out layer3

default hardware counter feature in|out layer3

Example

This example enables ingress and egress ip counters for Layer 3.

switch(config)# hardware counter feature in layer3

switch(config)# hardware counter feature out layer3

Show Commands

Use the show interfaces counters ip command to display IPv4, IPv6 packets, and octets.

Example

switch# show interfaces counters ip
Interface   IPv4InOctets    IPv4InPkts     IPv6InOctets    IPv6InPkts
Et1/1            0               0               0               0
Et1/2            0               0               0               0
Et1/3            0               0               0               0
Et1/4            0               0               0               0
...
Interface  IPv4OutOctets  IPv4OutPkts    IPv6OutOctets   IPv6OutPkts    
Et1/1            0               0               0               0
Et1/2            0               0               0               0
Et1/3            0               0               0               0
Et1/4            0               0               0               0
...

You can also query the output from the show interfaces counters ip command through SNMP via the ARISTA-IP-MIB.

To clear the IPv4 or IPv6 counters, use the clear counters command.

Example

switch# clear counters

Dedicated ARP Entry for TX IPv4 and IPv6 Counters

IPv4/IPv6 egress Layer 3 (hardware counter feature ip out layer3) counting on DCS-7280SR, DCS-7280CR, and DCS-7500-R platforms work based on ARP entry of the next hop. By default, IPv4's next-hop and IPv6's next-hop resolve to the same MAC address and interface that shared the ARP entry.

To differentiate the counters between IPv4 and IPv6, disable arp entry sharing with the following command:

ip hardware fib next-hop arp dedicated

Note: This command is required for IPv4 and IPv6 egress counters to operate on the DCS-7280SR, DCS-7280CR, and DCS-7500-R platforms.

Considerations

Packet sizes greater than 9236 bytes are not counted by per-port IPv4 and IPv6 counters.
Only the DCS-7260X3, DCS-7368, DCS-7300, DCS-7050SX3, DCS-7050CX3, DCS-7280SR, DCS-7280CR and DCS-7500-R platforms support the hardware counter feature ip in command.
Only the DCS-7280SR, DCS-7280CR and DCS-7500-R platforms support the hardware counter feature ip [in|out] layer3 command.

ACLs and Route Maps

The switch uses rule-based lists to control packet access to ports and to select routes for redistribution to routing domains defined by dynamic routing protocols.

This section describes the construction of Access Control Lists (ACLs), prefix lists, and route maps and includes the following topics:

Introduction
Access Control Lists
Service ACLs
Sub-interface ACLs
RACL Sharing on SVIs
Route Maps
Prefix Lists
Port ACLs with User-Defined Fields
ACL, Route Map, and Prefix List Commands

Introduction

The following provides an introduction to Access Control Lists (ACL), Service ACLs, Route Maps, Prefix Lists, and Router Access Control List (RACL) Divergence:

The switch processes ACLs, Service ACLs, route maps, and prefix lists in order, beginning with the first rule and continuing until a match is found.

An ACL contains a list of rules that control the inbound and outbound flow of packets into Ethernet interfaces, subinterfaces, port-channel interfaces, or the switch control plane. The switch supports implementing various filtering criteria, including IP and MAC addresses and TCP/UDP ports, with include/exclude options without compromising its performance or feature set. Filtering syntax is the industry standard.

Note: EOS supports egress IPv4 and IPv6 Port Access Control Lists (PACLs) by default. To enable egress MAC PACLs, add the configuration to the current TCAM profile.

A Service ACL applies a control-plane process to control connections to, or packets processed by, the agent process.

A route map contains a list of rules that control the redistribution of IP routes into a protocol domain based on criteria such as route metrics, access control lists, next-hop addresses, and route tags. Additionally, route maps can modify route parameters during redistribution.

A prefix list contains a list of rules that defines route redistribution access for a specified IP address space. Route maps often use prefix lists to filter routes.

The RACL divergence optimizes hardware resource usage on each forwarding ASIC. EOS installs ACLs only on the hardware components corresponding to the member interfaces of the SVIs with an applied ACL, and saves hardware resources and scales the RACLs to a larger configuration.

Tip: Use the show commands to display the interface mapping, Ternary Content Addressable Memory (TCAM) entries, and TCAM utilization information.

Access Control Lists

These sections describe access control lists:

ACL Types
ACL Configuration
Applying ACLs

ACL Types

The switch supports the following ACL types:

IPv4 matches on IPv4 source or destination addresses, with L4 modifiers including protocol, port number, IPsec tunnel interfaces, and DSCP value.
IPv6 matches on IPv6 source or destination addresses, with L4 modifiers including protocol, port number, or GRE tunnel interface.
Standard IPv4 matches only on source IPv4 addresses.
Standard IPv6 matches only on source IPv6 addresses.
MAC matches on L2 source and destination addresses.

ACLs can also be made dynamic using payload, turning them into a User-Defined Field (UDF) alias for use in other ACLs.

ACL Structure

An ACL is an ordered list of rules that defines access restrictions for the entities (the control plane or an interface) to which it is applied. Route maps also use ACLs to select routes for redistribution into specified routing domains.

ACL rules specify the data to which packet contents are compared when filtering data.

The interface forwards packets that match all commands in a permit rule.
The interface drops packets that match all commands in a deny rule.
The interface drops packets that do not match at least one rule.

Upon its arrival at an interface, the switch compares a packet’s fields to the first rule of the ACL applied to the interface. Packets that match the rule are forwarded (permit rule) or dropped (deny rule). The process continues whereby the switch compares packets that do not match the rule to the next rule in the list and continues until the packet either matches a rule or the rule list is exhausted. The interface drops packets that do not match a rule.

The sequence number designates the rule's placement in the ACL.

ACL Rules

The switch compares an ACL rule's command list to inbound and outbound packet fields. When all of a rule’s criteria match a packet’s contents, the interface performs the action specified by the rule.

The set of available commands depends on the ACL type and the specified protocol within the rule. The following is a list of commands available for supported ACL types:

IPv4 ACL Rule Parameters

All rules in IPv4 ACLs include the following criteria:

Protocol: The packet’s IP protocol. Valid rule inputs include:
- Protocol name for a limited set of common protocols.
- Assigned protocol number for all IP protocols.
Source Address: The packet’s source IPv4 address. Valid rule inputs include:
- A subnet address (CIDR or address mask). Discontiguous masks are supported.
- A host IP address (dotted decimal notation.)
- Using any to denote that the rule matches all source addresses.
Destination Address: The packet’s destination IP address. Valid rule inputs include:
- A subnet address (CIDR or address mask). Discontiguous masks are supported.
- A host IP address (dotted decimal notation.)
- Using any to denote that the rule matches all destination addresses.

All rules in IPv4 ACLs may include the following criteria:

Fragment: Rules filter on the fragment bit.
Time-to-live: Compares the packet TTL (time-to-live) value to a specified value and is valid in ACLs applied to the control plane. The validity of ACLs applied to the data plane varies by switch platform. Comparison options include:
- Equal: Packets match if the packet value equals the statement value.
- Greater than: Packets match if the packet value is greater than the statement value.
- Less than: Packets match if the packet value is less than the statement value.
- Not equal: Packets match if the packet value does not equal the statement value.

The availability of the following optional criteria depends on the specified protocol:

Source Ports / Destination Ports: A rule filters on ports when the specified protocol supports IP address-port combinations. Rules provide one of these port filtering values:
- Using any denotes that the rule matches all ports.
- A list of ports that matches the packet port. The maximum list size is 10 ports.
- Negative port list. The rule matches any port not in the list. The maximum list size is 10 ports.
- Integer (lower bound): The rule matches any port with a number larger than the integer.
- Integer (upper bound): The rule matches any port with a number smaller than the integer.
- Range integers: The rule matches any port whose number is between the integers.
Flag bits: Rules filter TCP packets on flag bits.
Message type: Rules filter ICMP type or code.
Tracked: Matches packets in existing ICMP, UDP, or TCP connections and is valid in ACLs applied to the control plane. The validity of ACLs applied to the data plane varies by switch platform.

IPv6 ACL Rule Parameters

Note: When calculating the size of ACLs, be aware that Arista switches install four rules in every IPv6 ACL so that ICMPv6 neighbor discovery packets bypass the default drop rule.

All rules in IPv6 ACLs include the following criteria:

Protocol: All rules filter on the packet’s IP protocol field. Rule input options include:
- Protocol name for a limited set of common protocols.
- Assigned protocol number for all IP protocols.
Source Address: The packet’s source IPv6 address. Valid rule inputs include:
- An IPv6 prefix (CIDR). Discontiguous masks are supported.
- A host IP address (dotted decimal notation).
- Using any to denote that the rule matches all addresses.
Destination Address: The packet’s destination IP address. Valid rule inputs include:
- A subnet address (CIDR or address mask). Discontiguous masks are supported.
- A host IP address (dotted decimal notation).
- Using any to denote that the rule matches all addresses.

All rules in IPv6 ACLs may include the following criteria:

Fragment: Rules filter on the fragment bit.
HOP Compares the packet’s hop-limit value to a specified value. Comparison options include:
- eq: Packets match if the hop-limit value equals the statement value.
- gt: Packets match if the hop-limit value is greater than the statement value.
- lt: Packets match if the hop-limit value is less than the statement value.
- neq: Packets match if the hop-limit value is not equal to the statement value.

The availability of the following optional criteria depends on the specified protocol:

Source Ports / Destination Ports: A rule filters on ports when the specified protocol supports IP address-port combinations. Rules provide one of these port filtering values:
- Using any denotes that the rule matches all ports.
- A list of ports that matches the packet port. The maximum list size is 10 ports.
- Negative port list. The rule matches any port not in the list. The maximum list size is 10 ports.
- Integer (lower bound): The rule matches any port with a number larger than the integer.
- Integer (upper bound): The rule matches any port with a number smaller than the integer.
- Range integers: The rule matches any port whose number is between the integers.
Flag bits: Rules filter TCP packets on flag bits.
Message type: Rules filter ICMP type or code.
Tracked: Matches packets in existing ICMP, UDP, or TCP connections and is valid in ACLs applied to the control plane. The validity of ACLs applied to the data plane varies by switch platform.

Standard IPv4 and IPv6 ACL Rule Parameters

Note: When calculating the size of ACLs, be aware that Arista switches install four rules in every IPv6 ACL so that ICMPv6 neighbor discovery packets bypass the default drop rule.

Standard ACLs filter only on the source address.

MAC ACL Rule Parameters

MAC ACLs filter traffic on a packet’s layer 2 header. Criteria that MAC ACLs use to filter packets include:

Source Address and Mask: The packet’s source MAC address. Valid rule inputs include:
- MAC address range (address mask in 3x4 dotted hexadecimal notation).
- Using any to denote that the rule matches all source addresses.
Destination Address and Mask: The packet’s destination MAC address. Valid rule inputs include:
- MAC address range (address mask in 3x4 dotted hexadecimal notation).
- Using any to denote that the rule matches all destination addresses.
Protocol: The packet’s protocol as specified by its EtherType field contents. Valid inputs include:
- Protocol name for a limited set of common protocols.
- Assigned protocol number for all protocols.

Creating and Modifying Lists

The switch provides configuration modes for creating and modifying ACLs. The command that enters an ACL configuration mode specifies the name of the list that the mode modifies. When the configuration mode is exited, the switch saves the list to the running configuration.

ACLs are created and modified in ACL configuration mode.
Standard ACLs are created and modified in Standard-ACL-configuration mode.
MAC ACLs are created and modified in MAC-ACL-configuration mode.

Lists created in one mode cannot be modified in any other mode.

A sequence number determines a rule's position within a list. New rules are inserted into a list based on their sequence numbers. You can reference a rule's sequence number to delete it from a list.

ACL Configuration describes procedures for configuring ACLs.

Implementing Access Control Lists

Implement an Access Control List (ACL) by assigning the list to an Ethernet interface, subinterface, port channel interface, or control plane. The switch assigns a default ACL to the control plane unless the configuration contains a valid control-plane ACL assignment statement. Ethernet and port-channel interfaces are not assigned an ACL by default. Apply standard ACLs to interfaces in the same manner as other ACLs.

IPv4 and MAC ACLs are separately applied for inbound and outbound packets. An interface or subinterface can be assigned multiple ACLs, with a limit of one ACL per packet direction per ACL type. A subset of all available switches supports Egress ACLs. The control plane does not support egress ACLs.

Applying ACLs describes procedures for applying ACLs to interfaces or the control plane.

ACL Rule Tracking

ACL rule tracking determines how ACL rules impact traffic on the interfaces where those rules are applied. ACLs provide two tracking mechanisms:

ACL logging: Logs a syslog entry when a packet matches specified ACL rules.
ACL counters: ACL counters increment when a packet matches a rule in specified ACLs.

ACL Logging

ACL rules provide a log option that produces a log message when a packet matches the rule. ACL logging creates a syslog entry when a packet matches an ACL rule where logging is enabled. Packets that match a logging-enabled ACL rule are copied to the CPU by the hardware. These packets trigger the creation of a syslog entry. The information provided in the entry depends on the ACL type or the protocol specified by the ACL. The system applies hardware rate limiting to packets written to the CPU, which prevents potential Denial-of-Service attacks. The logging rate is also limited in software to avoid creating syslog lists that are too large for human operators to use in practical ways.

ACL Rule Tracking Configuration describes procedures for configuring and enabling ACL logging.

ACL Counters

The system assigns an ACL counter to each ACL rule. The activity of the ACL counters for rules within a list depends on the list’s counter state. When the list is in a counting state, the ACL counter of a rule increments when the rule matches a packet. When the list is in a non-counting state, the counter does not increment. A list’s counter state applies to all rules in the ACL. The default state for new ACLs is non-counting.

The system maintains the values of the counters for all rules in the list when an ACL changes from a counting state to a non-counting state or is no longer applied to any interfaces that increment counters. The counters do not reset. When the ACL returns to counting mode or is applied to an interface that increments counters, the counter operation continues from its last value.

Counters never decrement and are reset only through CLI commands.

ACL Rule Tracking Configuration describes procedures for configuring and enabling ACL counters.

Egress ACL Counters

Egress ACL counters count the number of packets matching rules associated with egress ACLs applied to various interfaces in a switch. 7050 and 7060 series switches maintain these counters for every TCAM rule. On these platforms, commands such as show platform trident tcam, show platform trident counters, and show ip access-list always display packet counters greater than zero.

Other switches do not enable counters by default. You must configure counters for each ACL. The show hardware counter and show ip access-list commands display the counters.

Configuring Egress ACL Counters

7050 and 7060 series switches enable egress ACL counters and do not require configuration.

For other platforms, to enable egress ACL counters for a specific ACL, use the counters per-entry command in the ACL's configuration mode.

Example

As shown in the following example, configure the counters per-entry command in the ACL configuration mode.

switch(config)# ip access-list acl1
switch(config-acl-acl1)# counters per-entry

Enabling Egress Counters Globally

7050 and 7060 series switches enable egress counters.

For other switches, enable IPv4 and IPv6 egress ACL counters in the global configuration mode using the hardware counter feature acl out command.

Example

The following examples show how to enable IPv4 and IPv6 egress ACL counters:

switch(config)# hardware counter feature acl out ipv4
switch(config)#

switch(config)# hardware counter feature acl out ipv6
switch(config)#

Disabling Egress Counters Globally

For 7050 and 7060 series switches, egress counters cannot be disabled.

For other switches, disable IPv4 and IPv6 egress ACL counters in the global configuration mode by using the hardware counter feature acl out command.

The following examples show how to disable IPv4 and IPv6 egress ACL counters:

switch(config)# no hardware counter feature acl out ipv4
switch(config)#

switch(config)# no hardware counter feature acl out ipv6
switch(config)#

Egress Counter Roll Over in the Global Mode

The counters roll over when the counter value for an ACL rule exceeds 2^64 (2 to the power of 64).

Example

In the following example, the hardware counter feature acl ipv6 out command is configured using units and packets.

switch(config)# hardware counter feature acl ipv6 out units packets
switch(config)#

The clear ip access-lists counters command clears the counters for all of the IPv4 ACLs or a specific IPv4 ACL, either globally or per CLI session.

Example

In the following example the ACL list named red is selected.

switch(config)# clear ip access-list counters red session
switch(config)#

The IPv6 egress ACL counters do not work in unshared mode.

Example

Use the hardware access-lists resource sharing vlan ipv6 out command to enable egress IPv6 ACL sharing.

switch(config)# hardware access-list resource sharing vlan ipv6 out
switch(config)#

The clear ipv6 access-list counters command clears the counters for all of the IPv6 ACLs or a specific IPv6 ACL, either globally or per CLI session.

Example

In the following example the ACL list named green is selected.

switch(config)# clear ipv6 access-list counters green session
switch(config)#

Displaying Egress ACL Counters

Use the following show commands to display information on Egress ACL Counters.

Use the show ip access-lists command to display all the IPv4 ACLs, or a specific IPv4 ACL configured in a switch. The output contains details such as ACL rules and counter values for each rule.

switch(config)# show ip access-list acl1
IP Access List acl1
        counter per-entry
        10 deny ip 11.1.1.0/24 any dscp af11
        20 deny ip any any [match 39080716, 0:00:00 ago]
        
        Total rules configured: 2
        Configured on Ingress: Et2/1
        Active on     Ingress: Et2/1

Use the show ipv6 access-lists command to display all the IPv6 ACLs or a specific IPv6 ACL configured in a switch. The output contains details such as rules in an ACL and respective counter values with each rule.

switch(config)# show ipv6 access-list acl1
IPV6 Access List acl1
        counter per-entry
        10 permit ipv6 any any [match 3450000, 0:00:10 ago]
        20 deny ipv6 any any
        
        Total rules configured: 2
        Configured on Ingress: Et2/1
        Active on     Ingress: Et2/1

The counter name EgressAclDropCounter in the output of this show command signifies the aggregate counter value for the remaining egress IPv4 ACL. In this example, the deny rules, with per-rule counters, do not allocate. No per-rule counters are allocated if you do not configure the counter per-entry parameter for the respective ACL.

switch(config)# show hardware counter drop
Summary:
Total Adverse (A) Drops: 0
Total Congestion (C) Drops: 0
Total Packet Processor (P) Drops: 250
Type Chip CounterName : Count : First Occurrence : Last Occurrence
-------------------------------------------------------------------------------
P Fap0 EgressAclDropCounter : 250 : 2015-11-11 22:39:02 : 2015-11-11 22:51:44

ACL Configuration

You create and modify Access Control Lists (ACLs) in an ACL-configuration mode. You can edit a list only in the mode where you created it. The switch provides five configuration modes for creating and modifying access control lists:

ACL configuration mode for IPv4 access control lists.
IPv6-ACL configuration mode for IPv6 access control lists.
Std-ACL configuration mode for Standard IPv4 access control lists.
Std-IPv6-ACL configuration mode for Standard IPv6 access control lists.
MAC-ACL configuration mode for MAC access control lists.

These sections describe the creation and modification of ACLs:

Managing ACLs
Modifying an ACL
ACL Rule Tracking Configuration
Displaying ACLs
Configuring Per-Port Per-VLAN QoS
Displaying Per-Port Per-VLAN QoS
Configuring Mirror Access Control Lists

Managing ACLs

Creating and Opening a List

To create an ACL, enter one of the following commands, followed by the name of the list:

ip access-list for IPv4 ACLs.
ipv6 access-list for IPv6 ACLs.
ip access-list standard for standard IPv4 ACLs.
ipv6 access-list standard for standard IPv6 ACLs.
mac access-list for MAC ACLs.

The switch enters the appropriate ACL Configuration Mode for the list. When adding the name of an existing ACL to the command, subsequent commands edit that list (see Modifying an ACL for additional information).

Examples

This command places the switch in ACL Configuration Mode to create an ACL named test1.
```
switch(config)# ip access-list test1
switch(config-acl-test1)#
```
This command places the switch in ACL Configuration Mode to create a Standard ACL named stest1.
```
switch(config)# ip access-list standard stest1
switch(config-std-acl-stest1)#
```
This command places the switch in ACL Configuration Mode to create an MAC ACL named mtest1.
```
switch(config)# mac access-list mtest1
switch(config-mac-acl-mtest1)#
```

Saving List Modifications

ACL Configuration Modes are group-change modes. Changes made in a group-change mode are saved when exiting the mode. To discard changes, use the abort command instead of exit.

Examples

Use the following commands to configure the first three rules into a new ACL.

switch(config-acl-test1)# permit ip 10.10.10.0/24 any
switch(config-acl-test1)# permit ip any host 10.20.10.1
switch(config-acl-test1)# deny ip host 10.10.10.1 host 10.20.10.1

To view the edited list, use the show command.

switch(config-acl-test1)# show
IP Access List test1
        10 permit ip 10.10.10.0/24 any
        20 permit ip 10.30.10.0/24 host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
        40 permit ip any any

Because EOS has not saved the changes, the ACL remains empty, as displayed by show ip access-lists.

switch(config-acl-test1)# show ip access-lists test1
switch(config-acl-test1)#

Use the exit command to save all current changes to the ACL and exit the ACL configuration mode.

switch(config-acl-test1)# exit
switch(config)# show ip access-lists test1
IP Access List test1
        10 permit ip 10.10.10.0/24 any
        20 permit ip 10.30.10.0/24 host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
        40 permit ip any any

Total rules configured: 4
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1

To apply the ACL test1 on an interface, Ethernet1/1, for example, and on the ingress direction, use the following command:

switch(config)# int et1/1
switch(config-if-Et1/1)# ip access-group test1 in

Use the exit command to save all changes to the Ethernet interface and exit the interface configuration mode.

switch(config-if-Et1/1)# exit
switch(config)#
switch(config)# show ip access-lists test1
IP Access List test1
        10 permit ip 10.10.10.0/24 any
        20 permit ip 10.30.10.0/24 host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
        40 permit ip any any

Total rules configured: 4
Configured on Ingress: Et1/1
Active on     Ingress: Et1/1

Discarding List Changes

The abort command exits ACL Configuration mode without saving pending changes.

Examples

The following commands enter the first three rules into a new ACL.

switch(config-acl-test1)# permit ip 10.10.10.0/24 any
switch(config-acl-test1)# permit ip any host 10.20.10.1
switch(config-acl-test1)# deny ip host 10.10.10.1 host 10.20.10.1

To view the edited list, use the show command.

switch(config-acl-test1)# show
IP Access List test1
        10 permit ip 10.10.10.0/24 any
        20 permit ip 10.30.10.0/24 host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
        40 permit ip any any

To discard the changes, use the abort command. If the ACL existed before entering the ACL Configuration Mode, the abort command restores the version that existed before entering the ACL Configuration Mode. Otherwise, the show ip access-lists command displays no output.

switch(config-acl-test1)# abort
switch(config)#

Modifying an ACL

An existing ACL, including those applied to interfaces, can be modified by entering the appropriate configuration mode for the ACL as described in Creating and Opening a List. By default, while modifying an ACL, all traffic is blocked on any interface using the ACL.

Permit All Traffic During ACL Update

To avoid packet loss and interference with features like routing and dynamic NAT, you can configure the following switches to permit all traffic on Ethernet and VLAN interfaces during ACL modifications:

7050X
7060X
7150
7250X
7280
7280R
7300X
7320X
7500 series switches

Use the hardware access-list update default-result permit command to configure the preceding switches.

The following commands add deny rules to the appropriate ACL:

deny (IPv4 ACL) adds a deny rule to an IPv4 ACL.
deny (IPv6 ACL) adds a deny rule to an IPv6 ACL.
deny (Standard IPv4 ACL) adds a deny rule to an IPv4 standard ACL.
deny (Standard IPv6 ACL) adds a deny rule to an IPv6 standard ACL.
deny (MAC ACL) adds a deny rule to a MAC ACL.

The following commands add permit rules to the appropriate ACL:

permit (IPv4 ACL) adds a permit rule to an IPv4 ACL.
permit (IPv6 ACL) adds a permit rule to an IPv6 ACL.
permit (Standard IPv4 ACL) adds a permit rule to an IPv4 standard ACL.
permit (Standard IPv6 ACL) adds a permit rule to an IPv6 standard ACL.
permit (MAC ACL) adds a permit rule to a MAC ACL.

Adding a Rule

To append a rule to the end of a list, enter the rule without a sequence number while in ACL configuration mode for the list. The switch computes the new rule’s sequence number by adding 10 to the last rule’s sequence number.

Examples

The following command configures the switch to permit all traffic during ACL modifications on interfaces using the ACL. The rules in modified ACLs go into effect after exiting ACL configuration mode and after populating the ACL rules in hardware.
```
switch(config)# hardware access-list update default-result permit 
```

The following commands enter the first three rules into a new ACL.

switch(config-acl-test1)# permit ip 10.10.10.0/24 any
switch(config-acl-test1)# permit ip any host 10.20.10.1
switch(config-acl-test1)# deny ip host 10.10.10.1 host 10.20.10.1

To view the edited list, use the show command.

switch(config-acl-test1)# show
IP Access List test1
        10 permit ip 10.10.10.0/24 any
        20 permit ip any host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1

The following command appends a rule to the ACL. The new rule’s sequence number is 40.

switch(config-acl-test1)# permit ip any any
switch(config-acl-test1)# show
IP Access List test1
        10 permit ip 10.10.10.0/24 any
        20 permit ip any host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
        40 permit ip any any

Inserting a Rule

To insert a rule into an ACL, enter the rule with a sequence number between the existing rules’ numbers.

Example

The following command inserts a rule between the first two by assigning the sequence number 15.

Switch(config-acl-test1)# 15 permit ip 10.30.10.0/24 host 10.20.10.1
Switch(config-acl-test1)# show
IP Access List test1
        10 permit ip 10.10.10.0/24 any
        15 permit ip 10.30.10.0/24 host 10.20.10.1
        20 permit ip any host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
        40 permit ip any any

Deleting a Rule

To remove a rule from the current ACL, perform one of these commands:

Enter no, followed by the sequence number to delete a rule.
Enter no, followed by the actual rule to delete it.
Enter default, followed by the actual rule to delete it.

Examples

These equivalent commands remove rule 20 from the list.

switch(config-acl-test1)# no 20
switch(config-acl-test1)# no permit ip any host 10.20.10.1
switch(config-acl-test1)# default permit ip any host 10.20.10.1

This ACL results from entering one of the preceding commands.

switch(config-acl-test1)# show
ip access list test1
        10 permit ip 10.10.10.0/24 any
        15 permit ip 10.30.10.0/24 host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
        40 permit ip any any

Resequencing Rule Numbers

Sequence numbers determine the order of the rules in an ACL. After editing a list and deleting existing rules while inserting new rules between existing rules, the sequence number distribution may not be uniform. Resequencing rule numbers changes the sequence number of rules to provide a constant difference between adjacent rules. The resequence (ACLs) command adjusts the sequence numbers of ACL rules.

Example

The resequence (ACLs) command renumbers rules in the test1 ACL. The sequence number of the first rule is 100; subsequent rule numbers are incremented by 20.

switch(config-acl-test1)# show
IP Access List test1
        10 permit ip 10.10.10.0/24 any
        25 permit ip any host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
        50 permit ip any any
        90 remark end of list
switch(config-acl-test1)# resequence 100 20
switch(config-acl-test1)# show
IP Access List test1
        100 permit ip 10.10.10.0/24 any
        120 permit ip any host 10.20.10.1
        140 deny ip host 10.10.10.1 host 10.20.10.1
        160 permit ip any any
        180 remark end of list

ACL Rule Tracking Configuration

ACL Rules provide a log option that produces a syslog message about the packets matching a desired packet. ACL Logging creates a syslog entry when a packet matches an ACL rule with logging enabled.

Example

The following command creates an ACL Rule with logging enabled.

switch(config-acl-test1)# 15 permit ip 10.30.10.0/24 host 10.20.10.1 log
switch(config-acl-test1)#

The format of the generated Syslog message depends on the ACL type and the specified protocol:

Messages generated by a TCP or UDP packet matching an IP ACL:
IPACCESS: list acl intf filter protocol src-ip(src_port) -> dst-ip(dst_port)
Messages generated by ICMP packets matching an IP ACL:
IPACCESS: list acl intf filter icmp src-ip(src-port) -> dst-ip(dst-port) type= n code= m
Messages generated by all other IP packets matching an IP ACL:
IPACCESS: list acl intf filter protocol src-ip -> dst-ip
Messages generated by packets matching a MAC ACL:
MACACCESS: list acl intf filter vlan ether src_mac -> dst_mac
Messages generated by a TCP or UDP packet matching a MAC ACL:
MACACCESS: list acl intf filter vlan ether ip-prt src-mac src-ip : src-prt -> dst-mac dst-ip : dst-prt
Messages generated by any other IP packet matching a MAC ACL:
MACACCESS: list acl intf filtervlan ether src_mac src_ip -> dst_mac dst_ip

Variables in the Syslog messages display the following values:

acl - Specifies the name of the ACL.
intf - Specifies the name of the interface receiving the packet.
filter - Specifies the action triggered by the ACL as denied or permitted.
protocol - Specifies the IP protocol specified by the packet.
vlan - Specifies the number of the VLAN receiving the packet.
ether - Specifies the EtherType protocol specified by the packet.
src-ip and dst-ip - Specifies the source and destination IP addresses.
src-prt and dst-prt - Specifies the source and destination ports.
src-mac and dst-mac - Specifies the source and destination MAC addresses.

ACLs provide a command that configures as counter state as counting or non-counting. The counter state applies to all rules in the ACL. The initial state for new ACLs defaults to non-counting.

The counters per-entry (ACL configuration modes) command places the ACL in counting mode.

The following command places the configuration mode ACL in counting mode.

switch(config-acl-test1)# counters per-entry
switch(config-acl-test1)# exit
switch(config-acl-test1)# show ip access-list test1
IP Access List test1
        counters per-entry
        10 permit ip 10.10.10.0/24 any
        20 permit ip any host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
        40 permit ip any any
        50 remark end of list
Total rules configured: 5
        Configured on Ingress: Et1
        Active on     Ingress: Et1

The clear ip access-lists counters and clear ipv6 access-lists counters commands set the IP access list counters to zero for the specified IP access list.

The following command clears the ACL counter for the test1 ACL.

switch(config)# clear ip access-lists counters test1
switch(config)#

Displaying ACLs

Display ACLs using the show running-config command. The show ip access-lists command also displays ACL rosters and contents as specified by command parameters.

When editing an ACL, the show (ACL configuration modes) command displays the current or pending list as specified by command parameters.

Displaying a List of ACLs

To display the roster of ACLs on the switch, use the show [ip | ipv6 | mac] access-lists command with the summary option.

Example

The following command lists the available IPv4 access control lists.

switch(config)# show ip access-lists summary
IPV4 ACL default-control-plane-acl
        Total rules configured: 12
        Configured on: control-plane
        Active on    : control-plane

IPV4 ACL list2
        Total rules configured: 3

IPV4 ACL test1
        Total rules configured: 6

IPV4 ACL test_1
        Total rules configured: 1

IPV4 ACL test_3
        Total rules configured: 0
switch(config)#

Displaying Contents of an ACL

These commands display ACL contents.

show access-lists
show ip access-lists
show ipv6 access-lists
show mac access-lists

Each command can display the contents of one ACL or of all ACLs of the type specified by the command:

To display the contents of one ACL, enter show acl_type access-lists followed by the name of the ACL. The acl_type can be ip, ipv6, mac or null.
To display the contents of all ACLs on the switch, enter the command without any options.

ACLs in counting mode display the number of inbound packets matching each rule in the list and the elapsed time since the last match.

Examples

The following command displays the rules in the default-control-plane-acl IP ACL, configuration, and status.

switch# show ip access-lists default-control-plane-acl
IP Access List default-control-plane-acl [readonly]
        counters per-entry
        10 permit icmp any any
        20 permit ip any any tracked [match 1725, 0:00:00 ago]
        30 permit ospf any any
        40 permit tcp any any eq ssh telnet www snmp bgp https
        50 permit udp any any eq bootps bootpc snmp [match 993, 0:00:29 ago]
        60 permit tcp any any eq mlag ttl eq 255
        70 permit udp any any eq mlag ttl eq 255
        80 permit vrrp any any
        90 permit ahp any any
        100 permit pim any any
        110 permit igmp any any [match 1316, 0:00:23 ago]
        120 permit tcp any any range 5900 5910
Total rules configured: 12
             Configured on Ingress: control-plane(default VRF)
             Active on     Ingress: control-plane(default VRF)

The following command displays the rules, configuration, and status of all the IP ACLs on the switch.

switch# show ip access-lists
IP Access List default-control-plane-acl [readonly]
        counters per-entry
        10 permit icmp any any
        20 permit ip any any tracked [match 1371, 0:00:00 ago]
        30 permit ospf any any
        40 permit tcp any any eq ssh telnet www snmp bgp https
        50 permit udp any any eq bootps bootpc snmp
        60 permit tcp any any eq mlag ttl eq 255
        70 permit udp any any eq mlag ttl eq 255
        80 permit vrrp any any
        90 permit ahp any any
        100 permit pim any any
        110 permit igmp any any [match 1316, 0:00:23 ago]
        120 permit tcp any any range 5900 5910

        Total rules configured: 12
        Configured on Ingress: control-plane(default VRF)
        Active on     Ingress: control-plane(default VRF)

IP Access List list2
        10 permit ip 10.10.10.0/24 any
        20 permit ip 10.30.10.0/24 host 10.20.10.1
        30 permit ip any host 10.20.10.1
        40 deny ip host 10.10.10.1 host 10.20.10.1
        50 permit ip any any

        Total rules configured: 5
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1


IP Access List test1
switch(config)#

Displaying ACL Modifications

While editing an ACL in ACL Configuration Mode, the show command provides options for displaying ACL contents.

To display the list, as modified in ACL configuration mode, enter show or show pending.
To display the list, as stored in running-config, enter show active.
To display differences between the pending list and the stored list, enter show diff.

Examples

The examples in this section display previously configured ACL commands.

The configuration stores these parameters:

10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.21.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
50 remark end of list

The current edit session removed this command, and the change not yet stored to the running-config:

20 permit ip any host 10.21.10.1

The current edit session added these commands to the ACL, and the change not yet stored to the running-config:

20 permit ip 10.10.0.0/16 any
25 permit tcp 10.10.20.0/24 any
45 deny pim 239.24.124.0/24 10.5.8.4/30

The following command displays the pending ACL as modified in the ACL Configuration Mode.

switch(config-acl-test_1)# show pending
IP Access List test_1
        10 permit ip 10.10.10.0/24 any
        20 permit ip 10.10.0.0/16 any
        25 permit tcp 10.10.20.0/24 any
        30 deny ip host 10.10.10.1 host 10.20.10.1
        40 permit ip any any
        45 deny pim 239.24.124.0/24 10.5.8.4/30
        50 remark end of list

The following command displays the ACL as stored in the configuration.

switch(config-acl-test_1)# show active
IP Access List test_1
        10 permit ip 10.10.10.0/24 any
        20 permit ip any host 10.21.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
        40 permit ip any any
        50 remark end of list

The following command displays the difference between the saved and modified ACLs.

A plus sign (+) denotes rules added to the pending list.

A minus sign (-) denotes rules removed from the saved list.

switch(config-acl-test_1)# show diff
---
+++
@@ -1,7 +1,9 @@
 IP Access List test_1
         10 permit ip 10.10.10.0/24 any
-        20 permit ip any host 10.21.10.1
+        20 permit ip 10.10.0.0/16 any
+        25 permit tcp 10.10.20.0/24 any
         30 deny ip host 10.10.10.1 host 10.20.10.1
         40 permit ip any any
+        45 deny pim 239.24.124.0/24 10.5.8.4/30

Displaying Egress ACL Counters

The following show commands display Egress ACL Counters information.

Use the show ip access-lists command to display all the IPv4 ACLs, or a specific IPv4 ACL configured in a switch. The output contains details such as rules in an ACL as well as the respective counter values with each rule, configuration, and status.

switch(config)# show ip access-list acl1
IP Access List acl1
 counter per-entry
 10 deny ip 11.1.1.0/24 any dscp af11
 20 deny ip any any [match 39080716, 0:00:00 ago]

 Total rules configured: 2
 Configured on Ingress: Et2/1
 Active on     Ingress: Et2/1

Use the show ipv6 access-lists command to display all the IPv6 ACLs or a specific IPv6 ACL configured in a switch. The output contains details such as rules in an ACL and the respective counter values with each rule along with the configuration and status.

switch(config)# show ipv6 access-list acl1
IPV6 Access List acl1
 counter per-entry
 10 permit ipv6 any any [match 3450000, 0:00:10 ago]
 20 deny ipv6 any any

 Total rules configured: 2
 Configured on Ingress: Et1/1
 Active on     Ingress: Et1/1

The counter name EgressAclDropCounter in the output of this show command signifies the aggregate counter value for the remaining egress IPv4 ACL. In this example, the deny rules, with per rule counters, are not allocated. The per-rule counters are not allocated when the user does not configure the counter per-entry parameter for the respective ACL.

switch(config)# show hardware counter drop
Summary:
Total Adverse (A) Drops: 0
Total Congestion (C) Drops: 0
Total Packet Processor (P) Drops: 250
Type Chip CounterName : Count : First Occurrence : Last Occurrence
-------------------------------------------------------------------------------
P Fap0 EgressAclDropCounter : 250 : 2015-11-11 22:39:02 : 2015-11-11 22:51:44

Configuring Per-Port Per-VLAN QoS

To configure per-port per-VLAN Quality of Service (QoS), first configure the ACL policing for QoS and then apply the policy map on a single Ethernet or port-channel interface on a per-port per-VLAN basis. The per port per VLAN QoS allows a class map to match traffic for a single VLAN or for a range of VLANs separated by commas. Per-port per-VLAN only works with QoS-based class maps.

To configure per-port per-VLAN QoS on DCS-7280(R) and DCS-7500(R), change the TCAM profile to QoS as shown in the following steps:

Change the TCAM profile to QoS.

switch# config
switch(config)# hardware tcam profile qos

Create an ACL and then match the traffic packets based on the VLAN value and the VLAN mask configured in the ACL.

switch(config)# ip access-list acl1
switch(config-acl-acl1)# permit vlan 100 0xfff ip any any
switch(config-acl-acl1)# exit

Similarly, create a class map and then match the traffic packets based on the range of VLAN values configured in the class map.

switch(config)# class-map match-any class1
switch(config-cmap-qos-class1)# match vlan 20-40, 1000-1250, 2000
switch(config-cmap-qos-class1)# exit

Displaying Per-Port Per-VLAN QoS

The following show commands display the status, traffic hit counts, TCAM profile information, and policy maps configured on an interface.

Examples

The show policy-map command displays the policy-map information of the configured policy-map.

switch# show policy-map policy1
Service-policy policy1
Class-map: class1 (match-any)
Match: ip access-group name acl1
Police cir 512000 bps bc 96000 bytes
Class-map: class-default (match-any)

The show policy-map interface command displays the policy-map configured on an interface.

switch# show policy-map interface ethernet 1
Service-policy input: p1
Hardware programming status: Successful
Class-map: c2001 (match-any)
Match: vlan 2001 0xfff
set dscp 4
Class-map: c2002 (match-any)
Match: vlan 2002 0xfff
set dscp 8
Class-map: c2003 (match-any)
Match: vlan 2003 0xfff
set dscp 12

Configuring Mirror Access Control Lists

Access Control Lists (ACLs) are configured to permit or deny traffic between source and destination ports on Strata-based platforms. Mirror ACLs are used in mirroring traffic by matching VLAN ID of the configured ACLs. Mirror ACLs are applied for IPv4, IPv6, and MAC ACLs.

Note:Mirror ACLs work only in the receiving direction.

Examples

The following commands configure ACL to permit VLAN traffic between any source and destination host.
```
switch(config)# ip access-list acl1
switch(config-acl-acl1)# permit vlan 1234 0x0 ip any any
```

The following commands configure monitor session sess1 with Ethernet 1 as source port and Ethernet 2 as the destination port for an ingress ip acl_1.

switch(config)# monitor session sess1 source ethernet 1 rx ip access-group acl1
switch(config)# monitor session sess1 destination ethernet 2

Applying ACLs

Access Control Lists (ACLs) become active when assigned to an interface, subinterface, or control plane. This section describes the process of adding and removing ACL interface assignments.

Applying an ACL to an Interface

The switch must be in interface configuration mode to assign an ACL to an interface or subinterface.

The ip access-group command applies the specified IP or standard IP ACL to the configuration mode interface or subinterface.
The ip access-group command applies the specified IP or standard IP ACL to the control plane traffic.
The mac access-group command applies the specified MAC ACL to the configuration mode interface.

IPv4, IPv6, and MAC ACLs are separately applied for inbound and outbound packets. You can assign an interface or subinterface with multiple ACLs, with a limit of one ACL per packet direction per ACL type. A subset of all available switches support Egress ACLs. IPv6 egress ACLs have limited availability, and IPv6 egress ACLs applied to routed interfaces or subinterfaces across the same chip on the DCS-7500E and the DCS-7280E series can be shared. In addition to that, the DSCP value can match on IPv6 egress ACLs. This ability results in more efficient utilization of system resources and is particularly useful for environments with few, potentially large, IPv6 egress ACLs applied across multiple routed interfaces.

Examples

These commands assign test1 ACL to interface ethernet 3, and verify the assignment.

switch(config)# interface ethernet 3
switch(config-if-Et3)# ip access-group test1 in
switch(config-if-Et3)# show running-config interfaces ethernet 3
interface Ethernet3
   ip access-group test1 in
switch(config-if-Et3)#

The following commands place the switch in control plane configuration mode and applies the ACL assignment to the control plane traffic.
```
switch(config)# control-plane
switch(config-cp)# ip access-group test_cp in
```

The following command enables shared ACLs.

switch(config)# hardware access-list resource sharing vlan ipv6 out
switch(config)#

The following command disables shared ACLs.

switch(config)# no hardware access-list resource sharing vlan ipv6 out
switch(config)#

The following commands apply an IPv4 ACL named test_ACL to ingress traffic on interface ethernet 5.1.

switch(config)# interface ethernet 5.1
switch(config-if-Et5.1)# ipv4 access-group test_ACL in
switch(config-if-Et5.1)#

Removing an ACL from an Interface

The no ip access-group command removes an IP ACL assignment statement from running-config for the configuration mode interface. After removing an ACL, the interface is no longer associated with an IP ACL.

The no mac ip access-group command removes a MAC ACL assignment statement from running-config for the configuration mode interface. After removing a MAC ACL is removed, the interface is no longer associated with an MAC ACL.

To remove an ACL from the control plane, enter the no ip access-group command in control plane configuration mode. Removing the control plane ACL command from running-config reinstates default-control-plane-acl as the control plane ACL.

Examples

The following commands remove the assigned IPv4 ACL from interface ethernet 3.

switch(config)# interface ethernet 3
switch(config-if-Et3)# no ip access-group test in
switch(config-if-Et3)#

The following commands place the switch in control plane configuration mode and remove the ACL assignment from running-config, restoring default-control-plane-acl as the control plane ACL.
```
switch(config)# control-plane
switch(config-cp)# no ip access-group test_cp in
switch(config-cp)#
```

Service ACLs

These sections describe Service ACLs:

Service Access Control List Description
Configuring Service ACLs and Displaying Status and Counters

Service Access Control List Description

Service ACL enforcement is a feature added to a control plane service (the SSH server, the SNMP server, routing protocols, etc.) that allows the switch administrator to restrict the processing of packets and connections by the control plane processes that implement that service. The control plane program run by the control plane process checks already received packets and connections against a user-configurable Access Control List (ACL), a Service ACL.

The Service ACL contains permit and deny rules matching any source address, destination address, and TCP or UDP ports of received packets or connections. After receiving a packet or connection, the control plane process evaluates the packet or connection against the rules of the Service ACL configured for the control plane process. If the received packet or connection matches a deny rule, the control plane process drops or closes it without further processing.

Control Plane Process Enforced Access Control enables the system administrator to restrict which systems on the network can access the services provided by the switch. Each service has its own access control list, giving the system administrator fine-grained control over access to the switch's control plane services. The CLI for this uses the familiar pattern of access control lists assigned for a specific purpose, in this case, for each control plane service.

Configuring Service ACLs and Displaying Status and Counters

SSH Server

To apply the SSH Server Service ACLs for IPv4 and IPv6 traffic, use the ip access-group (Service ACLs) and ipv6 access-group (Service ACLs) commands in config-mgt-ssh configuration mode:

switch(config)# management ssh
switch(config-mgmt-ssh)# ip access-group <acl_name> [vrf <vrf_name>] in
switch(config-mgmt-ssh)# ipv6 access-group <acl_name> [vrf <vrf_name>] in

In Release EOS-4.19.0, all VRFs are required to use the same SSH Server Service ACL. The Service ACL assigned without the vrf keyword is applied to all VRFs where the SSH Server is enabled.

Use the following commands to display the status and counters of the SSH Server Service ACLs:

switch# show management ssh ip access-list
switch# show management ssh ipv6 access-list

SNMP Server

Use the snmp-server community command to apply the SNMP Server Service ACLs to restrict which hosts can access SNMP services on the switch:

Example

switch(config)# snmp-server community community-name [view viewname] [ro | rw] acl_name

switch(config)# snmp-server community community-name [view viewname] [ro | rw] ipv6 ipv6_acl_name

EAPI

Use the ip access-group (Service ACLs) and ipv6 access-group (Service ACLs) commands to apply Service ACLs to the EOS Application Programming Interface (EAPI) Server:

switch(config)# management api http-commands
switch(config-mgmt-api-http-cmds)# vrf <vrf_name>
switch(config-mgmt-api-http-cmds-vrf-<vrf>)# ip access-group <acl_name>
switch(config-mgmt-api-http-cmds-vrf-<vrf>)# ipv6 access-group <ipv6_acl_name>

Use the following commands to display the status and counters of the EAPI server Service ACLs:

switch# show management api http-commands ip access-list
switch# show management api http-commands ipv6 access-list

BGP

Use the ip access-group (Service ACLs) and ipv6 access-group (Service ACLs) commands to apply Service ACLs for controlling connections to the BGP routing protocol agent:

switch(config)# router bgp <asn>
switch(config-router-bgp)# ip access-group <acl_name>
switch(config-router-bgp)# ipv6 access-group <ipv6_acl_name>
switch(config-router-bgp)# vrf <vrf_name>
switch(config-router-bgp-vrf-<vrf>)# ip access-group <acl_name>
switch(config-router-bgp-vrf-<vrf>)# ipv6 access-group <ipv6_acl_name>

Use the following commands to display the status and counters of the BGP routing protocol Service ACLs:

switch# show bgp ipv4 access-list
switch# show bgp ipv6 access-list

UCMP Auto Adjust for BGP

Unequal Cost MultiPath (UCMP) for BGP forwards traffic based on weight assignments for next hops of Equal Cost MultiPath (ECMP) routes. The system programs the weights in the Forwarding Information Base (FIB).

Devices that receive BGP routes disseminate BGP link-bandwidth extended community attribute information. These devices then program the next hops in the FIB using the received link-bandwidth values. The system appends the percentage of interface speed to the received link bandwidth extended community value of the route. It adjusts the weight ratio of the traffic sent over egress ports to forward more traffic toward the peer with a higher interface speed.

Configuring UCMP Auto Adjust for BGP

The following command enables the weight adjustment and configures the adjust auto to 62.3 percent.

switch(config-router-bgp)# neighbor group1 link-bandwidth adjust auto percent 62.3

PERCENT is a float value between 0.0 and 100.0 and is optional.

OSPF

Use the ip access-group (Service ACLs) and ipv6 access-group (Service ACLs) commands to apply Service ACLs to control packets processed by the OSPF routing protocol agent:

Example

switch(config)# router ospf <id>
switch(config-router-ospf)# ip access-group <acl_name>
switch(config-router-ospf)# ipv6 access-group <ipv6_acl_name>

When using VRFs, each per VRF OSPF instance must be explicitly assigned its Service ACL.

Use the following commands to display the OSPF routing protocol Service ACLs' status and counters:

switch# show ospf ipv4 access-list
switch# show ospf ipv6 access-list

PIM

Use the access-group command to apply Service ACLs for controlling packets processed by the PIM routing protocol agent:

switch(config)# router pim
switch(config-router-pim)# ipv4
switch(config-router-pim-ipv4)# access-group <acl_name>
switch(config-router-pim-ipv4)# vrf <vrf_name>
switch(config-router-pim-vrf-<vrf>)# ipv4
switch(config-router-pim-vrf-<vrf>-ipv4)# access-group <acl_name>

Use the following command to display the status and counters of the PIM routing protocol Service ACLs.

switch# show ip pim access-list

IGMP

Use the ip igmp access-group command to apply Service ACLs for controlling packets processed by the IGMP management protocol agent:

switch(config)# router igmp
switch(config-router-igmp)# ip igmp access-group <acl_name>
switch(config-router-igmp)# vrf <vrf_name>
switch(config-router-igmp-vrf-<vrf>)# ip igmp access-group <acl_name>

Use the following command to display the status and counters of the IGMP management protocol Service ACLs.

switch# show ip igmp access-list

DHCP Relay

Use the ip dhcp relay access-group and ipv6 dhcp relay access-group commands to apply Service ACLs for controlling packets processed by the DHCP relay agent:

switch(config)# ip dhcp relay access-group <acl_name> [vrf <vrf_name>]
switch(config)# ipv6 dhcp relay access-group <acl_name> [vrf <vrf_name>]

Use the following commands to display the status and counters of the DHCP relay agent Service ACLs:

switch# show ip dhcp relay access-list
switch# show ipv6 dhcp relay access-list

LDP

Use the ip access-group (Service ACLs) to apply Service ACLs for controlling packets and connections processed by the LDP MPLS label distribution protocol:

switch(config)# mpls ldp 
switch(config-mpls-ldp)# ip access-group <acl_name>

Use the following command to display the status and counters of the LDP Service ACLs.

switch# show mpls ldp access-list

LANZ

Use the ip access-group (Service ACLs) and ipv6 access-group (Service ACLs) commands to apply Service ACLs for controlling connections accepted by the LANZ agent:

switch(config)# queue-monitor streaming
switch(config-qm-streaming)# ip access-group <acl_name>
switch(config-qm-streaming)# ipv6 access-group <ipv6_acl_name>

Use the following command to display the status and counters of the LDP Service ACLs.

switch# show queue-monitor streaming access-lists

MPLS Ping and Traceroute

Use the ip access-group (Service ACLs) and ipv6 access-group (Service ACLs) commands to apply Service ACLs for controlling connections accepted by the MPLS Ping agent:

switch(config)# mpls ping
switch(config-mpls-ping)# ip access-group <acl_name> [vrf <vrf_name>]
switch(config-mpls-ping)# ipv6 access-group <ipv6_acl_name> [vrf <vrf_name>]

Telnet Server

Use the ip access-group (Service ACLs) and ipv6 access-group (Service ACLs) commands to apply Service ACLs to the Telnet server:

switch(config)# management telnet
switch(config-mgmt-telnet)# ip access-group <acl_name> [vrf <vrf_name>] in
switch(config-mgmt-telnet)# ipv6 access-group <ipv6_acl_name> [vrf <vrf_name>] in

In EOS 4.19.0, all VRFs are required to use the same Telnet server Service ACL. The Service ACL assigned without the vrf keyword is applied to all VRFs where the Telnet server is enabled.

Use the following commands to display the status and counters of the LDP Service ACLs:

switch# show management telnet ip access-list
switch# show management telnet ipv6 access-list

Sub-interface ACLs

This Sub-interface ACLs feature enables ACL functionality on subinterfaces.

Configuring Sub-interface ACLs

Configure the ACLs on subinterfaces using the following command.

ip|ipv6 access-group acl-name in | out

Use the following command to unconfigure the ACLs on subinterfaces.

no ip|ipv6 access-group in | out

Configuring ACL Mirroring on a Subinterface Source

Configure a mirror session using subinterface sources and apply explicit ACLs to each source in the session. EOS only supports ingress mirroring from the Rx direction.

Use the following commands to configure a session, ACLMirror1, on Ethernet5/1.1, Ethernet5/1.2, Ethernet6/1 as the source, acl1 as the ACL group, and Ethernet 14/1 as the destination:

switch(config)# monitor session ACLMirror1 source Ethernet 5/1.1 rx
switch(config)# monitor session ACLMirror1 source Ethernet 5/1.2 rx ip access-group acl1
switch(config)# monitor session ACLMirror1 source Ethernet 6/1 rx
switch(config)# monitor session ACLMirror1 destination Ethernet 14/1

Displaying the ACL Mirroring Information

Use the show monitor session command to display the session information:

switch(config)# show monitor session
Session ACLMirror1
------------------------
        
Programmed in HW: Yes
        
Source Ports:
        
  Rx Only:     Et5/1.2(IP ACL: acl1), Et5/1.1
               Et6/1
        
Destination Ports:
        
    Et14/1 :  active

Sub-interface ACLs Limitations

The sub-interface ACLs feature contains the following limitations:

Egress IPv4 ACLs on subinterfaces are not supported when sharing mode is disabled for Egress IPv4 RACLs.
Egress IPv6 ACL deny logging is not supported on subinterfaces.
Blocking traffic while modifying ACLs is not supported on Egress IPv4 ACLs on subinterfaces.

Sub-interface ACLs Show Commands

The show ip access-lists and show ipv6 access-lists commands display the summary of a configured ACL including the subinterface on which the ACL is configured and active.

show ip|ipv6 access-lists acl-name summary

Examples

switch(config)# show ip access-lists acl1 summary 
IPV4 ACL acl1
 Total rules configured: 1
 Configured on Ingress: Et5.1
 Active on Ingress: Et5.1

switch(config)# show ipv6 access-lists acl1 summary 
IPV6 ACL acl1
 Total rules configured: 1
 Configured on Egress: Et5.1
 Active on Egress: Et5.1

RACL Sharing on SVIs

IPv4 Ingress Sharing

IPv4 ingress sharing optimizes the utilization of hardware resources by sharing them between different VLAN interfaces when they have the same ACL attached.

Larger deployments benefit from this function, where IPv4 ingress sharing is applied on multiple SVIs with member interfaces on the same forwarding ASIC. For example, a trunk port carrying multiple VLANs and an ingress sharing is applied on all VLANs; it occupies lesser hardware resources irrespective of the number of VLANs. By default, IPv4 ingress sharing is disabled on the switches.

To enable IPv4 Ingress Sharing, use the no hardware access-list resource sharing vlan in command.

Note: Enabling or disabling the IPv4 ingress sharing requires the restart of software agents on the switches which is a disruptive process and will impact the traffic forwarding.

The no form of the command disables the IPv4 ingress sharing on the switch. To display the IPv4 ingress sharing information use show platform trident command on the switch.

IPv4 Egress Sharing

IPv4 Egress Sharing optimizes the utilization of hardware resources by sharing TCAM entries for a group of SVIs on which IPv4 ACLs are shared. The TCAM entries are shared for all the SVIs per chip, saving a lot of hardware resources and enabling ACLs to scale to larger configurations.

Larger deployments benefit from IPv4 Egress Sharing, which is applied on multiple SVIs with member interfaces on the same forwarding ASIC. For example, a trunk port carrying multiple VLANs, and when applying Egress Sharing on all VLANs, it occupies lesser hardware resources irrespective of the number of VLANs.

By default, the system enables IPv4 Egress Sharing on the switches. However, enabling both IPv4 Egress Sharing and uRPF cannot at the same time is not possible. Disabling IPv4 RACL sharing will allow uRPF configuration and ensure the simultaneous configuration of the RACL in non-shared mode.

To enable unicast Reverse Path Forwarding (uRPF) on the switch, the IPv4 Egress Sharing must be disabled using the no hardware access-list resource sharing vlan ipv4 out command.

If IPv4 Egress Sharing was previously disabled from the default configuration, use the hardware access-list resource sharing vlan ipv4 out command to enable it.

Note: Enabling or disabling IPv4 Egress Sharing requires restarting software agents on the switches, which is a disruptive process and will impact the traffic forwarding.

Use the following show commands to verify the IPv4 Egress Sharing information on the switch.

Configuring IPv4 Egress Sharing

The hardware access-list resource sharing vlan ipv4 out command enables IPv4 Egress Sharing on the switch.

Note: IPv4 Egress Sharing is enabled by default.

The no form of the command disables the switch's IPv4 Egress Sharing, allowing you to configure the uRPF.

Displaying IPv4 Egress Sharing Information

Examples

The show ip access-lists command displays the list of all the configured IPv4 ACLs.

switch# show ip access-lists summary
IPV4 ACL default-control-plane-acl [readonly]
 Total rules configured: 17
 Configured on Ingress: control-plane(default VRF)
 Active on Ingress: control-plane(default VRF)

IPV4 ACL ipAclLimitTest
 Total rules configured: 0
 Configured on Egress: Vl2148,2700
 Active on Egress: Vl2148,2700

The show vlan command displays the list of all the member interfaces under each SVI.

switch# show vlan
VLAN  Name           Status    Ports
----- -------------- --------- -----------------
1     default        active
2148  VLAN2148       active    Cpu, Et1, Et26
2700  VLAN2700       active    Cpu, Et18

The show platform arad acl tcam command displays the number of TCAM entries (hardware resources) occupied by the ACL on each forwarding ASIC and the percentage of TCAM utilization per forwarding ASIC.

switch# show platform arad acl tcam detail
ip access-list ipAclLimitTest (Shared RACL, 0 rules, 1 entries, direction out, 
state success, Acl Label 2)
Fap: Arad0, Shared: true, Interfaces: Vl2148, Vl2700
Bank Offset Entries
0         0       1
Fap: Arad1, Shared: true, Interfaces: Vl2148
Bank Offset Entries
0         0       1

switch# show platform arad acl tcam summary
The total number of TCAM lines per bank is 1024.
========================================================
Arad0:
========================================================
 Bank   Used                  Used %             Used By
    0      1                       0   IP Egress PACLs/RACLs
Total Number of TCAM lines used is: 1
========================================================
Arad1:
========================================================
 Bank   Used                   Used %            Used By
    0      1                        0   IP Egress PACLs/RACLs
Total Number of TCAM lines used is: 1

The show ip route command displays the unicast ip routes installed in the system.

switch# show ip route
VRF name: default
Codes: C - connected, S - static, K - kernel,
 O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
 E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
 N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
 R - RIP, I - ISIS, A B - BGP Aggregate, A O - OSPF Summary,
 NG - Nexthop Group Static Route

Gateway of last resort is not set
 C 10.1.0.0/16 is directly connected, Vlan2659
 C 10.2.0.0/16 is directly connected, Vlan2148
 C 10.3.0.0/16 is directly connected, Vlan2700
 S 172.17.0.0/16 [1/0] via 172.24.0.1, Management1
 S 172.18.0.0/16 [1/0] via 172.24.0.1, Management1
 S 172.19.0.0/16 [1/0] via 172.24.0.1, Management1
 S 172.20.0.0/16 [1/0] via 172.24.0.1, Management1
 S 172.22.0.0/16 [1/0] via 172.24.0.1, Management1
 C 172.24.0.0/18 is directly connected, Management1

The show platform arad ip route command displays the platform unicast forwarding routes.

switch# show platform arad ip route
Tunnel Type: M(mpls), G(gre)
 -------------------------------------------------------------------------------
|                                Routing Table                                       |               |
|------------------------------------------------------------------------------
|VRF|   Destination    |      |                    |     | Acl   |                 | 
ECMP| FEC | Tunnel
| ID|   Subnet         | Cmd  |       Destination  | VID | Label |  MAC / CPU Code 
|Index|Index|T Value
 
--------------------------------------------------------------------------------
|0  |0.0.0.0/8          |TRAP | CoppSystemL3DstMiss|0    | - | ArpTrap | - |1031 | -
|0  |10.1.0.0/16        |TRAP | CoppSystemL3DstMiss|2659 | - | ArpTrap | - |1030 | -
|0  |10.2.0.0/16        |TRAP | CoppSystemL3DstMiss|2148 | - | ArpTrap | - |1026 | -
|0  |10.3.0.0/16        |TRAP | CoppSystemL3DstMiss|2700 | - | ArpTrap | - |1034 | -
|0  |127.0.0.0/8        |TRAP | CoppSystemL3DstMiss|0    | - | ArpTrap | - |1031 | -
|0  |172.17.0.0/16      |TRAP | CoppSystemL3DstMiss|0    | - | ArpTrap | - |1025 | -
|0  |172.18.0.0/16      |TRAP | CoppSystemL3DstMiss|0    | - | ArpTrap | - |1025 | -
|0  |172.19.0.0/16      |TRAP | CoppSystemL3DstMiss|0    | - | ArpTrap | - |1025 | -
|0  |172.20.0.0/16      |TRAP | CoppSystemL3DstMiss|0    | - | ArpTrap | - |1025 | -
|0  |172.22.0.0/16      |TRAP | CoppSystemL3DstMiss|0    | - | ArpTrap | - |1025 | -
|0  |172.24.0.0/18      |TRAP | CoppSystemL3DstMiss|0    | - | ArpTrap | - |1032 | -
|0  |0.0.0.0/0          |TRAP | CoppSystemL3LpmOver|0    | - | SlowReceive | - 
|1024 | -
|0  |10.1.0.0/32*       |TRAP | CoppSystemIpBcast  |0    | - | BcastReceive | - 
|1027 | -
|0  |10.1.0.1/32*       |TRAP | CoppSystemIpUcast  |0    | - | Receive | - |32766| -
|0  |10.1.255.1/32*     |ROUTE| Po1                |2659 |4094 | 00:1f:5d:6b:ce:45 
| - |1035 | -
|0  |10.1.255.255/32*   |TRAP | CoppSystemIpBcast  |0    | - | BcastReceive | - 
|1027 | -
|0  |10.2.0.0/32*       |TRAP | CoppSystemIpBcast  |0    | - | BcastReceive | - 
|1027 | -
|0  |10.2.0.1/32*       |TRAP | CoppSystemIpUcast  |0    | - | Receive | - |32766| -
|0  |10.2.255.1/32*     |ROUTE| Et1                |2148 |2 | 00:1f:5d:6d:54:dc | 
- |1036 | -
|0  |10.2.255.255/32*   |TRAP | CoppSystemIpBcast  |0    | - | BcastReceive | - 
|1027 | -
|0  |10.3.0.0/32*       |TRAP | CoppSystemIpBcast  |0    | - | BcastReceive | - 
|1027 | -
|0  |10.3.0.1/32*       |TRAP | CoppSystemIpUcast  |0    | - | Receive | - |32766| -
|0  |10.3.255.1/32*     |ROUTE| Et18               |2700 |2 | 00:1f:5d:6b:00:01 | 
- |1038 | -

Route Maps

A route map is an ordered set of rules that controls the redistribution of IP routes into a protocol domain based on criteria such as route metrics, access control lists, next-hop addresses, and route tags. Route maps can also alter route parameters as they are redistributed.

Route Map Description

Route maps are composed of route map statements, each consisting of a list of match and set commands.

Route Map Statements

Route map statements are categorized by the resolution of routes that the statement filters.

Permit statements facilitate the redistribution of matched routes.
Deny statements prevent the redistribution of matched routes.

Route map statement elements include name, sequence number, filter type, match commands, set commands, and continue commands.

The name identifies the route map to which the statement belongs.
The sequence number designates the statement’s placement within the route map.
A filter type specifies the route resolution. Valid types are permit and deny.
The match commands specify criteria that select the routes the statement evaluates for redistribution.
The set commands modify route parameters for redistributed routes.
The continue commands prolong the route map evaluation of routes that match a statement.

Statements filter routes for redistribution. Routes that statements pass are redistributed (permit statements) or rejected (deny statements). The next statement in the route map then filters routes that statements fail.

When a statement does not contain a match command, the statement passes all routes.
When a statement contains a single match command that lists a single object, the statement passes routes whose parameters match the object.
When a statement contains a single match command that lists multiple objects, the statement passes routes whose parameters match at least one object.
When a statement contains multiple match commands, the statement passes routes whose parameters match all match commands.

The Set commands modify parameters for redistributed routes and are valid in permit statements.

Example

The following route map statement is named MAP_1 with sequence number 10. The statement matches all routes from BGP Autonomous System 10 and redistributes them with a local preference set to 100. Routes that do not match the statement are evaluated against the next statement in the route map.

switch# route-map MAP_1 permit 10
   match as 10
   set local-preference 100

Route Maps with Multiple Statements

A route map consists of statements with the same name and different sequence numbers. Statements filter routes by ascending order based on their sequence numbers. When a statement passes a route, the redistribution action is performed as the filter type specifies, ignoring all subsequent statements. When the statement fails the route, the statement with the smallest sequence number larger than the current one filters the route.

All route maps contain an implied final statement containing a single deny statement without a match command. This statement denies the redistribution of any routes that no other statement passes.

Example

The following route map is named MAP_1 and has two permit statements. Routes that do not match either statement are denied redistribution into the target protocol domain.

switch# route-map MAP_1 permit 10
   match as 10
   set local-preference 100 
!
switch# route-map MAP_1 permit 20
   match metric-type type-1
   match as 100

Route Map Configuration describes route map configuration procedures.

Route Maps with Multiple Statements and Continue Commands

Route map statements that contain a continue (route map) command support additional route map evaluation of routes whose parameters meet the statement’s match commands. Routes that match a statement containing a continue command are evaluated against the statement specified by the continue command.

When a route matches multiple route-map statements, the filter action (deny or permit) is determined by the last statement that the route matches. The set commands in all statements matching the route are applied to the route after the route map evaluation is complete. Multiple set commands are applied in the same order by which the route was evaluated against the statements containing them.

Example

The following route map is named MAP_2 with a permit and a deny statement. The permit statement contains a continue command. Routes that match statement 10 are evaluated against statement 20.

switch# route-map MAP_2 permit 10
   match as 10
   continue 20
   set local-preference 100 
!
switch# route-map MAP_2 deny 20
   match metric-type type-1
   match as 100

The route is redistributed if it passes statement 10 and is rejected by statement 20. The route is denied redistribution in all other instances. The continue command guarantees the evaluation of all routes against both statements.

Route Map Configuration

Route maps are created and modified in route-map configuration mode. These sections describe the configuration mode and its commands.

Route Map Creation and Editing
Modifying Route Map Components

Route Map Creation and Editing

Creating a Route Map Statement

To create a route map, use the route-mapcommand, including the map name and filter type (deny or permit). If the command does not specify a number, the system assigns a default sequence number to the statement.

Example

The following command places the switch in the route map configuration mode and creates a route map statement named map1 with a sequence number of 50.

switch(config)# route-map map1 permit 50
switch(config-route-map-map1)#

Editing a Route Map Statement

To edit an existing route map statement, use the route-map, including the map’s name and the statement’s number. The switch enters the route map configuration mode for the statement. Subsequent match (route-map) and set (route-map) commands add the corresponding commands to the statement.

The show command displays the contents of the existing route map.

Example

The following command places the switch in the route map configuration mode to edit an existing route map statement. The show command displays the contents of all statements in the route map.

switch(config)# route-map MAP2
switch(config-route-map-MAP2)#show
  Match clauses:
    match as 10
    match tag 333
  Set clauses:
    set local-preference 100
switch(config-route-map-MAP2)#

Saving Route Map Modifications

Route map configuration mode is a group-change mode. You can save changes by exiting the mode, either with an explicit exit command or by switching directly to another configuration mode. This includes switching to the configuration mode for a different route map.

Example

The first command creates the map1 statement with a sequence number of 10. The second command is not yet saved to the route map, as displayed by the show command.

switch(config)# route-map map1 permit
switch(config-route-map-map1)# match as 100
switch(config-route-map-map1)# show

switch(config-route-map-map1)#

The exit command saves the match command.

switch(config-route-map-map1)# exit
switch(config)# show route-map map1
route-map map1 permit 10
  Match clauses:
    match as 100
  Set clauses:
switch(config)#

Discarding Route Map Modifications

The abort command discards all pending changes and exits route-map configuration mode.

Example

The abort command discards the pending match command and restores the original route map.

switch(config)# route-map map1 permit
switch(config-route-map-map1)# match as 100
switch(config-route-map-map1)# abort
switch(config)# show route-map map1
switch(config)#

Modifying Route Map Components

The following commands add rules to the configuration mode route map:

match (route-map) adds a match rule to a route map.
set (route-map) adds a set rule to a route map.

Inserting a Statement

To insert a new statement into an existing route map, create a new statement with a sequence number that differs from any existing statement in the map.

Example

The following commands add statement 50 to the Map1 route map and a match statement of 150. They save the configuration using exit then display the new route map using show route-map Map1.

switch(config)# route-map Map1 permit 50
switch(config-route-map-Map1)# match as 150
switch(config-route-map-Map1)# exit
switch(config)# show route-map Map1
route-map Map1 deny 10
  Match clauses:
    match as 10
    match tag 333
  Set clauses:
    set local-preference 100
route-map Map1 permit 50
  Match clauses:
    match as 150
  Set clauses:
switch(config)#

Deleting Route Map Components

To remove a component from a route map, perform one of the following:

To remove a command from a statement, enter no, followed by the command you want to remove.
To remove a statement, enter no, followed by the route map with the filter type and the sequence number of the statement you want to remove.
To remove a route map, enter no followed by the route map without a sequence number.

Using Route Maps

Protocol redistribution commands include a route map parameter determining the routes to be redistributed into the specified protocol domain.

Example

The following commands use the Map1 route map to select OSPFv2 routes for redistribution into BGP AS1.

switch(config)# router bgp 1
switch(config-router-bgp)# redistribute ospf route-map Map1
switch(config-router-bgp)# exit
switch(config)#

Prefix Lists

A prefix list is an ordered set of rules that defines route redistribution access for a specified IP address space. It consists of a filter action (deny or permit), an address space identifier (IPv4 subnet address or IPv6 prefix), and a sequence number.

Prefix lists are referenced by route map match commands when filtering routes for redistribution.

Prefix List Configuration describes the prefix list configuration process.
Using Prefix Lists describes the use of prefix lists.
Static Routes Redistribution into IGPs describes the redistribution of routes whose configured next-hops satisfy the route-map policy.

Prefix List Configuration

A prefix list is an ordered set of rules that defines route redistribution access for a specified IP address space. A prefix list rule consists of a filter action (deny or permit), a network address (IPv4 subnet or IPv6 prefix), and a sequence number. A rule may also include an alternate mask size.

The switch supports IPv4 and IPv6 prefix lists. The switch is placed in a Prefix-list configuration mode to create and edit IPv4 or IPv6 prefix lists.

IPv4 Prefix Lists

IPv4 prefix lists are created or modified by adding an IPv4 prefix list rule in the Prefix-list configuration mode. Each rule includes the name of a prefix list and the sequence number, network address, and filter action. A list consists of all rules that have the same prefix-list name.

The ip prefix-list command creates a prefix list or adds a rule to an existing list. Route map match commands use prefix lists to filter routes for redistribution into OSPF, RIP, or BGP domains.

Creating an IPv4 Prefix List

To create an IPv4 prefix list, enter the ip prefix-list command, followed by the list's name. The switch enters the IPv4 prefix-list configuration mode for the list. If the name of an existing ACL follows the command, subsequent commands edit that list.

Examples

The following command places the switch in IPv4 prefix list configuration mode to create an IPv4 prefix list named route-one.
```
switch(config)# ip prefix-list route-one
switch(config-ip-pfx)#
```

This series of commands creates four different rules for the prefix-list named route-one.

switch(config)# ip prefix-list route-one
switch(config-ip-pfx)# seq 10 deny 10.1.1.0/24
switch(config-ip-pfx)# seq 20 deny 10.1.0.0/16
switch(config-ip-pfx)# seq 30 permit 12.15.4.9/32
switch(config-ip-pfx)# seq 40 deny 1.1.1.0/24

To view the list, save the rules by exiting the Prefix-list command mode using the exit command, then re-enter the configuration mode and use the show active command.

switch(config-ip-pfx)# exit
switch(config)# ip prefix-list route-one
switch(config-ip-pfx)# show active
ip prefix-list route-one
   seq 10 deny 10.1.1.0/24
   seq 20 deny 10.1.0.0/16
   seq 30 permit 12.15.4.9/32
   seq 40 deny 1.1.1.0/24
switch(config-ip-pfx)# ip prefix-list route-one

IPv4 prefix lists are referenced in the match (route-map) command.

IPv6 Prefix Lists

Creating an IPv6 Prefix List

The switch provides an IPv6 prefix-list configuration mode for creating and modifying IPv6 prefix lists. A list can be edited only in the mode where it was created.

To create an IP ACL, enter the ipv6 prefix-list command and the list's name. The switch enters the list's IPv6 prefix-list configuration mode. If the name of an existing ACL follows the command, subsequent commands edit that list.

Example

This command places the switch in the IPv6 prefix list configuration mode to create an IPv6 prefix list named map1.

switch(config)# ipv6 prefix-list map1
switch(config-ipv6-pfx)#

Adding a Rule

To append a rule to the end of a list, enter the rule without a sequence number while in Prefix-List configuration mode for the list. The system derives the new rule’s sequence number by adding 10 to the last rule’s sequence number.

Example

These commands enter the first two rules into a new prefix list.

switch(config-ipv6-pfx)# permit 3:4e96:8ca1:33cf::/64
switch(config-ipv6-pfx)# permit 3:11b1:8fe4:1aac::/64

To view the list, save the rules by exiting the prefix-list command mode using the exit command, then re-enter the configuration mode and use the show active command.

switch(config-ipv6-pfx)# exit
switch(config)# ipv6 prefix-list map1
switch(config-ipv6-pfx)# show active
ipv6 prefix-list map1
   seq 10 permit 3:4e96:8ca1:33cf::/64
   seq 20 permit 3:11b1:8fe4:1aac::/64
switch(config-ipv6-pfx)#

The following command appends a rule to the end of the prefix list. The new rule’s sequence number is 30.

switch(config-ipv6-pfx)# permit 3:1bca:1141:ab34::/64
switch(config-ipv6-pfx)# exit
switch(config)# ipv6 prefix-list map1
switch(config-ipv6-pfx)# show active
ipv6 prefix-list map1
   seq 10 permit 3:4e96:8ca1:33cf::/64
   seq 20 permit 3:11b1:8fe4:1aac::/64
   seq 30 permit 3:1bca:1141:ab34::/64
switch(config-ipv6-pfx)#

Inserting a Rule

To insert a rule into a prefix list, use the seq (IPv6 Prefix Lists) command to enter a rule with a sequence number between the numbers of two existing rules.

Example

This command inserts a rule between the first two by assigning sequence number 15.

switch(config-ipv6-pfx)# seq 15 deny 3:4400::/64
switch(config-ipv6-pfx)# exit
switch(config)# show ipv6 prefix-list map1
ipv6 prefix-list map1
seq 10 permit 3:4e96:8ca1:33cf::/64
seq 15 deny 3:4400::/64
seq 20 permit 3:11b1:8fe4:1aac::/64
seq 30 permit 3:1bca:3ff2:634a::/64
switch(config)#

Deleting a Rule

To remove a rule from the configuration mode prefix list, enter no seq (see seq (IPv6 Prefix Lists)), followed by the rule's sequence number.

Example

These commands remove rule 20 from the prefix list and display the resultant prefix list.

switch(config-ipv6-pfx)# no seq 20
switch(config-ipv6-pfx)# exit 
switch(config)# show ipv6 prefix-list map1
ipv6 prefix-list map1
seq 10 permit 3:4e96:8ca1:33cf::/64
seq 15 deny 3:4400::/64
seq 30 permit 3:1bca:3ff2:634a::/64
switch(config)#

Using Prefix Lists

Route map match commands include an option that matches a specified prefix list.

Example

The MAP_1 route map uses a match command that references the PL_1 prefix list.

switch(config)# route-map MAP_1 permit
switch(config-route-map-MAP_1)# match ip address prefix-list PL_1
switch(config-route-map-MAP_1)# set community 500
switch(config-route-map-MAP_1)# exit

Static Routes Redistribution into IGPs

Use match ip next-hop to match against next-hops in a route-map. This can be used to redistribute matching static routes into an IGP (IS-IS, OSPF, etc.).

The following example applies the match ip next-hop clause for static routes redistributed into IGPs for multi-agent mode. The following configures a static route.

switch(config)# ip route 10.20.30.0/24 1.2.3.4

The following commands configure a prefix-list:

switch (config)# ip prefix-list prefixListName
switch(config-ip-pfx)# permit 1.2.3.4/32

1.2.3.4 is a configured next-hop for static route 10.20.30.0/24.

The following commands configure a route map:

switch(config)# route-map routeMapName
switch(config-route-map-routeMapName)# match ip next-hop prefix-list prefixListName

For example, based on the route-map mentioned in the preceding command, to redistribute matching static routes into an IGP, use the following command for IS-IS:

switch(config-router-isis)# redistribute static route-map routeMapName

View redistributed routes using the following show commands.

The show ip route command displays the IP route.

switch# show ip route

VRF: default
Codes: C - connected, S - static, K - kernel,
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP,
       R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
       O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
       NG - Nexthop Group Static Route, V - VXLAN Control Service,
       DH - DHCP client installed default route, M - Martian,
       DP - Dynamic Policy Route, L - VRF Leaked

Gateway of last resort is not set

 ...
 I L2     10.20.30.0/24 [115/10] via 1.2.3.4, Ethernet1

Use the show isis database detail command to view routes redistributed into IS-IS.

switch# show isis database detail

IS-IS Instance: B VRF: default
  IS-IS Level 1 Link State Database
    LSPID                 Seq Num   Cksum  Life  IS Flags
    ...
  IS-IS Level 2 Link State Database
    LSPID                 Seq Num   Cksum  Life  IS Flags
    0000.0000.0001.00-00  6         10364  840   L2 <>
      ...
      Reachability         : 10.20.30.0/24 Metric: 0 Type: 1 Up
      ...

While the preceding example applies to IS-IS, a similar approach may be taken for other IGPs, such as OSPF.

Port ACLs with User-Defined Fields

Describes the support for specifying User-Defined Fields (UDF) in Port ACLs, including IPv4, IPv6, and MAC ACLs. The purpose of the User-Defined Fields feature is to permit or deny packets based on custom offset pattern matching.

User-Defined Fields, or UDFs, are part of an access-list filter and comprise an offset, length, pattern match and mask. This describes a single portion of any incoming packet that matches the provided value.

UDFs may also be defined via aliases. Aliases can save a UDF configuration for reuse in multiple access lists or access list rules. An alias may substitute for a fully defined UDF, including the offset, pattern, and mask. The pattern or mask may be overridden when the alias is used in an access list rule.

The behavior, CLI syntax, and configuration of UDFs are identical to Traffic Steering UDF and Mirroring ACL UDF.

This section describes port ACLs with user-defined fields, including configuration instructions. Topics covered by this section include:

Configuring Port ACLs with User-Defined Fields
Port ACLs with User-Defined Fields Limitations

Configuring Port ACLs with User-Defined Fields

User-Defined Fields (UDFs) are specified as part of an access list. However, the type of access list dictates the base position of the UDF and the options available. In addition, you must configure a TCAM profile to include UDFs as part of the Port ACL feature’s key.

TCAM Profile

User-Defined Fields are defined as additional fields in the Port ACL feature’s key. By default, UDFs are not included in the keys for the Port ACL features. Adding a UDF to the key requires removing different key fields to fit within the TCAM width restrictions.

Note: Each UDF is either 16 bits wide or 32 bits wide.

The following are example configurations of the TCAM profile.

IPv4 Port ACL

The following configurations create a new profile based on the default profile. This new profile replaces the Layer 4 port key fields with one 16-bit UDF and one 32-bit UDF.

switch(config)# hardware tcam
switch(config-hw-tcam)# profile ipv4Udf copy default
switch(config-hw-tcam-profile-ipv4Udf)# feature acl port ip
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# no key field l4-ops
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# no key field l4-src-port
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# no key field l4-dst-port
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# key field udf-16b-1
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# key field udf-32b-1
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# exit
switch(config-hw-tcam-profile-ipv4Udf)# exit
switch(config-hw-tcam)# system profile ipv4Udf

16-bit IPv4 Header Match

Example

The following configurations match IPv4 packets based on the Identification (ID) field.

Packets ingressing into interface ethernet 7 with an ID equal to 1000 (0x03E80000) are forwarded, while packets with an ID different from 1000 are dropped.

(config)# ip access-list udfAcl
(config-acl-udfAcl)# permit ip any any payload header start offset 1 pattern 0x03E80000 mask 0x0000FFFF
(config-acl-udfAcl)# deny ip any any
(config-acl-udfAcl)# exit
(config)# interface ethernet 7
(config-if-Et7)#

IPv6 Port ACL

The following configurations create a new profile based on the default profile. This new profile replaces the destination IPv6 address key field with two 32-bit UDFs.

switch(config)# hardware tcam
switch(config-hw-tcam)# profile ipv6Udf copy default
switch(config-hw-tcam-profile-ipv6Udf)# feature acl port ipv6
switch(config-hw-tcam-profile-ipv6Udf-feature-acl-port-ipv6)# no key field dst-ipv6
switch(config-hw-tcam-profile-ipv6Udf-feature-acl-port-ipv6)# key field udf-32b-1
switch(config-hw-tcam-profile-ipv6Udf-feature-acl-port-ipv6)# key field udf-32b-2
switch(config-hw-tcam-profile-ipv6Udf-feature-acl-port-ipv6)# exit
switch(config-hw-tcam-profile-ipv6Udf)# exit
switch(config-hw-tcam)# system profile ipv6Udf

32-bit IPv6 Payload Match

Example

The following configurations match IPv6 UDP packets based on the first 32 bits of the packet payload.

UDP packets ingressing into interface ethernet 7 that starts with 0x1234567X (where X can be any valid hexadecimal) in the payload are forwarded while dropping any other packets. The offset is set to 2 (2 x 4-byte words) to skip the UDP header.

(config)# ipv6 access-list udfAcl
(config-ipv6-acl-udfAcl)# permit udp any any payload offset 2 pattern 0x12345670 mask 0x0000000f
(config-ipv6-acl-udfAcl)# deny ipv6 any any
(config-ipv6-acl-udfAcl)# exit
(config)# interface ethernet 7
(config-if-Et7)# ipv6 access-group udfAcl in

Port ACLs with User-Defined Fields Limitations

User-defined fields consume a limited set of copy resources. For each unique offset, if a pattern is specified masked to be > 16 bits wide, then a 32-bit resource is used. If no 32-bit resource is available, then two 16-bit resources are used if available. Copy resources depend on the number of UDF key fields added to the feature key. Each UDF key field maps to one copy resource. Using the above TCAM profile configurations:

IPv4: 1 × 16-bit pattern + 1 × 32-bit pattern.
IPv6: 2 × 32-bit pattern.
MAC: 1 × 16-bit pattern + 1 × 32-bit pattern.

Other limitations include:

The maximum offset value is 31, which is 31 4-byte words, or 124 bytes.
UDFs only work on ingress Port ACLs.

ACL, Route Map, and Prefix List Commands

This section describes CLI commands that this chapter references.

ACL Creation and Access Commands

hardware access-list resource sharing vlan in
hardware access-list resource sharing vlan ipv4 out
ip access-list
ip access-list standard
ipv6 access-list
ipv6 access-list standard
mac access-list
system profile

Service ACL Implementation Commands

ip access-group (Service ACLs)
ipv6 access-group (Service ACLs)

ACL Edit Commands

counters per-entry (ACL configuration modes)
hardware access-list update default-result permit
no sequence number (ACLs)
resequence (ACLs)
show (ACL configuration modes)

ACL Rule Commands

deny (IPv4 ACL)
deny (IPv6 ACL)
deny (MAC ACL)
deny (Standard IPv4 ACL)
deny (Standard IPv6 ACL)
permit (IPv4 ACL)
permit (IPv6 ACL)
permit (MAC ACL)
permit (Standard IPv4 ACL)
permit (Standard IPv6 ACL)
remark

ACL List Counter Commands

clear ip access-lists counters
clear ipv6 access-lists counters
hardware counter feature acl out

ACL Display Commands

show access-lists
show ip access-lists
show ipv6 access-lists
show mac access-lists

Prefix List Creation and Access Commands

ip prefix-list
ipv6 prefix-list

Prefix List Edit Commands

deny (IPv6 Prefix List)
permit (IPv6 Prefix List)
seq (IPv6 Prefix Lists)

Prefix List Display Commands

show hardware tcam profile
show ip prefix-list
show ipv6 prefix-list
show platform arad acl tcam
show platform arad acl tcam summary
show platform arad mapping
show platform fap acl
show platform fap acl tcam
show platform fap acl tcam hw
show platform fap acl tcam summary
show platform trident tcam

Route Map Creation and Access Command

route-map

Route Map Edit Commands

continue (route map)
description (route map)
match (route-map)
set (route-map)
set as-path prepend
set as-path match
set community (route-map)
set extcommunity (route-map)

Route Map Display Commands

show route-map

clear ip access-lists counters

The clear ip access-lists counters command sets ACL counters to zero for the specified IPv4 Access Control List (ACL). The session parameter limits ACL counter clearing to the current CLI session.

Command Mode

Privileged EXEC

Command Syntax

clear ip access-lists counters acl_name scope

Parameters

acl_name - Specify the name of ACL list. Options include the following:
- no parameter - Specifies all ACLs.
- access_list - Specifies the name of ACL.
scope - Specify the session affected by command. Options include the following:
- no parameter - Clears all counters on all CLI sessions.
- session - Clears counters only on the current CLI session.

Example

This command resets all IPv4 ACL counters.

switch(config)# clear ip access-lists counters
switch(config)#

clear ipv6 access-lists counters

The clear ipv6 access-lists counters command sets ACL counters to zero for the specified IPv6 Access Control List (ACL). The session parameter limits ACL counter clearing to the current CLI session.

Command Mode

Privileged EXEC

Command Syntax

clear ipv6 access-lists counters [acl_name][scope]

Parameters

acl_name - Specify the name of ACL. Options include the following:
- no parameter - Clears all IPv6 ACLs.
- access_list - Clears the access list of the IPv6 ACL.
scope - Specify the session affected by command. Options include the following:
- no parameter - The command affects counters on all CLI sessions.
- session - Affects only current CLI session.

Example

This command resets all IPv6 ACL counters.

switch(config)# clear ipv6 access-lists counters
switch(config)#

continue (route map)

The continue command creates a route map statement entry that enables additional route map evaluation of routes with parameters meeting the statement matching criteria.

A statement typically contains a match (route-map) and a set (route-map) command. The evaluation of routes with settings the same as match command parameters normally ends and the statement's set commands apply to the route. Routes that match a statement containing a continue command evaluate against the statement specified by the continue command.

When a route matches multiple route map commands, the last statement that the route matches determines the filter action (deny or permit) . The set commands in all statements matching the route apply to the route after completing the route map evaluation. Multiple set commands apply in the same order by the route evaluation against the statement containing them.

The no continue and default continue commands remove the corresponding continue command from the configuration mode route map statement by deleting the corresponding command from running-config.

Command Mode

Route-Map Configuration

Command Syntax

continue next_seq

no continue next_seq

default continue next_seq

Parameters

next_seq - Specifies next statement for evaluating matching routes. Options include the following:

no parameter - The next statement in the route map, as determined by sequence number.
seq_number - Specifies the number of the next statement. Values range from 1 to 16777215.

Restrictions

A continue command cannot specify a sequence number smaller than the sequence number of the route map statement.

Related Command

route-map command enters the Route-Map Configuration Mode.

Example

This command creates route map map1, statement 40 with a match command, a set command, and a continue command. Routes that match the statement subsequently evaluate against statement 100. The set local-preference command applies to matching routes regardless of subsequent matching operations.

switch(config)# route-map map1 deny 40
switch(config-route-map-map1)# match as 15
switch(config-route-map-map1)# continue 100
switch(config-route-map-map1)# set local-preference 50
switch(config-route-map-map1)#

counters per-entry

The counters per-entry command places the ACL in counting mode. In counting mode, the feature generally displays the number of instances in which each rule in the list matches an inbound packet and the elapsed time since the last match. However, for certain select platforms, in addition to the packet counter, ACL counters can also be enabled for byte counts when applied to data plane ACLs. Review the complete list of platforms that support byte count for data plan ACLslisted below:

Note: Only dataplane ACLs support byte counting on the switch.

The following platforms support ACL byte counting:

CCS-710/720/722/755/758 series
DCS-7010TX
DCS-7050SX3/CX3/TX3/CX4/DX4/PX4
DCS-7060 Series
DCS-7300X3/7304X3/7308X3/7316/7320X/7324/7328/7358X4/7368/7388

On the FM6000 platform, this command has no effect when used in an ACL for a PBR class map.

The no counters per-entry and default counters per-entry commands place the ACL in non-counting mode.

Command Mode

ACL Configuration

IPv6-ACL Configuration

Std-ACL Configuration

Std-IPv6-ACL Configuration

MAC-ACL Configuration

Command Syntax

counters per-entry

no counters per-entry

default counters per-entry

Examples

This command places the test1 ACL in counting mode.

switch(config)# ip access-list test1
switch(config-acl-test1)# counters per-entry
switch(config-acl-test1)#

This command displays the ACL, with counter information, for an ACL in counting mode.

switch# show ip access-lists
IP Access List default-control-plane-acl [readonly]
  counters per-entry
  10 permit icmp any any
  20 permit ip any any tracked [match 12041 packets, 0:00:00 ago]
  30 permit ospf any any
  40 permit tcp any any eq ssh telnet www snmp bgp https [match 11 packets, 1:41:07 ago]
  50 permit udp any any eq bootps bootpc snmp rip [match 78 packets, 0:00:27 ago]
  60 permit tcp any any eq mlag ttl eq 255
  70 permit udp any any eq mlag ttl eq 255
  80 permit vrrp any any
  90 permit ahp any any
  100 permit pim any any
  110 permit igmp any any [match 14 packets, 0:23:27 ago]
  120 permit tcp any any range 5900 5910
  130 permit tcp any any range 50000 50100
  140 permit udp any any range 51000 51100
Total rules configured: 14
       Configured on Ingress: control-plane(default VRF)
       Active on     Ingress: control-plane(default VRF)

On platforms that support byte counting, Counter information displays as shown below:

switch# show ip access-lists
IP Access List default-control-plane-acl [readonly]
        counters per-entry
        10 permit icmp any any [match 30 packets, 0:02:08 ago]
        20 permit ip any any tracked [match 97777 packets, 0:00:00 ago]
        30 permit udp any any eq bfd ttl eq 255
        40 permit udp any any eq bfd-echo ttl eq 254
        50 permit udp any any eq multihop-bfd micro-bfd sbfd
        60 permit udp any eq sbfd any eq sbfd-initiator
        70 permit ospf any any
        80 permit tcp any any eq ssh telnet www snmp bgp https msdp ldp netconf-ssh gnmi [match 72 packets, 0:00:00 ago]
        90 permit udp any any eq bootps bootpc snmp rip ntp ldp ptp-event ptp-general
        100 permit tcp any any eq mlag ttl eq 255
        110 permit udp any any eq mlag ttl eq 255
        120 permit vrrp any any
        130 permit ahp any any
        140 permit pim any any
Total rules configured: 14
             Configured on Ingress: control-plane(default VRF)
             Active on     Ingress: control-plane(default VRF)

IP Access List ipCountersTest:The ipCountersTest ACL is applied to the data plane. Hence, it displays the byte count information as shown below:
        counters per-entry
        10 permit tcp host 10.1.1.1 range 2000 4000 host 10.2.1.1 [match 486 bytes in 3 packets, 0:00:26 ago]
        20 permit tcp host 10.1.1.1 range 14000 16000 host 10.2.1.1 [match 486 bytes in 3 packets, 0:00:18 ago]
        30 permit udp host 10.1.1.1 range 62000 64000 host 10.2.1.1 [match 450 bytes in 3 packets, 0:00:00 ago]
        40 permit tcp host 10.1.1.1 range 50000 52000 host 10.2.1.1 [match 486 bytes in 3 packets, 0:00:02 ago]
        50 permit tcp host 10.1.1.1 range 38000 40000 host 10.2.1.1 [match 486 bytes in 3 packets, 0:00:10 ago]
        60 permit tcp host 10.1.1.1 range 26000 28000 host 10.2.1.1 [match 486 bytes in 3 packets, 0:00:18 ago]
Total rules configured: 6

ipCountersTest ACL applies to the data plane and displays the byte count information.

deny (IPv4 ACL)

The deny command adds a deny rule to the configuration mode IPv4 Access Control List (ACL). Interfaces with the ACL drop packets filtered by a deny rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL's last rule.

The no deny and default deny commands remove the specified rule from the configuration mode ACL. The no sequence number (ACLs) command also removes the specified rule from the ACL.

Command Mode

ACL Configuration

Command Syntax

[seq_num] deny protocol source_addr source_port dest_addrR dest_port flags message fragments tracked dscp_filter ttl_filter log

no deny protocol source_addr source_port dest_addrR dest_port flags message fragments tracked dscp_filter ttl_filter log]

default deny protocol source_addr source_port dest_addrR dest_port flags message fragments tracked dscp_filter ttl_filter log]

Note: Commands use a subset of the listed fields. Available parameters depend on specified protocol.

Parameters

seq_num - The sequence number assigned to the rule. Options include the following:
- no parameter The number derive from adding 10 to the number of the ACL last rule.
- 14294967295 -The number assigned to the entry.
protocol Specify the protocol field filter. Values include the following:
- ahp - Authentication Header Protocol (51
- icmp - Internet Control Message Protocol (1)
- igmp - Internet Group Management Protocol (2)
- ip - Internet Protocol v4 (4)
- ospf - Open Shortest Path First (89)
- pim - Protocol Independent Multicast (103)
- tcp - Transmission Control Protocol (6)
- udp - User datagram protocol (17)
- vrrp - Virtual Router Redundancy Protocol (112)
- protocol_num - An integer corresponding to an IP protocol. Values range from 0 to 255.
source_addr and dest_addr - Specify the source and destination address filters. Values include the following:
- network_addr - Specify the subnet address as a CIDR or address-mask.
- any - Filter packets from all addresses.
- host ip_addr - Specify an IP address in dotted decimal notation.
  Subnet addresses support discontiguous masks.
source_port and dest_port - Specify the source and destination port filters. Values include the following:
- any - Specify all ports.
- eq port-1 port-2 ... port-n - Specify a list of ports. Maximum list size is 10 ports.
- neq port-1 port-2 ... port-n - Specify the set of all ports not listed. Maximum list size is 10 ports.
- gt port - Specify the set of ports with larger numbers than the listed port.
- lt port - Specify the set of ports with smaller numbers than the listed port.
- range port_1 port_2 - Specify a range of ports.
fragments Filters packets with FO bit set that indicates a non-initial fragment packet.
flags Flag bit filters (TCP packets).
message Message type filters (ICMP packets).
tracked Rule filters packets in existing ICMP, UDP, or TCP connections.
- Valid in ACLs applied to the control plane.
- Validity in ACLs applied to data plane varies by switch platform.
dscp_filter - Filters a packet by the DSCP value. Values include the following:
- no parameter -Specify that the rule does not use DSCP to filter packets.
- dscp dscp_value - Specify to match packets match if the DSCP field in packet equals the dscp_value.
TTL_FILTER - Filters a packet by the TTL (time-to-live) value. Values include the following:
- ttl eq ttl_value - Match packets if ttl in packet is equal to ttl_value.
- ttl gt ttl_value - Match packets if ttl in packet is greater than ttl_value.
- ttl lt ttl_value - Match packets if ttl in packet is less than ttl_value.
- ttl neq ttl_value - Match packets if ttl in packet is not equal to ttl_value.
  - Valid in ACLs applied to the control plane.
  - Validity in ACLs applied to data plane varies by switch platform.
log - Triggers an informational log message to the console about the matching packet.
- Valid in ACLs applied to the control plane.
- Validity in ACLs applied to data plane varies by switch platform.

Examples

This command appends a deny statement at the end of the ACL. The deny statement drops OSPF packets from 10.10.1.1/24 to any host.
```
switch(config)# ip access-list text1
switch(config-acl-text1)# deny ospf 10.1.1.0/24 any
switch(config-acl-text1)#
```
This command inserts a deny statement with the sequence number 65. The deny statement drops all PIM packets.
```
switch(config-acl-text1)# 65 deny pim any any
switch(config-acl-text1)#
```

deny (IPv6 ACL)

The deny command adds a deny rule to the an IPv6 Access Control List (ACL). Interfaces with the ACL drop packets filtered by a deny rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL's last rule.

The no deny and default deny commands remove the specified rule from the configuration mode ACL. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.

Command Mode

IPv6-ACL Configuration

Command Syntax

seq_num deny protocol src_addr source_pt dest_addr dest_pt flag msg hop tracked dscp_filter log

no deny protocol src_addr source_pt dest_addr dest_pt flag msg hop tracked dscp_filter log

default deny protocol src_addr source_pt dest_addr dest_pt flag msg hop tracked dscp_filter log

Note: Commands use a subset of the listed fields. Available parameters depend on specified protocol. Use CLI syntax assistance to view parameters for specific protocols when creating a deny rule.

Parameters

seq_num - The sequence number assigned to the rule. Optionsinclude the following:
- no parameter - The number derived from adding 10 to the number of the ACL last rule.
- 1 - 4294967295 - A number assigned to an entry.
prot - Specify the protocol field filter. Values include the following:
- icmpv6 - Internet Control Message Protocol for version 6 (58)
- ipv6 - Internet Protocol IPv6 (41)
- ospf - Open Shortest Path First (89)
- tcp - Transmission Control Protocol (6)
- udp - User Datagram Protocol (17)
- protocol_num - An integer corresponding to an IP protocol. Values range from 0 to 255.
SRC_ADDR and DEST_ADDR - Specify source and destination address filters. Options include the following:
- ipv6_prefix - Specify an IPv6 address with prefix length (CIDR notation).
- any - Filter packets from all addresses.
- host ipv6_addr - Specify an IPv6 host address.
SRC_PT and DEST_PT - Specify the source and destination port filters. Options include the following:
- any - Specify all ports.
- eq port-1 port-2 ... port-n - Specify a list of ports. Maximum list size is 10 ports.
- neq port-1 port-2 ... port-n - Specify the set of all ports not listed. Maximum list size is 10 ports.
- gt port - Specify the set of ports with larger numbers than the listed port.
- lt port - Specify the set of ports with smaller numbers than the listed port.
- range port_1 port_2 - Specify a range of ports.
HOP - Filters by packet hop-limit value. Options include the following:
- no parameter - The rule does not use hop limit to filter packets.
- hop-limit eq hop_value - Match packetsif hop-limit value in packet equals hop_value.
- hop-limit gt hop_value - Match packets if hop-limit in packet is greater than hop_value.
- hop-limit lt hop_value - Match packets if hop-limit in packet is less than hop_value.
- hop-limit neq hop_value - Match packets if hop-limit in packet is not equal to hop_value.
FLAG - Specify flag bit filters (TCP packets).
MSG - Specify message type filters (ICMPv6 packets).
tracked - Specify rule filters packets in existing ICMP, UDP, or TCP connections.
- Valid in ACLs applied to the control plane.
- Validity in ACLs applied to data plane varies by switch platform.
DSCP_FILTER- Filters packet by theDSCP value. Values include the following:
- no parameter - The rule does not use DSCP to filter packets.
- dscp dscp_value - Match packets if DSCP field in packet equalsthe dscp_value.
log - Triggers an informational log message to the console about the matching packet.
- Valid in ACLs applied to the control plane.
- Validity in ACLs applied to data plane varies by switch platform.

Example

This command appends a deny statement at the end of the ACL. The deny statement drops IPv6 packets from 3710:249a:c643:ef11::/64 to any host.

switch(config)# ipv6 access-list text1
switch(config-acl-text1)# deny ipv6 3710:249a:c643:ef11::/64 any
switch(config-acl-text1)#

deny (IPv6 Prefix List)

The deny command adds a deny rule in the IPv6 Prefix List Configuration Mode . Route map match commands use prefix lists to filter routes for redistribution into OSPF, RIP, or BGP domains. Routes are denied access when they match the prefix in a deny statement.

The no deny and default deny commands remove the specified rule from theIPv6 prefix list. The no deny command also removes the specified rule from the prefix list.

Command Mode

IPv6-pfx Configuration

Command Syntax

sequence deny ipv6_prefix mask

Parameters

sequence - A sequence number assigned to the rule. Options include the following:
- no parameter - A number derived by adding 10 to the number of the list last rule.
- seq seq_num - A number specified by seq_num. Value ranges from 0 to 65535.
ipv6_prefix - Specify the IPv6 prefix to filter routes (CIDR notation).
mask - Specify the range of the prefix to match.
- no parameter - Requires an exact match with the subnet mask.
- eq mask_e - Specify a prefix length equal to mask_e.
- ge mask_g Specify a range from mask_g to 128.
- le mask_l - Specify a range from subnet mask length to mask_l.
- ge mask_l le mask_g - Specify a range from mask_g to mask_l.
- mask_e, mask_land, and mask_g -from 1 to 128.

Example

This command appends a deny statement at the end of the text1 prefix list. The deny statement denies redistribution of routes with the specified prefix.

switch(config)# ipv6 prefix-list route-five
switch(config-ipv6-pfx)# deny 3100::/64
switch(config-ipv6-pfx)#

deny (MAC ACL)

The deny command adds a deny rule to the MAC Access Control List (ACL) Configuration Mode.

Interfaces with an applied ACL drop packets filtered by a deny rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL last rule.

The no deny and default deny commands remove the specified rule from the MAC Access Control List (ACL) Configuration Mode. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.

Command Mode

MAC-ACL Configuration Mode

Command Syntax

seq_num deny source_addr dest_addr [protocol][log]

no deny source_addr dest_addr [protocol][log]

default deny source_addr dest_addr [protocol][log]

Parameters

seq_num Sequence number assigned to the rule. Options include the following:
- no parameter - A number derived by adding 10 to the number of the ACL's last rule.
- 1 - 4294967295 - A number assigned to entry.
source_addr and dest_addr - Configure source and destination address filters. Options includethe following:
- mac_address mac_mask - Specify the MAC address and mask.
- any - Filters all Packets from all addresses.
- mac_address - Specifies a MAC address in 3x4 dotted hexadecimal notation (hhhh.hhhh.hhhh).
- mac_mask - Specifies a MAC address mask in 3x4 dotted hexadecimal notation (hhhh.hhhh.hhhh).
- 0 - Requires an exact match to filter.
- 1 - Filters on any value.
protocol - Configure a protocol field filter. Values include the following:
- aarp - Appletalk Address Resolution Protocol (0x80f3).
- appletalk - Appletalk (0x809b).
- arp - Address Resolution Protocol (0x806).
- ip - Internet Protocol Version 4 (0x800).
- ipx - Internet Packet Exchange (0x8137).
- lldp - LLDP (0x88cc).
- novell - Novell (0x8138).
- rarp - Reverse Address Resolution Protocol (0x8035).
- protocol_num An integer corresponding to a MAC protocol. Values range from 0 to 65535.
log Triggers an informational log message to the console about the matching packet.

Examples

This command appends a permit statement at the end of the ACL. The deny statement drops all aarp packets from 10.1000.0000 through 10.1000.FFFF to any host.
```
switch(config)# mac access-list text1
switch(config-mac-acl-text1)# deny 10.1000.0000 0.0.FFFF any aarp
```
This command inserts a permit statement with the sequence number 25. The deny statement drops all packets through the interface.
```
switch(config-mac-acl-text1)# 25 deny any any
```

deny (Standard IPv4 ACL)

The deny command adds a deny rule to the Standard IPv4 Access Control List (ACL) Configuration Mode. Standard ACL rules filter on the source field.

The no deny and default deny commands remove the specified rule from the Standard IPv4 Access Control List (ACL) Configuration Mode. The no sequence number (ACLs) command also removes the specified rule from the ACL.

Command Mode

Std-ACL Configuration

Command Syntax

[seq_num] deny source_addr log

no deny source_addr log

default deny source_addr log

Parameters

seq_num - Specify the sequence number assigned to the rule. Options include the following:
- no parameter - A number derived by adding 10 to the number of the ACL last rule.
- 1 - 4294967295 - A number assigned to entry.
source_addr- Specify a source address filter. Options include the following:
- network_addr - Specify a subnet address as a CIDR or address-mask.
- any Filter packets from all addresses.
- host ip_addr - Specify an IP address in dotted decimal notation.
  Subnet addresses support noncontinuous masks.
log - Triggers an informational log message to the console about the matching packet.
- Valid in ACLs applied to the control plane.
- Validity in ACLs applied to data plane varies by switch platform.

Example

This command appends a deny statement at the end of the ACL. The deny statement drops packets from 10.10.1.1/24.

switch(config)# ip access-list standard text1
switch(config-std-acl-text1)# deny 10.1.1.1/24
switch(config-std-acl-text1)#

deny (Standard IPv6 ACL)

The deny command adds a deny rule to the Standard IPv6 Access Control List (ACL) Configuration Mode. Standard ACL rules filter on the source field.

The no deny and default deny commands remove the specified rule from the Standard IPv6 Access Control List (ACL) Configuration Mode. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.

Command Mode

Std-IPv6-ACL Configuration

Command Syntax

seq_num deny source_addr

no deny source_addr

default deny source_addr

Parameters

seq_num Sequence number assigned to the rule. Options include:
- no parameter - A Number derived by adding 10 to the number of the ACL's last rule.
- 1 - 4294967295 - The number assigned to entry.
source_addr- The Source address filter configured for the ACL. Options include:
- ipv6_prefix - IPv6 address with prefix length (CIDR notation).
- any - Filter all packets from all addresses.
- host ipv6_addr - Specify the IPv6 host address.

Example

This command appends a deny statement at the end of the ACL. The deny statement drops packets from 2103::/64.

switch(config)# ipv6 access-list standard text1
switch(config-std-acl-ipv6-text1)# deny 2103::/64
switch(config-std-acl-ipv6-text1)#

description (route map)

The description command adds a text string to the configuration mode route map. The string has no functional impact on the route map.

The no description and default description commands remove the text string from the configuration mode route map by deleting the corresponding description command from running-config.

Command Mode

Route-Map Configuration

Command Syntax

description label_text

no description

default description

Parameter

label_text Character string assigned to the route map configuration.

Related Command

route-map

Example

These commands add description text to the XYZ-1 route map.

switch(config)# route-map XYZ-1
switch(config-route-map-XYZ-1)# description This is the first map.
switch(config-route-map-XYZ-1)# exit
switch(config)# show route-map XYZ-1
route-map XYZ-1 permit 10
  Description:
    description This is the first map.
  Match clauses:
  Set clauses:
switch(config)#

hardware access-list resource sharing vlan in

The hardware access-list resource sharing vlan in command enables the IPv4 Ingress Sharing of hardware resources on the switch when the same ACL applies to different VLANs.

The no hardware access-list resource sharing vlan in command disables the IPv4 Ingress Sharing of hardware resources on the switch.

Command Mode

Global Configuration

Command Syntax

hardware access-list resource sharing vlan [ipv4 | ipv6] in

no hardware access-list resource sharing vlan in

Guidelines

Ccompatible only with the DCS-7010 and DCS-7050x series switches.
Enabling IPv4 Ingress Sharing requires the restart of software agents on the platform. This is a disruptive process and impacts traffic forwarding.

Use the show platform trident command to verify the Ingress IPv4 Sharing information.

hardware access-list resource sharing vlan ipv4 out

The hardware access-list resource sharing vlan ipv4 out command enables IPv4 Egress RACL TCAM sharing on the switch.

The no hardware access-list resource sharing vlan ipv4 out command disables the IPv4 Egress RACL TCAM sharing on the switch. By default, the switch enables IPv4 Egress RACL sharing.

Command Mode

Global Configuration

Command Syntax

hardware access-list resource sharing vlan ipv4 out

no hardware access-list resource sharing vlan ipv4 out

Guidelines

Compatible only with the DCS-7280E and DCS-7500E series switches.
Disabling IPv4 RACL sharing requires the restart of software agents on the platform. This is a disruptive process and impacts traffic forwarding.
Enabling IPv4 RACL sharing, if previously disabled from the default configuration, requires the restart of software agents on the platform. This is a disruptive process and impacts traffic forwarding. Enabling IPv4 RACL sharing if uRPF is configured disables uRPF.
Use the show running-config all | include sharing command to verify whether or not sharing for egress IPv4 RACLs is enabled.

Example

This command verifies if IPv4 RACL sharing is enabled or disabled.

switch# show running-config all | include sharing

hardware access-list resource sharing vlan ipv4 out 
                        ---->It returns the following output if IPv4 RACL sharing is enabled.

hardware access-list update default-result permit

The hardware access-list update default-result permit command configures the switch to permit all traffic on Ethernet and VLAN interfaces with ACLs applied to them while modifying the ACLs. Permits traffic when modifying the ACL using one of the ip access-list commands, and ends when exiting the ACL Configuration Mode and rules populated in hardware. EOS disables this by default.

The no hardware access-list update default-result permit and default hardware access-list update default-result permit commands restore the switch to the default state and blocks traffic during ACL modifications by removing the corresponding hardware access-list update default-result permit command from the running-config.

Command Mode

Global Configuration

Command Syntax

hardware access-list update default-result permit

no hardware access-list update default-result permit

default hardware access-list update default-result permit

Restrictions

This command is available on the Arista 7050X, 7060X, 7150, 7250X, 7280, 7280R, 7300X, 7320X, and 7500 series switches.

When enabled, static NAT, and ACL-based mirroring are affected during ACL updates.

Example

This command configures a 7150 series switch to permit all traffic on Ethernet and VLAN interfaces with applied ACLs while modifying the ACLs.

switch(config)# hardware access-list update default-result permit
switch(config)#

hardware counter feature acl out

The hardware counter feature acl out command enables egress ACL hardware counters for IPv4 or IPv6 and count the number of packets matching rules associated with egress ACLs applied to various interfaces on a switch.

The no hardware counter feature acl out and default hardware counter feature acl out commands disable or return the egress ACL hardware counters to the default state.

Command Mode

Global Configuration

Command Syntax

hardware counter feature acl out [options [ipv4 | ipv6]

no hardware counter feature acl out [options [ipv4 | ipv6]

default hardware counter feature acl out [options [ipv4 | ipv6]

Parameters

options - ACL hardware counter options include the following:
- ipv4 - Specify an IPv4 address.
- ipv6 - Specify an IPv4 address.

Examples

This command enables IPv4 egress ACL hardware counters.

switch(config)# hardware counter feature acl out ipv4
switch(config)#

This command disables IPv4 egress ACL hardware counters.

switch(config)# no hardware counter feature acl out ipv4
switch(config)#

ip access-group (Service ACLs)

The ip access-group (Service ACLs) command configures a Service ACL to apply to a control-plane service. Specify the service by the command mode used to apply the Service ACL.

The no ip access-group and default ip access-group commands remove the corresponding ip access-group (Service ACLs) command from running-config.

Command Mode

Mgmt-SSH Configuration

Mgmt-API Configuration

Router-BGP Configuration

Router-OSPF Configuration

Router-IGMP Configuration

MPLS-LDP Configuration

Queue-Monitor-Streaming Configuration

MPLS-Ping Configuration

Mgmt-Telnet Configuration

Command Syntax

ip access-group acl_name [vrfvrf_name][in]

no ip access-group acl_name [vrfvrf_name][in]

default ip access-group acl_name [vrfvrf_name][in]

Parameters

Parameters vary by process.

acl_name - Specify the name of the Service ACL assigned to control-plane service.
vrf vrf_name - Specifies the VRF to apply the Service ACL.
in - Specifies inbound connections or packets only. Requires a keyword for SSH and Telnet services.

Example

These commands apply the Service ACL bgpacl to the BGP routing protocol in VRF purple.

(config)# router bgp 5
(config-router-bgp)# vrf purple
(config-router-bgp-vrf-purple)# ip access-group bgpacl

For additional configuration examples, see Configuring Service ACLs and Displaying Status and Counters.

ip access-group

The ip access-group command applies an IPv4 or standard IPv4 Access Control List (ACL) to an interface or subinterface in the Interface Configuration Mode.

The no ip access-group and default ip access-group commands remove the corresponding ip access-group command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

ip access-group list_name[direction [in | out]]

no ip access-group list_name[direction [in | out]]

default ip access-group list_name [direction [in | out]]

Parameters

list_name - Specify the name of ACL assigned to interface.
direction Transmission direction of packets, relative to interface. Valid options include the following:
- in - Inbound packets.
- out - Outbound packets.

Considerations

Filtering of outbound packets by ACLs not supported on Petra platform switches.

Filtering of outbound packets by ACLs on FM6000 switches supported on physical interfaces only (Ethernet and port channels).

ACLs on sub-interfaces are supported on DCS-7280E, DCS-7500E, DCS-7280R, and DCS-7500R.

Example

These commands apply the IPv4 ACL named test2 to interface ethernet 3.

switch(config)# interface ethernet 3
switch(config-if-Et3)# ip access-group test2 in
switch(config-if-Et3)#

ip access-list

The ip access-list command places the switch in ACL Configuration Mode, a group change mode that modifies an IPv4 access control list. The command specifies the name of the IPv4 ACL that subsequent commands modify and creates an ACL if it references a nonexistent list. All changes in a group change mode edit session are pending until the end of the session.

The exit command saves pending ACL changes to running-config, then returns the switch to Global Configuration Mode. ACL changes are also saved by entering a different configuration mode.

The abort command discards pending ACL changes, returning the switch to Global Configuration Mode.

The no ip access-list and default ip access-list commands delete the specified IPv4 ACL.

Command Mode

Global Configuration

Command Syntax

ip access-list list_name

no ip access-list list_name

default ip access-list list_name

Parameter

list_name - Specify the name of the ACL. Must begin with an alphabetic character. Cannot contain spaces or quotation marks.

Commands Available in ACL configuration mode:

deny (IPv4 ACL)
no sequence number
permit (IPv4 ACL)
remark
resequence (ACLs)
show (ACL configuration modes)

Related Commands:

ip access-list standard Enters std-acl configuration mode for editing standard IP ACLs.
show ip access-lists Displays IP and standard ACLs.

Examples

This command places the switch in ACL configuration mode to modify the filter1 IPv4 ACL.
```
switch(config)# ip access-list filter1
switch(config-acl-filter1)#
```
This command saves changes to filter1 ACL, then returns the switch to Global Configuration Modee.
```
switch(config-acl-filter1)# exit
switch(config)#
```
This command discards changes to filter1, then returns the switch to Global Configuration Mode.
```
switch(config-acl-filter1)# abort
switch(config)#
```

ip access-list standard

The ip access-list standard command places the switch in STD-ACL Configuration Mode, a group change mode that modifies a standard IPv4 access control list. The command specifies the name of the standard IPv4 ACL that subsequent commands modify, and creates an ACL if it references a nonexistent list. All group change mode edit session changes are pending until the session ends.

The exit command saves pending ACL changes to running-config, then returns the switch to Global Configuration Mode. Pending changes are also saved by entering a different configuration mode.

The abort command discards pending ACL changes, returning the switch to global configuration mode.

The no ip access-list standard and default ip access-list standard commands delete the specified ACL.

Command Mode

Global Configuration

Command Syntax

ip access-list standard list_name

no ip access-list standard list_name

default ip access-list standard list_name

Parameter

list_name - Specify the name of standard ACL. Must begin with an alphabetic character. Cannot contain spaces or quotation marks.

Commands Available in std-ACL configuration mode:

deny (Standard IPv4 ACL)
no sequence number
permit (Standard IPv4 ACL)
remark
resequence (ACLs)
show (ACL configuration modes)

Related Commands

ip access-list - Enters ACL configuration mode for editing IPv4 ACLs.
show ip access-lists - Displays IPv4 and standard IPv4 ACLs.

Examples

This command places the switch in std-ACL configuration mode to modify the filter2 IPv4 ACL.
```
switch(config)# ip access-list standard filter2
switch(config-std-acl-filter2)#
```
This command saves changes to filter2 ACL, then returns the switch to the Global Configuration Mode.
```
switch(config-std-acl-filter2)# exit
switch(config)#
```
This command discards changes to filter2, then returns the switch to the Global Configuration Mode.
```
switch(config-std-acl-filter2)# abort
switch(config)#
```

ip prefix-list

The ip prefix-list command creates a prefix list or adds an entry to an existing list. Route map match commands use prefix lists to filter routes for redistribution into OSPF, RIP, or BGP domains.

A prefix list comprises all prefix list entries with the same label. The sequence numbers of the rules in a prefix list specify the order for applying rules to a route evaluated by the match command.

The no ip prefix-list and default ip prefix-list commands delete the specified prefix list entry by removing the corresponding ip prefix-list statement from running-config. If the no or default ip prefix-list command does not list a sequence number, the command deletes all entries of the prefix list.

Command Mode

Global Configuration

Command Syntax

ip prefix-list list_name [deny | permit] [seq index] network_addr [mask] resequence seq_number remark comment

no ip prefix-list list_name seq [index]

default ip prefix-list list_name seq [index]

Parameters

list_name - Specify a name for the prefix list.
seq seq_num- Specify the sequence number for the prefix list entry Value ranges from 0 to 65535.
permit | deny - Specifies route access when a route matches IP prefix list. Options include:
- permit - Allows access when matching the specified subnet.
- deny - Denies access when matching the specified subnet.
network_addr - Specify the subnet to filter routes. Use either a CIDR or address-mask format.
MASK - Specifies the range of the prefix to be matched.
- no parameter Exact match with the subnet mask is required.
- eq mask_e Prefix length is equal to mask_e.
- ge mask_g Range is from 1 to 32.
- le mask_l Range is from subnet mask length to mask_l.
- ge mask_l le mask_g Range is from mask_g to mask_l.
- mask_e, mask_l, and mask_g range from 1 to 32. When le and ge are specified, subnet mask mask_g>mask_l.
remark comment - Add a comment to the prefix list configuration.

Example

This command places the switch in IPv4 prefix list configuration mode to create an IPv4 prefix list named route-one.
```
switch(config)# ip prefix-list route-one
switch(config-ip-pfx)#
```

These commands create four different rules for the prefix-list named route-one.

switch(config)# ip prefix-list route-one
switch(config-ip-pfx)# seq 10 deny 10.1.1.0/24
switch(config-ip-pfx)# seq 20 deny 10.1.0.0/16
switch(config-ip-pfx)# seq 30 permit 12.15.4.9/32
switch(config-ip-pfx)# seq 40 deny 1.1.1.0/24

ipv6 access-group

The ipv6 access-groupcommand applies an IPv6 or standard IPv6 Access Control List (ACL) to the configuration mode interface.

The no ipv6 access-group and default ipv6 access-group commands remove the corresponding ipv6 access-group command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 access-group list_name [in | out]

no ipv6 access-group list_name [in | out]

default ipv6 access-group list_name [in | out]

Parameters

list_name - Specify the name of the ACL assigned to interface.
[in | out] - Specify the transmission direction of packets, relative to interface. Valid options include the following:
- in Inbound packets.
- out Outbound packets.

Examples

These commands assign the IPv6 ACL named test2 to the interface ethernet 3.

switch(config)# interface ethernet 3
switch(config-if-Et3)# ipv6 access-group test2 in
switch(config-if-Et3)#

ipv6 access-group (Service ACLs)

The ipv6 access-group (Service ACLs) command configures an IPv6 or standard IPv6 Service ACL to be applied by a control-plane service. Specify the service with the command mode to apply the Service ACL.

The no ipv6 access-group (Service ACLs) and default ipv6 access-group (Service ACLs) commands remove the corresponding ipv6 access-group (Service ACLs) command from running-config.

Command Mode

Mgmt-SSH Configuration

Mgmt-API Configuration

Router-BGP Configuration

Router-OSPF Configuration

MPLS-LDP Configuration

Queue-Monitor-Streaming Configuration

MPLS-Ping Configuration

Mgmt-Telnet Configuration

Command Syntax

ipv6 access-group ipv6_acl_name [vrf vrf_name][in]

no ipv6 access-group [ipv6_acl_name][vrfvrf_name][in]

default ipv6 access-group ipv6_acl_name [vrf vrf_name][in]

Parameters

Parameters vary by process.

ipv6_acl_name - Specify the name of the IPv6 Service ACL assigned to control-plane service.
vrf vrf_name - Specifies the VRF to apply the Service ACL.
in - Specifies inbound connections or packets only and requires a keyword for SSH and Telnet services.

Example

These commands apply the IPv6 Service ACL bgpacl to the BGP routing protocol in VRF purple.

(config)# router bgp 5
(config-router-bgp)# vrf purple
(config-router-bgp-vrf-purple)# ipv6 access-group bgpacl

For additional configuration examples, see Configuring Service ACLs and Displaying Status and Counters.

ipv6 access-list

The ipv6 access-list command places the switch in IPv6-ACL Configuration Mode, a group change mode that modifies an IPv6 access control list. The command specifies the name of the IPv6 ACL that subsequent commands modify and creates an ACL if it references a nonexistent list. All changes in a group change mode edit session pend until the end of the session.

The exit command saves pending ACL changes to running-config, then returns the switch to global configuration mode. ACL changes are also saved by entering a different configuration mode.

The abort command discards pending ACL changes, returning the switch to Global Configuration Mode.

The no ipv6 access-list and default ipv6 access-list commands delete the specified IPv6 ACL.

Command Mode

Global Configuration

Command Syntax

ipv6 access-list list_name

no ipv6 access-list list_name

default ipv6 access-list list_name

Parameters

list_name - Specify a name for the ACL. Must begin with an alphabetic character and cannot contain spaces or quotation marks.

Commands Available in IPv6-ACL configuration mode:

deny (IPv6 ACL)
no <sequence number> (ACLs)
permit (IPv6 ACL)
remark
resequence (ACLs)
show (ACL configuration modes)

Related Commands

ipv6 access-list standard Enters std-ipv6-acl configuration mode for editing standard IPv6 ACLs.
show ipv6 access-lists Displays IPv6 and standard IPv6 ACLs.

Examples

This command places the switch in IPv6-ACL configuration mode to modify the filter1 IPv6 ACL.
```
switch(config)# ipv6 access-list filter1
switch(config-ipv6-acl-filter1)#
```
This command saves changes to filter1 ACL, then returns the switch to global configuration mode.
```
switch(config-ipv6-acl-filter1)# exit
switch(config)#
```
This command discards changes to filter1, then returns the switch to global configuration mode.
```
switch(config-ipv6-acl-filter1)# abort
switch(config)#
```

ipv6 access-list standard

The ipv6 access-list standard command places the switch in std-IPv6-ACL-configuration mode, a group change mode that modifies a standard IPv6 access control list. The command specifies the name of the standard IPv6 ACL that subsequent commands modify and creates an ACL if it references a nonexistent list. All group change mode edit session changes are pending until the session ends.

The abort command discards pending ACL changes, returning the switch to global configuration mode.

The no ipv6 access-list standard and default ipv6 access-list standard commands delete the specified ACL.

Command Mode

Global Configuration

Command Syntax

ipv6 access-list standard list_name

no ipv6 access-list standard list_name

default ipv6 access-list standard list_name

Parameters

list_name - Specify a name for the ACL. Must begin with an alphabetic character and cannot contain spaces or quotation marks.

Commands Available in std-IPv6-ACL configuration mode:

deny (Standard IPv6 ACL)
no <sequence number> (ACLs)
permit (Standard IPv6 ACL)
remark
resequence (ACLs)
show (ACL configuration modes)

Related Commands

ipv6 access-list Enters IPv6-ACL configuration mode for editing IPv6 ACLs.
show ipv6 access-lists Displays IPv6 and standard IPv6 ACLs.

Examples

This command places the switch in Std-IPv6 ACL configuration mode to modify the filter2 ACL.
```
switch(config)# ipv6 access-list standard filter2
switch(config-std-ipv6-acl-filter2)#
```
This command saves changes to filter2 ACL, then returns the switch to global configuration mode.
```
switch(config-std-ipv6-acl-filter2)# exit
switch(config)#
```
This command discards changes to filter2, then returns the switch to global configuration mode.
```
switch(config-std-ipv6-acl-filter2)# abort
switch(config)#
```

ipv6 prefix-list

The ip prefix-list command places the switch in IPv6 prefix-list configuration mode, which is a group change mode that modifies an IPv6 prefix list. The command specifies the name of the IPv6 prefix list that subsequent commands modify and creates a prefix list if it references a nonexistent list. All changes in a group change mode edit session are pending until the end of the session.

The exit command saves pending prefix list changes to running-config, then returns the switch to global configuration mode. ACL changes are also saved by entering a different configuration mode.

The abort command discards pending changes, returning the switch to global configuration mode.

The no ipv6 prefix-list and default ipv6 prefix-list commands delete the specified IPv6 prefix list.

Command Mode

Global Configuration

Command Syntax

ipv6 prefix-list list_name

no ipv6 prefix-list list_name

default ipv6 prefix-list list_name

Parameter

list_name Name of prefix list. Must begin with an alphabetic character. Cannot contain spaces or quotation marks.

Commands Available in IPv6-pfx configuration mode:

deny (IPv6 Prefix List)
permit (IPv6 Prefix List)
seq (IPv6 Prefix Lists)

Examples

This command places the switch in IPv6 prefix-list configuration mode to modify the route-five prefix list.
```
switch(config)# ipv6 prefix-list route-five
switch(config-ipv6-pfx)#
```
This command saves changes to the prefix list, then returns the switch to global configuration mode.
```
switch(config-ipv6-pfx)# exit
switch(config)#
```
This command saves changes to the prefix list, then places the switch in interface-ethernet mode.
```
switch(config-ipv6-pfx)# interface ethernet 3
switch(config-if-Et3)#
```
This command discards changes to the prefix list, then returns the switch to global configuration mode.
```
switch(config-ipv6-pfx)# abort
switch(config)#
```

mac access-group

The mac access-group command applies a MAC Access Control List (MAC ACL) when in the Interface Configuration Mode.

The no mac access-group and default mac access-group commands remove the specified mac access-group command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Command Syntax

mac access-group list_name [direction [in | out]]

no mac access-group list_name[direction [in | out]]

default mac access-group list_name [direction [in | out]]

Parameters

list_name - Specify the name of MAC ACL.
direction - Specify the transmission direction of packets, relative to interface. Valid options include:
- in Inbound packets.
- out Outbound packets.

Restrictions

Only Helix, Trident, and Trident II platform switches support filtering of outbound packets by MAC ACLs.

Example

These commands assign the MAC ACL named mtest2 to interface ethernet 3 to filter inbound packets.

switch(config)# interface ethernet 3
switch(config-if-Et3)# mac access-group mtest2 in
switch(config-if-Et3)#

mac access-list

The mac access-list command places the switch in MAC-ACL Configuration Mode, a group change mode that modifies a MAC access control list. The command specifies the name of the MAC ACL that subsequent commands modify and creates an ACL if it references a nonexistent list. All changes in a group change mode edit session are pending until the end of the session.

The exit command saves pending ACL changes to running-config, then returns the switch to Global Configuration Mode. ACL changes are also saved by entering a different configuration mode.

The abort command discards pending ACL changes, returning the switch to Global Configuration Mode.

The no mac access-list and default mac access-list commands delete the specified list.

Command Mode

Global Configuration

Command Syntax

mac access-list list_name

no mac access-list list_name

default mac access-list list_name

Parameter

list_name - Specify the name of the MAC ACL. Names must begin with an alphabetic character and cannot contain a space or quotation mark.

Commands Available in MAC-ACL Configuration Mode:

deny (MAC ACL)
no <sequence number> (ACLs)
permit (MAC ACL)
remark
resequence (ACLs)
show (ACL configuration modes)

Examples

This command places the switch in MAC-ACL configuration mode to modify the mfilter1 MAC ACL.
```
switch(config)# mac access-list mfilter1
switch(config-mac-acl-mfilter1)#
```
This command saves changes to mfilter1 ACL, then returns the switch to global configuration mode.
```
switch(config-mac-acl-mfilter1)# exit
switch(config)#
```
This command saves changes to mfilter1 ACL, then places the switch in interface-ethernet configuration mode.
```
switch(config-mac-acl-mfilter1)# interface ethernet 3
switch(config-if-Et3)#
```
This command discards changes to mfilter1, then returns the switch to global configuration mode.
```
switch(config-mac-acl-mfilter1)# abort
switch(config)#
```

match (route-map)

The match command creates a route map statement entry that specifies one route filtering command. When a statement contains multiple match commands, the permit or deny filter applies to a route only if the properties equal the corresponding parameters in each match command. When a route properties do not equal the command parameters, the route is evaluated against the next statement in the route map, as determined by sequence number. If all statements fail to permit or deny the route, the route is denied.

The no match and default match commands remove the match command from the configuration mode route map statement by deleting the corresponding command from running-config.

Note: The route map configuration supports only standard ACL.

Command Mode

Route-Map Configuration

Command Syntax

match condition

no match condition

default match condition

Parameters

condition - Specifies criteria for evaluating a route. Options include the following:
- aggregate-role - Specify the role in BGP contributor-aggregate relation. Options include the following:
  - contributor - Specify BGP aggregate contributor.
  - aggregate-attributes - Specify the Route map to apply against the aggregate route.
- as 1 to 4294967295 - Specify the BGP Autonomous System number.
- as-path path_name - Specify the BGP Autonomous System path access list.
- as-path length { <= | = | => } length
  - <= - Length of AS path must be less than or equal to specified value.
  - = - Length of AS path must be equal to specified value.
  - => Length of AS path must be equal to or greater than specified value.
  - length - Value for AS path length comparison (0-4000).
- community name BGP community. Options include the following:
  - listname - Specify the BGP community.
  - listname - Specify the exact-match BGP community. The list must match the present set.
- extcommunity listname - Specify the BGP extended community. Options include the following:
  - listname - Specify the BGP community.
  - listname - Specify the exact-match BGP community. The list must match the present set.
- interface intf_name - Specifies an interface. Options include the following::
  - ethernet e_num - Specify the Ethernet interface.
  - loopback l_num - Specify the Loopback interface.
  - port-channel p_num - Specify the Port channel interface.
  - vlan v_num - Specify the VLAN interface.
  invert-result - Specify the Invert sub route map result.
- ip address LIST - Specify the IPv4 address filtered by an ACL or prefix list. Options include the following:
  - access-list acl_name - Specify the IPv4 address filtered by access control list (ACL).
  - prefix-list plv4_name- Specify the IPv4 address filtered by IP prefix list.
- ip next-hop prefix-list plv4_name - Specify the IPv4 next-hop filtered by IP prefix list.
- ip resolved-next-hop prefix-list plv4_name - Specify the IPv4 resolved next-hop filtered by IP prefix list.
- ipv6 address prefix-list plv6_name - Specify the IPv6 address filtered by IPv6 prefix list.
- ipv6 next-hop prefix-list plv6_name - Specify the IPv6 next-hop filtered by IPv6 prefix list.
- ipv6 resolved-next-hop prefix-list plv6_name - Specify the IPv6 resolved nexthop filtered by IPv6 prefix list.
- local-preference 1 to 4294967295 - Specify the BGP local preference metric.
- metric 1 to 4294967295 - Specify the route metric.
- metric-type OSPF_TYPE - Specify the OSPF metric type. Options include the following:
  - type-1 OSPF type 1 metric.
  - type-2 OSPF type 2 metric.
- source-protocol protocol_type - Specify the Routing protocol of route source. Options include the following:
  - bgp
  - connected
  - ospf
  - rip
  - static
- tag 1 to 4294967295 Route tag.

Related Command

route-map

Examples

This command creates a route map match rule that filters routes from BGP as 15.

switch(config)# route-map map1
switch(config-route-map-map1)# match as 15
switch(config-route-map-map1)#

This command adds a route-map match rule that the AS path be less than or equal to 300.

switch(config-route-map-map1)# match as-path length <= 300
switch(config-route-map-map1)#

no `sequence number`

The no sequence number command removes the rule with the specified sequence number from the ACL. The default <sequence number> command also removes the specified rule.

Command Mode

ACL Configuration

IPv6-ACL Configuration

Std-ACL Configuration

Std-IPv6-ACL Configuration

MAC-ACL Configuration

Command Syntax

no line_num

default line_num

Parameter

line_num - Specify the sequence number of rule to delete. Values range from 1 - 4294967295.

Example

This command removes statement 30 from the list.

switch(config-acl-test1)# show IP Access Lists test1
  10 permit ip 10.10.10.0/24 any
  20 permit ip any host 10.20.10.1
  30 deny ip host 10.10.10.1 host 10.20.10.1
  40 permit ip any any
  50 remark end of list
Total rules configured: 5
  Configured on Ingress: Et1/1
  Active on     Ingress: Et1/1

switch(config-acl-test1)# no 30
switch(config-acl-test1)# show IP Access Lists
  20 permit ip any host 10.20.10.1
  40 permit ip any any
  50 remark end of list
Total rules configured: 4
  Configured on Ingress: Et1/1
  Active on     Ingress: Et1/1

permit (IPv4 ACL)

The permit command adds a permit rule to the configuration mode IPv4 Access Control List (ACL). Interfaces with the applied ACL accept packets filtered by a permit rule the ACL is applied. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL last rule.

The no permit and default permit commands remove the specified rule from the configuration mode ACL. The no <sequence number> (ACLs) command also removes a specified rule from the ACL.

Command Mode

ACL Configuration

Command Syntax

seq_num permit protocol src_addr source_pt dest_addr dest_pt flags msg fragments tracked dscp_filter ttl_filter log

no permit protocol src_addr source_pt dest_addr dest_pt flags msg fragments tracked dscp_filter ttl_filter log

default permit protocol src_addr source_pt dest_addr dest_pt flags msg fragments tracked dscp_filter ttl_filter log

Commands use a subset of the listed fields and available parameters depend on specified protocol.

Parameters

seq_num- Specify the sequence number assigned to the rule. Options include the following:
- no parameter - A number derived from adding 10 to the number of the ACL's last rule.
- 1 - 4294967295 - Specify the number assigned to entry.
protocol - Specify the protocol field filter. Options include the following:
- ahp- Authentication Header Protocol (51)
- gre - Generic Routing Encapsulation
- gtp - GPRS Tunneling Protocol
- icmp - Internet Control Message Protocol (1)
- igmp -Internet Group Management Protocol (2)
- ip -Any Internet Protocol v4 (4)
- ospf -Open Shortest Path First (89)
- pim -Protocol Independent Multicast (103)
- tcp -Transmission Control Protocol (6)
- udp -User datagram protocol (17)
- vlan - Enter VLAN number and mask. VLAN value range from 1 to 4094, and mask value range from 0x000-0xFFF .
- vrrp - Virtual Router Redundancy Protocol (112).
- protocol_num -An integer corresponding to an IP protocol. Values range from 0 to 255.
src_addr and dest_addr - Specify the source and destination address filters. Options include the following:
- network_addr - Specify the subnet address (CIDR or address-mask).
- any - Filter packets from all addresses.
- host ip_addr - Specify the IP address in dotted decimal notation.
  Source and destination subnet addresses support discontiguous masks.
source_port and dest_port Source and destination port filters. varnames include:
- any - Specify all ports.
- eq port-1 port-2 ... port-n - Specify a list of ports. Maximum list size is 10 ports.
- neq port-1 port-2 ... port-n - Specify the set of all ports not listed. Maximum list size is 10 ports.
- gt port - Specify the set of ports with larger numbers than the listed port.
- lt port - Specify the set of ports with smaller numbers than the listed port.
- range port_1 port_2 - Specify the set of ports within a range.
fragments -Filters packets with FO bit set (indicates a non-initial fragment packet).
flags -Specify the flags bit filters (TCP packets). Use CLI syntax assistance (?) to display varnames.
msg - Specify the message type filters (ICMP packets). Use CLI syntax assistance (?) to display varnames.
tracked - Specify the rule filters packets in existing ICMP, UDP, or TCP connections.
- Valid in ACLs applied to the control plane.
- Validity in ACLs applied to data plane varies by switch platform.
dscp_filter -Specify the rule filters packet by its DSCP value. Values include:
- no parameter - The rule does not use DSCP to filter packets.
- dscp dscp_value - Packets match if DSCP field in packet is equal to dscp_value.
ttl_filter - Rule filters packet by its TTL (time-to-live) value. Values include:
- ttl eq ttl_value - Match packets if ttl in packet is equal to ttl_value.
- ttl gt ttl_value - Match packets if ttl in packet is greater than ttl_value.
- ttl lt ttl_value - Match packets if ttl in packet is less than ttl_value.
- ttl neq ttl_value - Match packets if ttl in packet is not equal to ttl_value.
  - Valid in ACLs applied to the control plane.
  - Validity in ACLs applied to data plane varies by switch platform.
log-Specify to trigger an informational log message to the console about the matching packet.
- Valid in ACLs applied to the control plane.
- Validity in ACLs applied to data plane varies by switch platform.

Examples

This command appends a permit statement at the end of the ACL. The permit statement passes all OSPF packets from 10.10.1.1/24 to any host.
```
switch(config)# ip access-list text1
switch(config-acl-text1)# permit ospf 10.1.1.0/24 any
switch(config-acl-text1)#
```
This command inserts a permit statement with the sequence number 25. The permit statement passes all PIM packets through the interface.
```
switch(config-acl-text1)# 25 permit pim any any
switch(config-acl-text1)#
```

These commands configure ACL to permit VLAN traffic between any source and destination host.

switch(config)# ip access-list acl1
switch(config-acl-acl1)# permit vlan 1234 0x0 ip any any

permit (IPv6 ACL)

The permit command adds a permit rule to the configuration mode IPv6 Access Control List (ACL). Interfaces with the applied ACL accept packets filtered by a permit rule the ACL is applied. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL last rule.

The no permit and default permit commands remove the specified rule from the configuration mode ACL. The no <sequence number> (ACLs) command also removes a specified rule from the ACL.

Command Mode

IPv6-ACL Configuration

Command Syntax

seq_num permit protocol src_addr source_pt dest_addr dest_pt flags msg hop tracked dscp_filter log

no permit protocol src_addr source_pt dest_addr dest_pt flag msg hop tracked dscp_filter log

default deny protocol src_addr source_pt dest_addr dest_pt flag msg hop tracked dscp_filter log

Note: Commands use a subset of the listed fields and available parameters depend on specified protocol.

Parameters

seq_num - The sequence number assigned to the rule. Options include the following:
- no parameter.Number is derived by adding 10 to the number of the ACL’s last rule.
- 1 - 4294967295 Number assigned to entry.
protocol Specify the protocol field filter. Options include the following:
- icmpv6 - Internet Control Message Protocol for IPv6 (58).
- ipv6 - Internet Protocol IPv6 (41).
- ospf - Open Shortest Path First (89).
- tcp - Transmission Control Protocol (6).
- udp - User Datagram Protocol (17).
- vlan - Enter VLAN number. Value ranges from 1 to 4094.
- protocol_num - Integer corresponding to an IP protocol. Values range from 0 to 255.
src_addr and dest_addr - Specify the source and destination address filters. Options include the following:
- ipv6_prefix - Specify the IPv6 address with prefix length (CIDR notation).
- any - Specify the Packets from all addresses are filtered.
- host ipv6_addr - Specify the IPv6 host address.
source_pt and DEST_PT - Specify the source and destination port filters. Options include the following:
- any All ports.
- eq port-1 port-2 ... port-n - Specify the list of ports. Maximum list size is 10 ports.
- neq port-1 port-2 ... port-n Specify the set of all ports not listed. Maximum list size is 10 ports.
- gt port - Specify theset of ports with larger numbers than the listed port.
- lt port - Specify the set of ports with smaller numbers than the listed port.
- range port_1 port_2 - Specify the set of ports whose numbers are in the range.
hop - Filter using the packet’s hop-limit value. Options include the following:
- no parameter - The rule does not use hop limit to filter packets.
- hop-limit eq hop_value - Match packets if hop-limit value in packet equals hop_value.
- hop-limit gt hop_value - Match packets if hop-limit in packet is greater than hop_value.
- hop-limit lt hop_value - Match packets if hop-limit in packet is less than hop_value.
- hop-limit neq hop_value - Match packets if hop-limit in packet is not equal to hop_value.
flag - Flag bit filters (TCP packets).
msg - Message type filters (ICMPv6 packets).
tracked The rule filters packets in existing ICMP, UDP, or TCP connections.
- Valid in ACLs applied to the control plane.
- Validity in ACLs applied to data plane varies by switch platform.
dscp_filter The rule filters packet by its DSCP value. Options include the following:
- no parameter - The rule does not use DSCP to filter packets.
- dscp dscp_value - Match packets if DSCP field in packet is equal to dscp_value.

flow_label - The rule permits packets with IPv6 flow labels matching an exact value or a pattern based on a mask. varnames include:
- no parameter - The rule does not use IPv6 flow labels to filter packets.
- flow-label eq ipv6_flow_label - The IPv6 flow label must exactly match ipv6_flow_label. Flow labels can range from 0 to 1048575.
- flow-label ipv6_flow_label flow_label_mask The IPv6 flow label must match a pattern defined by ipv6_flow_label and flow_label_mask. The mask is an inverse mask. Where the mask has a 0 bit, the flow label must match the ipv6_flow_label value, and where the mask has a 1 bit, the corresponding bit in the flow label is ignored. For example, if ipv6_flow_label is 10 (0b01010 in binary) and flow_label_mask is 0x14 (0b10100 in binary), the rule matches flow labels described by 0b.1.10 where “.” is a wildcard and can be either 0 or 1. The flow labels that match include 10 (0b01010), 14 (0b0110), 26 (0b11010), and 30 (0b1110). Flow labels can range from 0 to 1048575 and flow label masks can range from 0x00000 to 0xfffff.
log - Send an informational log message to the console when a packet matches.
- Valid in ACLs applied to the control plane.
- Validity in ACLs applied to data plane varies by switch platform.

Examples

This command appends a permit statement at the end of the ACL. The permit statement passes all IPv6 packets with the source address 3710:249a:c643:ef11::/64 and with any destination address.
```
switch(config)# ipv6 access-list acl1
switch(config-acl-acl1)# permit ipv6 3710:249a:c643:ef11::/64 any
switch(config-acl-acl1)# exit
switch(config)#
```

These commands configure ACL to permit VLAN traffic between any source and destination host.

switch(config)# ip access-list acl2
switch(config-acl-acl2)# permit ipv6 vlan 1234 0x0 ip any any
switch(config-acl-acl2)# exit
switch(config)#

These commands add a rule to permit all IPv6 packets with flow label 23.

switch(config)# ipv6 access-list acl3
switch(config-acl-acl3)# permit ipv6 any any flow-label eq 23
switch(config-acl-acl3)# exit
switch(config)#

These commands create a rule to permit all IPv6 packets matched by the flow label 23 and the mask 0x5678.

switch(config)# ipv6 access-list acl4
switch(config-acl-acl4)# permit ipv6 any any flow-label 23 0x5678
switch(config-acl-acl4)# exit
switch(config)#

permit (IPv6 Prefix List)

The permit command adds a rule to the configuration mode IPv6 prefix list. Route map match commands use prefix lists to filter routes for redistribution into OSPF, RIP, or BGP domains. Routes are redistributed into the specified domain when they match the prefix that a permit statement specifies.

The no permit and default permit commands remove the specified rule from the prefix list. The no seq (IPv6 Prefix Lists) command also removes the specified rule from the prefix list.

Command Mode

IPv6-pfx Configuration

Command Syntax

seq_num permit ipv6_prefix mask

Parameters

seq_num - Specify the sequence number assigned to the rule. Options include the following:
- no parameter - Number derived from adding 10 to the number of the list's last rule.
- seq seq_num - Specify the number from the seq_num. Value ranges from 0 to 65535.
ipv6_prefix - Specify the IPv6 prefix that filters the routes in CIDR notation.
mask - Specify the range of the prefix to match.
- no parameter - Requires an exact match with the subnet mask.
- eq mask_e - Specify the prefix length equal to mask_e.
- ge mask_g - Specify the range from the mask_g to 128.
- le mask_l - Specify the range from the subnet mask length to mask_l.
- ge mask_l le mask_g Range is from mask_g to mask_l.
- mask_e, mask_l and mask_g range from 1 to 128.
- When le and ge are specified, the prefix list size mask_g mask_l.

Example

This command appends a permit statement at the end of the text1 prefix list. The permit statement allows redistribution of routes with the specified prefix.

switch(config)# ipv6 prefix-list route-five
switch(config-ipv6-pfx)# permit 3100::/64
switch(config-ipv6-pfx)#

permit (MAC ACL)

The permit command adds a permit rule to the configuration mode MAC access control list packets through the interface to which the list is applied. Rule filters include protocol, source, and destination.

The no permit and default permit commands remove the specified rule from the configuration mode ACL. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.

Command Mode

MAC-ACL Configuration

Command Syntax

seq_num permit source_addr dest_addr protocol log

no permit source_addr dest_addr protocol log

default permit source_addr dest_addr protocol log

Parameters

seq_num - Specify the sequence number assigned to the rule. Options include the following:
- no parameter - Specify the number derived by adding 10 to the number of the ACL's last rule.
- 1 - 4294967295 - Specify the number assigned to entry.
source_addr and dest_addr- Specify the source and destination address filters. Options include the following:
- mac_address mac_mask - Specify the MAC address and mask.
- any - Filter packets from all addresses.
- mac_address - Specifies a MAC address in 3x4 dotted hexadecimal notation (hhhh.hhhh.hhhh).
- mac_mask - Specifies a MAC address mask in 3x4 dotted hexadecimal notation (hhhh.hhhh.hhhh).
- 0 - Require an exact match to filter.
- 1 - Filter on any value.
protocol - Specify the protocol field filter. Options include the following:
- aarp Appletalk Address Resolution Protocol (0x80f3).
- appletalk Appletalk (0x809b).
- arp Address Resolution Protocol (0x806).
- ip Internet Protocol Version 4 (0x800).
- ipx Internet Packet Exchange (0x8137).
- lldp LLDP (0x88cc).
- novell Novell (0x8138).
- rarp Reverse Address Resolution Protocol (0x8035).
- protocol_num Integer corresponding to a MAC protocol. Values range from 0 to 65535.
log - Specify to trigger an informational log message to the console about the matching packet.

Examples

This command appends a permit statement at the end of the ACL. The permit statement passes all aarp packets from 10.1000.0000 through 10.1000.FFFF to any host.
```
switch(config)# mac access-list text1
switch(config-mac-acl-text1)# permit 10.1000.0000 0.0.FFFF any aarp
switch(config-mac-acl-text1)#
```
This command inserts a permit statement with the sequence number 25. The permit statement passes all packets through the interface.
```
switch(config-mac-acl-text1)# 25 permit any any
switch(config-mac-acl-text1)#
```

permit (Standard IPv4 ACL)

The permit command adds a permit rule to a standard IPv4 Access Control List (ACL). Standard ACL rules filter on the source field.

Interfaces with the applied ACL accept packets filtered by a permit rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL's last rule..

The no permit and default permit commands remove the specified rule from the ACL. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.

Command Mode

Std-ACL Configuration

Command Syntax

[seq_num] permit [ source_addr network_addr [any | host] [log]

no permit [ source_addr network_addr [any | host] [log]

default permit [ source_addr network_addr [any | host][log]

Parameters

seq_num - Specify the sequence number assigned to the rule. Options include the following:
- no parameter - A number derived from adding 10 to the number of the ACL's last rule.
- 1 - 4294967295 Number assigned to entry.
source_addr - Specify the source address filter. Options include the following:
- network_addr - Specify the subnet address in CIDR or as an address-mask.
- any - Filter packets from all addresses.
- host ip_addr - Specify the IP address in dotted decimal notation.
  Subnet addresses support discontiguous masks.
log - Specify to trigger an informational log message to the console about the matching packet.
- Valid in ACLs applied to the control plane.
- Validity in ACLs applied to data plane varies by switch platform.

Example

This command appends a permit statement at the end of the ACL. The permit statement passes all packets with a source address of 10.10.1.1/24.

switch(config)# ip access-list standard text1
switch(config-std-acl-text1)# permit 10.1.1.1/24
switch(config-std-acl-text1)#

permit (Standard IPv6 ACL)

The permit command adds a permit rule to the standard IPv6 access control list. Standard ACL rules filter on the source field.

The no permit and default permit commands remove the specified rule from the configuration mode ACL. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.

Command Mode

Std-IPv6-ACL Configuration

Command Syntax

[seq_num] permit source_addr

no permit source_addr

default permit source_addr

Parameters

seq_num - Specify the sequence number assigned to the rule. Options include the following:
- no parameter - The number derived by adding 10 to the number of the ACL's last rule.
- 1 - 4294967295 - The number assigned to entry.
source_addr - Specify the source address filter. Options include the following:
- ipv6_prefix - Specify the IPv6 address with prefix length (CIDR notation).
- any - Filter packets from all addresses.
- host ipv6_addr - Specify the IPv6 host address.

Example

This command appends a permit statement at the end of the ACL. The permit statement drops packets with a source address of 2103::/64.

switch(config)# ipv6 access-list standard text1
switch(config-std-acl-ipv6-text1)# permit 2103::/64
switch(config-std-acl-ipv6-text1)#

remark

The remark command adds a non-executable comment statement into the pending ACL. Remarks entered without a sequence number are appended to the end of the list. Remarks with a sequence number insert into the list as specified by the sequence number.

The default remark command removes the comment statement from the ACL.

The no remark command removes the comment statement from the ACL. The command can specify the remark by content or by sequence number.

Command Mode

ACL Configuration

IPv6-ACL Configuration

Std-ACL Configuration

Std-IPv6-ACL Configuration

MAC-ACL Configuration

Command Syntax

remark text

line_num remark [text]

no remark text

default remark text

Parameters

text The comment text.
line_num Sequence number assigned to the remark statement. Value ranges from 1 - 4294967295.

Example

This command appends a comment to the list.

switch(config-acl-test1)# remark end of list
switch(config-acl-test1)# show
IP Access List test1
  10 permit ip 10.10.10.0/24 any
  20 permit ip any host 10.20.10.1
  30 deny ip host 10.10.10.1 host 10.20.10.1
  40 permit ip any any  
  50 remark end of list

resequence (ACLs)

The resequence command assigns sequence numbers to rules in the configuration mode ACL. Command parameters specify the number of the first rule and the numeric interval between consecutive rules.

Maximum rule sequence number is 4294967295.

Command Mode

ACL Configuration

IPv6-ACL Configuration

Std-ACL Configuration

Std-IPv6-ACL Configuration

MAC-ACL Configuration

Command Syntax

resequence [start_num [inc_num]]

Parameters

start_num Sequence number assigned to the first rule. Default is 10.
inc_num Numeric interval between consecutive rules. Default is 10.

Example

The resequence command re-numbers the list, starting the first command at number 100 and incrementing subsequent lines by 20.

switch(config-acl-test1)# show
IP Access List test1
  10 permit ip 10.10.10.0/24 any
  20 permit ip any host 10.20.10.1
  30 deny ip host 10.10.10.1 host 10.20.10.1
  40 permit ip any any
  50 remark end of list
switch(config-acl-test1)# resequence 100 20
switch(config-acl-test1)# show
IP Access List test1
  100 permit ip 10.10.10.0/24 any
  120 permit ip any host 10.20.10.1
  140 deny ip host 10.10.10.1 host 10.20.10.1
  160 permit ip any any
  180 remark end of list

route-map

The route-map command places the switch in Route-Map Configuration Mode, a group change mode that modifies a route map statement. The command specifies the name and number of the route map statement that subsequent commands modify and creates a route map statement if it references a nonexistent statement. All changes in a group change mode edit session pend until the end of the session.

Route maps define commands for redistributing routes between routing protocols. Use names, filter type (permit or deny), and sequence number to identify a route map statement. Statements with the same name are components of a single route map, and the sequence number determines the order in which the statements compare to a route.

The exit command saves pending route map statement changes to running-config, then returns the switch to global configuration mode. Also, save ACL changes by entering a different configuration mode.

The abort command discards pending changes, returning the switch to global configuration mode.

The no route-map and default route-map commands delete the specified route map statement from running-config.

Note: The route map configuration supports only standard ACL.

Command Mode

Global Configuration

Command Syntax

route-map map_name [filter_type] [sequence_number]

no route-map map_name [filter_type] [sequence_number]

default route-map map_name [filter_type][sequence_number]

Parameters

map_name - Assign a label to the route map. Protocols reference this label to access the route map.
filter_type - Specify the disposition of routes matching commands specified by route map statement.
- permit - Redistribute routes when they match route map statement.
- deny - Do not redistribute routes when they match route map statement.
- no parameter Assigns permit as the filter_type.

When a route does not match the route map criteria, EOS evaluates the next statement within the route map to determine the redistribution action for the route.

sequence_number - Specify the route map position relative to other statements with the same name.
- no parameter - Assign the sequence number of 10 (default) to the route map.
- 1-16777215 - Specifies sequence number assigned to route map.

Commands Available in Route-Map Configuration Mode:

continue (route map)
match (route-map)
set (route-map)

Examples

This command creates the route map named map1 and places the switch in route map configuration mode. This configures the route map as a permit map.
```
switch(config)# route-map map1 permit 20
switch(config-route-map-map1)#
```
This command saves changes to map1 route map, then returns the switch to Global Configuration Mode.
```
switch(config-route-map-map1)# exit
switch(config)#
```
This command saves changes to map1 route map, then places the switch in Interface-Ethernet Configuration Mode.
```
switch(config-route-map-map1)# interface ethernet 3
switch(config-if-Et3)#
```
This command discards changes to map1 route map, then returns the switch to Global Configuration Mode.
```
switch(config-route-map-map1)# abort
switch(config)#
```

no seq (IPv6 Prefix Lists)

The no seq command removes the rule with the specified sequence number from the ACL. The default seq command also removes the specified rule.

The seq keyword provides a command option used at the beginning of deny (IPv6 Prefix List) and permit (IPv6 Prefix List) commands that places a new rule between two existing rules.

Command Mode

IPv6-pfx Configuration

Command Syntax

no seq line_num

default seq line_num

Parameter

line_num - Specify the sequence number of rule to delete. Valid rule numbers range from 0 to 65535.

Example

These commands remove rule 20 from the map1 prefix list, then displays the resultant list.

switch(config)# ipv6 prefix-list map1
switch(config-ipv6-pfx)# no seq 20
switch(config-ipv6-pfx)# exit
switch(config)# show ipv6 prefix-list map1
ipv6 prefix-list map1
seq 10 permit 3:4e96:8ca1:33cf::/64
seq 15 deny 3:4400::/64
seq 30 permit 3:1bca:3ff2:634a::/64
seq 40 permit 3:1bca:1141:ab34::/64
switch(config)#

set (route-map)

The set command specifies modifications to routes selected for redistribution by the Route-Map Configuration Mode.

The no set and default set commands remove the specified set command from the Route-Map Configuration Mode statement by deleting the corresponding set command from running-config.

Command Mode

Route-Map Configuration

Command Syntax

set condition [as-path prepend [num | auto]]

no set condition [as-path prepend [num | auto]]

default set condition[as-path prepend [num | auto]]

Parameters

condition - Specifies the route modification parameter and value. Options include the following:
- as-path prepend - Specifies the BGP AS number prepended to as-path. For details, see the set as-path prepend command.
  - 1 - 4294967295 - Specifies the BGP AS number to prepend.
  - auto - Specifies to use the peer AS number for inbound and local AS for outbound to prepend.
- distance 1 - 255 - Specifies the protocol independent administrative distance.
- ip next-hop ipv4_address - Specifies the next-hop IPv4 address.
  - peer-address - Specifies using BGP peering address as next hop IPv4 address.
- ipv6 next-hop ipv6_address - Specifies the next-hop IPv6 address.
  - peer-address - Specifies using the BGP peering address as next hop IPv6 address.
- local-preference 1 - 4294967295 - Specifies the BGP local preference metric.
- metric 1 - 4294967295 - Specifies the route metric.
- metric + 1 - 4294967295 - Specifies adding specified value to current route metric.
- metric - 1 - 4294967295 - Specifies subtracting specified value to current route metric.
- metric-type OSPF_TYPE OSPF metric type. Options include the following:
  - type-1 - OSPF type 1 metric.
  - type-2 - OSPF type 2 metric.
- origin O_TYPE BGP origin attribute. Options include the following:
  - egp - Exterior BGP route.
  - igp - Interior BGP route.
  - incomplete - BGP route of unknown origin.
- tag 1 - 4294967295 - Route tag.
- weight 1 - 65535 - BGP weight parameter.

Related Commands

route-map enters the Route-Map Configuration Mode.
set (route-map) specifies community modifications for the redistributed routes.
set community (route-map) specifies extended community modifications for the redistributed routes.

Example

This command creates a route map entry that sets the local preference metric to 100 on redistributed routes.

switch(config)# route-map map1
switch(config-route-map-map1)# set local-preference 100
switch(config-route-map-map1)#

set as-path match

The set as-path match command configures the as_path attribute for prefixes either received from a BGP neighbor or advertised to a BGP neighbor in the Route-Map Configuration Mode.

The no set as-path match command removes the AS path specified for the BGP prefix.

Command Mode

Route-Map Configuration

Command Syntax

set as-path match [all replacement [none| auto]] as_path

set as-path match[all replacement [none| auto]] as_path

Parameters

none - Replaces the as_path of the matching routes with a null or an empty as_path.
auto - Applying the specific route map as an inbound policy to a corresponding BGP neighbor statement, then replace the as_path of the prefixes received from this neighbor with the neighbor AS number. If applying this route map as an outbound policy to a corresponding neighbor statement, then replace the as_path of the prefixes advertised to this neighbor with the locally configured AS number.
as_path - Replaces the AS-Path of the matching routes with an arbitrary as_path.

Examples

This command replaces the AS-Path with the none option.

switch# show ip bgp neighbors 80.80.1.2 advertised-routes
BGP routing table information for VRF default
Router identifier 202.202.1.1, local AS number 200
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E 
- ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued 
for advertisement
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - 
Link Local Nexthop

Network Next Hop Metric LocPref Weight Path
* > 101.101.1.0/24 80.80.1.1 - - - 200 i
* > 102.102.1.0/24 80.80.1.1 - - - 200 i
* > 103.103.1.0/24 80.80.1.1 - - - 200 302 i
* > 202.202.1.0/24 80.80.1.1 - - - 200 i

switch# configure terminal
switch(config)# route-map foo permit 10
switch(config-route-map-foo)# set as-path match all replacement none
switch(config-route-map-foo)# exit
switch(config)# router bgp 200
switch(config-router-bgp)# neighbor 80.80.1.2 route-map foo out
switch(config-router-bgp)# end

switch# show ip bgp neighbors 80.80.1.2 advertised-routes
BGP routing table information for VRF default
Router identifier 202.202.1.1, local AS number 200
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E 
- ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued 
for advertisement
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - 
Link Local Nexthop

Network Next Hop Metric LocPref Weight Path
* > 101.101.1.0/24 80.80.1.1 - - - 200 i
* > 102.102.1.0/24 80.80.1.1 - - - 200 i
* > 103.103.1.0/24 80.80.1.1 - - - 200 i
* > 202.202.1.0/24 80.80.1.1 - - - 200 i

Replace the AS-Path of matching prefixes with an empty or a null AS-Path. Remove AS 302 from prefix 103.103.1.0/24 as shown in the above output.

This command replaces the AS-Path with the auto option.

switch(config)# route-map foo permit 10
switch(config-route-map-foo)# set as-path match all replacement auto
switch(config-route-map-foo)# end

switch# show ip bgp neighbors 80.80.1.2 advertised-routes
BGP routing table information for VRF default
Router identifier 202.202.1.1, local AS number 200
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E 
- ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued 
for advertisement
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - 
Link Local Nexthop

Network Next Hop Metric LocPref Weight Path
* > 101.101.1.0/24 80.80.1.1 - - - 200 200 i
* > 102.102.1.0/24 80.80.1.1 - - - 200 200 i
* > 103.103.1.0/24 80.80.1.1 - - - 200 200 i
* > 202.202.1.0/24 80.80.1.1 - - - 200 200 i

Replaces the AS-Path of matching prefixes with the locally configured AS 200.

This command replaces the AS-Path with another AS-Path.

switch(config)# route-map foo permit 10
switch(config-route-map-foo)# set as-path match all replacement 500 600
switch(config-route-map-foo)# end

switch# show ip bgp neighbors 80.80.1.2 advertised-routes
BGP routing table information for VRF default
Router identifier 202.202.1.1, local AS number 200
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E 
- ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued 
for advertisement
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - 
Link Local Nexthop

Network Next Hop Metric LocPref Weight Path
* > 101.101.1.0/24 80.80.1.1 - - - 200 500 600 i
* > 102.102.1.0/24 80.80.1.1 - - - 200 500 600 i
* > 103.103.1.0/24 80.80.1.1 - - - 200 500 600 i
* > 202.202.1.0/24 80.80.1.1 - - - 200 500 600 i

Replaces the AS-Path of matching prefixes with 500 600 as configured.

Replaces the AS-Path with a combination of auto and an AS-Path.

switch(config)# route-map foo permit 10
switch(config-route-map-foo)# set as-path match all replacement auto 500 600
switch(config-route-map-foo)# end

switch# show ip bgp neighbors 80.80.1.2 advertised-routes
BGP routing table information for VRF default
Router identifier 202.202.1.1, local AS number 200
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E 
- ECMP head, e - ECMP
 S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued 
for advertisement
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - 
Link Local Nexthop

 Network Next Hop Metric LocPref Weight Path
 * > 101.101.1.0/24 80.80.1.1 - - - 200 200 500 600 i
 * > 102.102.1.0/24 80.80.1.1 - - - 200 200 500 600 i
 * > 103.103.1.0/24 80.80.1.1 - - - 200 200 500 600 i
 * > 202.202.1.0/24 80.80.1.1 - - - 200 200 500 600 i

Replaces the AS-Path of matching prefixes with the locally configured AS 200 and 500 600.

set as-path prepend

The set as-path prepend command adds a set statement to a route map to prepend one or more Autonomous System (AS) numbers to the as_path attribute of a BGP route.

The no set as-path prepend and default set as-path prepend commands remove the specified set statements from the route map and update all corresponding routes.

Command Mode

Route-Map Configuration

Command Syntax

set as-path prepend auto | as_number [auto | as_number | last-as count]

no set as-path prepend auto | as_number [auto | as_number | last-as count]

default set as-path prepend auto | as_number [auto | as_number | last-as count]

Parameters

auto - Prepends the peer AS number for peer inbound route maps and the local AS number for peer outbound route maps.
as_number - Prepends the specified AS number. Enter in plain notation (values range from 1-4294967295) or in asdot notation as described in RFC 5396. In asdot notation, enter AS numbers from 1-65535 in plain notation, and enter AS numbers from 65536 to 4294967295 as two values separated by a dot. The first value is high-order and represents a multiple of 65536, and the second value is low-order and represents a decimal integer. For example, AS number 65552 can be entered as either 65552 or 1.16 (i.e., 1*65536+16). However entered, EOS stores the AS numbers internally in plain decimal notation and appear that way in show outputs.
last-as count - Prepends the last AS number in the AS path count times. Values range from 1 to 15. Mutually exclusive with the use of the auto cmdname or the entry of one or more specified AS numbers, and not supported in multi-agent mode.

Examples

These commands create a route-map entry that prepends AS number 64496 and prepends either the peer or local AS number twice.

switch(config)# route-map map1
switch(config-route-map-map1)# set as-path prepend 64496 auto auto
switch(config-route-map-map1)# exit

switch(config)# show route-map map1
route-map map1 permit 10
  Description:
  Match clauses:
  SubRouteMap:
  Set clauses:
    set as-path prepend 64496 auto auto
switch(config)#

The commands create a route-map entry that prepends AS numbers 64496, 64498, and 65552.

switch(config)# route-map map2
switch(config-route-map-map2)# set as-path prepend 64496 64498 1.16
switch(config-route-map-map2)# exit

switch(config)# show route-map map2
route-map map2 permit 10
  Description:
  Match clauses:
  SubRouteMap:
  Set clauses:
    set as-path prepend 64496 64498 65552
switch(config)#

These commands create a route map entry that prepends the last AS number 12 times.

switch(config)# route-map map3
switch(config-route-map-map3)# set as-path prepend last-as 12
switch(config-route-map-map3)# exit

switch(config)# show route-map map3
route-map map3 permit 10
  Description:
  Match clauses:
  SubRouteMap:
  Set clauses:
    set as-path prepend last-as 12
switch(config)#

set community (route-map)

The set community command specifies community attribute modifications to routes selected for redistribution. The set community none command removes community attributes from the route.

The no set community and default set community commands remove the specified community from the Route-Map Configuration Modestatement by deleting the corresponding statement from the running config.

Command Mode

Route-Map Configuration

Command Syntax

Parameters

gshut - Configures a graceful shutdown in BGP.
aa:nn - Configures the community AS and network number, separated by colon. Value ranges from 0:0 to 65535:65535.
community-list - A label for community list.
internet - Advertises route to the Internet community.
local-as - Advertises route only to local peers.
no-advertise - Does not advertise route to any peer.
no-export - Advertises route only within BGP AS boundary.
none - Does not provide any community attributes.
number - Configures the community number. Value ranges from 1 to 4294967040.
additive - Adds specified attributes to the current community.
delete - Removes specified attributes from the current community.

Related Commands

ip community-list
route-map
set (route-map)
set community (route-map)

Guideline

EOS does not support disabling the process of graceful shutdown community.

Example

This command advertises routes only to local peers.

switch(config-route-map-map1)# show active
route-map map1 permit 10
   match community instances <= 50
   set community 0:456 0:2345
switch(config-route-map-map1)# set community local-as
switch(config-route-map-map1)# ip community-list 345 permit 23
switch(config)# route-map map1
switch(config-route-map-map1)# show active
route-map map1 permit 10
   match community instances <= 50
   set community 0:456 0:2345 local-as
switch(config-route-map-map1)#

set extcommunity (route-map)

The set extcommunity command specifies extended community attribute modifications to routes selected for redistribution. The set extcommunity none command removes extended community attributes from the route.

The no set extcommunity and default set extcommunity commands remove the specified set extcommunity command from the Route-Map Configuration Mode statement by deleting the corresponding statement from running-config.

Command Mode

Route-Map Configuration Mode

Command Syntax

set extcommunity cond_x [cond_2][cond_n][mod_type]

set extcommunity none

no set extcommunitycond_x [cond_2][cond_n][mod_type]

default set extcommunity cond_x [cond_2][cond_n][mod_type]

default set extcommunity none

Parameters

cond_x - Specifies extended community route map modification. Command may contain multiple attributes. Options include the following:
- rt asn:nn - Specifies the route target attribute (AS:network number).
- rt ip-address:nn - Specifies the route target attribute (IP address: network number).
- soo ASN:nn - Specifies the site of origin attribute (AS:network number).
- soo IP-address:nn - Specifies the site of origin attribute (IP address: network number).
mod_type- Specifies the route map modification method. Options include the following:
- no parameter - Specifies the command to replace an existing route map with specified parameters.
- additive - Specifies the command to add specified parameters to existing route map.
- delete - Specifies the command to remove specified parameters from existing route map.

Related Commands

route-map enters route map configuration mode.
set (route-map) specifies attribute modifications for the redistributed routes.

Example

This command creates a route map entry in map1 that sets the route target extended community attribute.

switch(config)# route-map map1
switch(config-route-map-map1)# set extcommunity rt 10.13.2.4:100
switch(config-route-map-map1)#

show (ACL configuration modes)

The show command displays the contents of an Access Control List (ACL).

show or show pending displays the list as modified in ACL configuration mode.
show active displays the list as stored in running-config.
show comment displays the comment stored with the list.
show diff displays the modified and stored lists, with flags denoting the modified rules.

Exiting the ACL configuration mode stores all pending ACL changes to running-config.

Command Mode

ACL Configuration

IPv6-ACL Configuration

Std-ACL Configuration

Std-IPv6-ACL Configuration

MAC-ACL Configuration

Command Syntax

show

show active

show comment

show diff

show pending

Examples

The examples in this section assume these ACL commands are entered as specified.

These commands are stored in none:

10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.21.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
50 remark end of list

The current edit session removed this command. This change is not yet stored to none:
```
20 permit ip any host 10.21.10.1
```

The current edit session added these commands ACL. They are not yet stored to none:

20 permit ip 10.10.0.0/16 any
25 permit tcp 10.10.20.0/24 any
45 deny pim 239.24.124.0/24 10.5.8.4/30

This command displays the ACL, as stored in the configuration.

switch(config-acl-test_1)# show active
IP Access List test_1
  10 permit ip 10.10.10.0/24 any
  20 permit ip any host 10.21.10.1
  30 deny ip host 10.10.10.1 host 10.20.10.1
  40 permit ip any any
  50 remark end of list

This command displays the pending ACL, as modified in ACL configuration mode.

switch(config-acl-test_1)# show pending
IP Access List test_1
  10 permit ip 10.10.10.0/24 any
  20 permit ip 10.10.0.0/16 any
  25 permit tcp 10.10.20.0/24 any
  30 deny ip host 10.10.10.1 host 10.20.10.1
  40 permit ip any any
  45 deny pim 239.24.124.0/24 10.5.8.4/30
  50 remark end of list

This command displays the difference between the saved and modified ACLs.

Rules added to the pending list are denoted with a plus sign (+).

Rules removed from the saved list are denoted with a minus sign (-)

switch(config-acl-test_1)# show diff
---
+++
@@ -1,7 +1,9 @@
 IP Access List test_1
  10 permit ip 10.10.10.0/24 any
  20 permit ip any host 10.21.10.1
  20 permit ip 10.10.0.0/16 any
  25 permit tcp 10.10.20.0/24 any
  30 deny ip host 10.10.10.1 host 10.20.10.1
  40 permit ip any any  
  45 deny pim 239.24.124.0/24 10.5.8.4/30

show hardware tcam profile

The show hardware tcam profile command displays the hardware specific information for the current operational TCAM profile in the running configuration.

This command is applicable to DCS-7280(E/R) and DCS-7500(E/R) series switches only.

Command Mode

EXEC

Command Syntax

show hardware tcam profile [[profileName [[feature featureName] detail]]|[detail]

Parameters

profileName Selects the named profile.
featurefeatureNameSelects the specific feature by name.
detail Displays the content of the TCAM profile.

Guidelines

If the profile cannot be programmed, the Status column will print ‘ERROR‘. Any features that use TCAM functionality will not work properly. Do not expect any features to work if the profile is in the ‘ERROR’ state. If there are warnings or errors, a summary message will display warnings or errors found in programming the profile in addition to the system log messages.

Examples

The show hardware tcam profile lists the TCAM profile status on each line card. In case of successful programming it is as shown below.

switch(config)# show hardware tcam profile
                     Configuration            Status
FixedSystem          testprofile              testprofile

If the profile cannot be programmed, the Status column will print ‘ERROR‘.

(config)# show hardware tcam profile
             Configuration    Status
Linecard3    newprofile1    ERROR
Linecard4    newprofile1    ERROR Linecard5 newprofile1 ERROR
Linecard6    newprofile1    ERROR
Linecard7    newprofile1    WARNING

Detailed Programming Status
Linecard3, Linecard4, Linecard5
[Error] feature flow is not supported on this hardware platform
Linecard7
[Warning] the key size of feature flow exceeds the configured key size limit

The show hardware tcam profile <profile> detail command displays further info about the TCAM profile features.

Note: The profile contains all the features that are untouched after copying from the base profile.

switch(config-hw-tcam)# show hardware tcam profile myprofile detail
Profile myprofile [ FixedSystem ]
 Feature:             acl port ip egress
 Key size:            320
 Key Fields:          dscp, dst-ip, ip-frag, ip-protocol, l4-dst-port,
                      l4-src-port, src-ip
 
 Feature:             acl port ip ingress
 Key size:            320
 Key Fields:          dscp, dst-ip, ip-frag, ip-protocol, l4-dst-port, l4-ops,
                      l4-src-port, src-ip, tcp-control, ttl
 
 Feature:             acl port ipv6 egress
 Key size:            320
 Key Fields:          dst-ipv6, ip-protocol, ipv6-next-header,
                      ipv6-traffic-class, l4-dst-port, l4-src-port, src-ipv6,
                      tcp-control, ttl
 
 Feature:             acl port ipv6 ingress
 Key size:            320
 Key Fields:          dst-ipv6, ip-protocol, ipv6-next-header,
                      ipv6-traffic-class, l4-dst-port, l4-ops, l4-src-port,
                      src-ipv6, tcp-control, ttl
    
 Feature:             acl port ipv6 source-only egress
 Key size:            320
 Key Fields:          ip-protocol, src-ipv6
    
 Feature:             acl port mac egress
 Key size:            320
 Key Fields:          dst-mac, ether-type, src-mac
...

You can use the show hardware tcam profile command without the detail keyword to see all of the features configured in a profile without seeing how the features are defined.

(config-hw-tcam-profile-newfeature)# show hardware tcam profile default

Features enabled in TCAM profile default: [ Linecard3, Linecard4, Linecard6, Linecard
7, Linecard8, Linecard9, Linecard10 ]

mpls
acl vlan ipv6
acl subintf ipv6
acl vlan ipv6 egress
acl port ipv6
pbr ipv6
acl vlan ip
acl subintf ip
acl port ip
tunnel vxlan
acl port mac
pbr ip
pbr mpls
qos ipv6
qos ip
mirror ip
counter lfib
mpls pop ingress

show access-lists

The show access-lists command displays the contents of all IPv4, IPv6, and MAC Access Control Lists (ACLs) on the switch in addition to the configuration and status. Use the summary option to display only the configuration and status, which contains details such as the name of the ACL, total rules configured, configured and active status containing interface information, and supplicant information as in the case of dynamic ACLs from dot1x sessions.

Command Mode

Privileged EXEC

Command Syntax

show access-lists[interface interface_acl] | [acl_name acl_name] acl_name | [scope summary]

Parameters

interface - Filter by interfaces such as Ethernet, VLANs, and Port Channels. Selection options include the following:
- no parameter - Display all ACLs.
- interface_acl - Display ACLs attached to the interface if present.
acl_name - Display the list name. Selection options include the following:
- no parameter - Display all ACLs.
- acl_name - Display a specific ACL.
scope - Display detailed or summarized information. Selection options include the following:
- no parameter - Display all rules in the specified lists including the configuration and status.
- summary - Display only the configuration and status of the ACL.

Examples

This command displays all rules in all the ACLs including IPv4, IPv6, and MAC and the configuration and status.

switch# show access-lists
Phone ACL bypass: disabled
IP Access List default-control-plane-acl [readonly]
        counters per-entry
        10 permit icmp any any
        20 permit ip any any tracked [match 149061 bytes in 1721 packets, 0:00:00 ago]
        30 permit udp any any eq bfd ttl eq 255
        40 permit udp any any eq bfd-echo ttl eq 254
        50 permit udp any any eq multihop-bfd micro-bfd sbfd
        60 permit udp any eq sbfd any eq sbfd-initiator
        70 permit ospf any any
        80 permit tcp any any eq ssh telnet www snmp bgp https msdp ldp netconf-ssh gnmi [match 180 bytes in 3 packets, 0:03:08 ago]
        90 permit udp any any eq bootps bootpc snmp rip ntp ldp ptp-event ptp-general [match 984 bytes in 3 packets, 1 day, 9:02:21 ago]
        100 permit tcp any any eq mlag ttl eq 255
        110 permit udp any any eq mlag ttl eq 255
        120 permit vrrp any any
        130 permit ahp any any
        140 permit pim any any
        150 permit igmp any any
        160 permit tcp any any range 5900 5910
        170 permit tcp any any range 50000 50100
        180 permit udp any any range 51000 51100
        190 permit tcp any any eq 3333
        200 permit tcp any any eq nat ttl eq 255
        210 permit tcp any eq bgp any
        220 permit rsvp any any
        230 permit tcp any any eq 9340
        240 permit tcp any any eq 9559
        250 permit udp any any eq 8503
        260 permit udp any any eq lsp-ping
        270 permit udp any eq lsp-ping any

        Total rules configured: 27
        Configured on Ingress: control-plane(default VRF)
        Active on     Ingress: control-plane(default VRF)

IP Access List v4Acl
        10 permit ip any any

        Total rules configured: 1
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1

Standard IP Access List stAcl
        10 permit any

        Total rules configured: 1

IP Access List noRulesAcl

        Total rules configured: 0
        Configured on Ingress: Et2/1
        Active on     Ingress: Et2/1

IPV6 Access List default-control-plane-acl [readonly]
        counters per-entry
        10 permit icmpv6 any any [match 335448 bytes in 4424 packets, 0:01:13 ago]
        20 permit ipv6 any any tracked
        30 permit udp any any eq bfd hop-limit eq 255
        40 permit udp any any eq bfd-echo hop-limit eq 254
        50 permit udp any any eq multihop-bfd micro-bfd sbfd
        60 permit udp any eq sbfd any eq sbfd-initiator
        70 permit ospf any any
        80 permit 51 any any
        90 permit 50 any any
        100 permit tcp any any eq ssh telnet www snmp bgp https netconf-ssh gnmi
        110 permit udp any any eq bootps bootpc snmp ntp ptp-event ptp-general
        120 permit tcp any any eq mlag hop-limit eq 255
        130 permit udp any any eq mlag hop-limit eq 255
        140 permit tcp any any range 5900 5910
        150 permit tcp any any range 50000 50100
        160 permit udp any any range 51000 51100
        170 permit udp any any eq dhcpv6-client dhcpv6-server
        180 permit tcp any eq bgp any
        190 permit tcp any any eq nat hop-limit eq 255
        200 permit udp any any eq nat hop-limit eq 255
        210 permit rsvp any any
        220 permit pim any any
        230 permit tcp any any eq 9340
        240 permit tcp any any eq 9559
        250 permit udp any any eq 8503
        260 permit udp any any eq lsp-ping
        270 permit udp any eq lsp-ping any

        Total rules configured: 27
        Configured on Ingress: control-plane(default VRF)
        Active on     Ingress: control-plane(default VRF)

IPV6 Access List v6Acl
        10 permit ipv6 3891:3c58:6300::/64 any
        20 permit ipv6 any host 2fe1:b468:24a::
        30 deny ipv6 host 3411:91c1:: host 4210:cc23:d2de::

        Total rules configured: 3
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1

MAC Access List mlist
        10 deny any any

        Total rules configured: 1
        Configured on Ingress: Et11/1
        Configured on Egress: Et11/1
        Active on     Ingress: Et11/1
        Active on     Egress: Et11/1

This command displays only the configuration and status of each ACL on the switch.

switch# show access-lists summary
Phone ACL bypass: disabled
IPV4 ACL default-control-plane-acl [readonly]
        Total rules configured: 27
        Configured on Ingress: control-plane(default VRF)
        Active on     Ingress: control-plane(default VRF)

IPV4 ACL v4Acl
        Total rules configured: 1
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1

Standard IPV4 ACL stAcl
        Total rules configured: 1

IPV4 ACL noRulesAcl
        Total rules configured: 0
        Configured on Ingress: Et2/1
        Active on     Ingress: Et2/1

IPV6 ACL default-control-plane-acl [readonly]
        Total rules configured: 27
        Configured on Ingress: control-plane(default VRF)
        Active on     Ingress: control-plane(default VRF)

IPV6 ACL v6Acl
        Total rules configured: 3
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1

MAC ACL mlist
        Total rules configured: 1
        Configured on Ingress: Et11/1
        Configured on Egress: Et11/1
        Active on     Ingress: Et11/1
        Active on     Egress: Et11/1

This command displays all rules in list2 ACL and the configuration and status.

switch# show access-list list2
IP Access List list2
        10 permit ip 10.10.10.0/24 any
        20 permit ip any host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
       
        Total rules configured: 3
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1

IPV6 Access List list2
        10 permit ipv6 3891:3c58:6300::/64 any
        20 permit ipv6 any host 2fe1:b468:24a::
        30 deny ipv6 host 3411:91c1:: host 4210:cc23:d2de::

        Total rules configured: 3
        Configured on Ingress: Et2/1
        Active on     Ingress: Et2/1
switch#

The above output displayed two ACLs as the switch had an IPv4 ACL and an IPv6 ACL with the same name.

This command displays all rules in list2 ACL on Ethernet 1/1 with the configuration and status.

switch# show access-list list2 interface Ethernet 1/1
IP Access List list2
        10 permit ip 10.10.10.0/24 any
        20 permit ip any host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
       
        Total rules configured: 3
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1
switch#

show ip access-lists

The show ip access-lists command displays the contents of IPv4 and standard IPv4 Access Control List (ACLs) on the switch with the configuration and status. Use the summary option to display only the configuration and status with details such the name of the ACL, total rules configured, configured and active status containing interface information, and supplicant information as in the case of dynamic ACLs from dot1x sessions.

Command Mode

Privileged EXEC

Command Syntax

show ip access-lists [interface interface_ipv4]|[acl_name acl_name] | [scope summary]

Parameters

interface Filter on interfaces such as Ethernet, VLANs, and Port Channels. Selection options include the following:
- no parameter - Displays all IPv4 ACLs.
- interface_ipv4 - Display the ACLs on a specified interface.

acl_name - Specify the name of a list to display. Selection options include the following:
- no parameter - Displays all IPv4 ACLs.
- acl_name - Specify an IPv4 ACL to display.

scope - Displays detailed or summarized information. Selection options include the following:
- no parameter - Display all rules in the specified lists with the configuration and status.
- summary - Display only the configuration and status.

Examples

This command displays all rules in list2 IPv4 ACL, configuration, and status.

switch# show ip access-lists list2
IP Access List list2
        10 permit ip 10.10.10.0/24 any
        20 permit ip any host 10.20.10.1
        30 deny ip host 10.10.10.1 host 10.20.10.1
Total rules configured: 3
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1
switch#

The above output can also be displayed with the help of the show ip access-lists interface Ethernet 1/1 command since the ACL list2 applies to the Ethernet 1/1 interface.

This command displays the name and number of rules in each list on the switch.

switch# show ip access-lists summary
IPV4 ACL default-control-plane-acl
        Total rules configured: 12
        Configured on: control-plane
        Active on    : control-plane

IPV4 ACL list2
        Total rules configured: 3
IPV4 ACL test1
        Total rules configured: 6
Standard IPV4 ACL test_1
        Total rules configured: 1
IPV4 ACL test_3
        Total rules configured: 0
switch#

This command displays the summary and lists all the configured IPv4 ACLs.

switch # show ip access-lists summary
IPV4 ACL default-control-plane-acl [readonly]
 Total rules configured: 17
 Configured on Ingress: control-plane(default VRF)
 Active on Ingress: control-plane(default VRF)

IPV4 ACL ipAclLimitTest
 Total rules configured: 0
 Configured on Egress: Vl2148,2700
 Active on Egress: Vl2148,2700

show ip prefix-list

The show ip prefix-list command displays all rules for the specified IPv4 prefix list. The command displays all IPv4 prefix list rules if a prefix list name is not specified.

Command Mode

EXEC

Command Syntax

show ip prefix-list [display_items list_name]

Parameters

display_items - Specifies the name of prefix lists to display rules. Options include:

no parameter - Display all IPv4 prefix list rules.
list_name Specifies the IPv4 prefix list to display rules.

Example

This command displays all rules in the route-one IPv4 prefix list.

switch(config-ip-pfx)# show ip prefix-list
ip prefix-list route-one
    seq 10 deny 10.1.1.0/24
    seq 20 deny 10.1.0.0/16
    seq 30 permit 12.15.4.9/32
    seq 40 deny 1.1.1.0/24
switch(config-ip-pfx)#

show ipv6 access-lists

The show ipv6 access-lists command displays the contents of all IPv6 Access Control Lists (ACLs) on the switch with the configuration and status. Use the summary option to display only the configuration and status with contains details such as the name of the ACL, total rules configured, configured and active on status with interface information, and supplicant information in case of dynamic ACLs from dot1x sessions.

Command Mode

Privileged EXEC

Command Syntax

show ipv6 access-lists [ interface interface_ipv6] [supplicant supplicant][acl_name acl_name][scope summary]

Parameters

interface Filter on interfaces such as Ethernet, VLANs, and Port Channels. Selection options include the following:
- no parameter - Displays all IPv6 ACLs.
- interface_ipv6 - Display the ACLs on a specified interface.

acl_name - Specify the name of a list to display. Selection options include the following:
- no parameter - Displays all IPv6 ACLs.
- acl_name - Specify an IPv6 ACL to display.

scope - Displays detailed or summarized information. Selection options include the following:
- no parameter - Display all rules in the specified lists with the configuration and status.
- summary Display only the configuration and status.

Examples

This command displays all rules in test1 IPv6 ACL.

switch# show ipv6 access-lists list2
IP Access List list2
        10 permit ipv6 3891:3c58:6300::/64 any
        20 permit ipv6 any host 2fe1:b468:024a::
        30 deny ipv6 host 3411:91c1:: host 4210:cc23:d2de:::
Total rules configured: 3
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1
switch#

The above output can also be displayed using the show ipv6 access-lists interface Ethernet 1/1 command since the ACL list2 applies to the Ethernet 1/1 interface.

This command displays the name and number of rules in each list on the switch.

switch# show ipv6 access-lists summary
IPV6 ACL list2
        Total rules configured: 3
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1

IPV6 ACL test1
        Total rules configured: 6

IPV6 ACL test_1
        Total rules configured: 1

Standard IPV6 ACL test_3
        Total rules configured: 0
switch#

show ipv6 prefix-list

The show ipv6 prefix-list command displays all rules for the specified IPv6 prefix list. The command displays all IPv6 prefix lists if a prefix list name is not specified.

Command Mode

EXEC

Command Syntax

show ipv6 prefix-list [display_items list_name]

Parameters

display_items Specifies the name of prefix lists for which rules are displayed. Options include:

no parameter All IPv6 prefix lists are displayed.
list_name Specifies the IPv6 prefix list for which rules are displayed.

Examples

This command displays all rules in the map1 IPv6 prefix list:

switch> show ipv6 prefix-list map1
ipv6 prefix-list map1
seq 10 permit 3:4e96:8ca1:33cf::/64
seq 15 deny 3:4400::/64
seq 20 permit 3:11b1:8fe4:1aac::/64
seq 30 permit 3:1bca:3ff2:634a::/64
seq 40 permit 3:1bca:1141:ab34::/64

This command displays all prefix lists:

switch> show ipv6 prefix-list
ipv6 prefix-list map1
seq 10 permit 3:4e96:8ca1:33cf::/64
seq 15 deny 3:4400::/64
seq 20 permit 3:11b1:8fe4:1aac::/64
seq 30 permit 3:1bca:3ff2:634a::/64
seq 40 permit 3:1bca:1141:ab34::/64
ipv6 prefix-list FREDD
ipv6 prefix-list route-five
ipv6 prefix-list map2
seq 10 deny 10:1:1:1::/64 ge 72 le 80
seq 20 deny 10:1::/32

show mac access-lists

The show mac access-lists command displays the contents of all MAC Access Control Lists (ACLs) on the switch, along with their configuration and status. Use the summary option to display only the configuration and status, which contain details such as the name of the ACL, the total rules configured, and where the ACL is configured/active with a status containing specific interface information.

Command Mode

Privileged EXEC

Command Syntax

show mac access-lists [interface interface_acl] [acl_name acl_name] [scope summary]

Parameters

interface - Filter by interfaces such as Ethernet, VLANs, and Port Channels. Selection options include the following:
- no parameter - Display all MAC ACLs.
- interface_acl - Display MAC ACLs attached to the interface if present.
acl_name Display the list name. Selection options include the following:
- no parameter - Display all MAC ACLs.
- acl_name - Display a specific MAC ACL.
scope - Display detailed or summarized information. Selection options include the following:
- no parameter - Display all rules in the specified lists including the configuration and status.
- summary - Display only the configuration and status of the MAC ACL.

Examples

This command displays all rules in mtest2 MAC ACL.

switch# show mac access-list mlist2
MAC Access List mlist2
        10 permit 1024.4510.F125 0.0.0 any aarp
        20 permit any 4100.4500.0000 0.FF.FFFF novell
        30 deny any any

        Total rules configured: 3
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1

The above output can also be displayed with the help of show mac access-lists interface Ethernet 1/1 command since the ACL mlist2 applies to the Ethernet 1/1 interface.

This command displays the number of rules in each MAC ACL on the switch.

switch# show mac access-list summary
MAC ACL mlist1
        Total rules configured: 6

MAC ACL mlist2
        Total rules configured: 3
        Configured on Ingress: Et1/1
        Active on     Ingress: Et1/1

MAC ACL mlist3
        Total rules configured: 1

MAC ACL mlist4
        Total rules configured: 0

show platform arad acl tcam summary

The show platform arad tcam summary command displays the percentage of TCAM utilization per forwarding ASIC.

Command Mode

EXEC

Command Syntax

show platform arad acl tcam summary

Parameter

summary - Displays the ACL TCAM summary.

Example

This command displays the percentage of TCAM utilization per forwarding ASIC.

switch# show platform arad acl tcam summary
The total number of TCAM lines per bank is 1024.

========================================================
Arad3/0:
========================================================
 Bank      Used           Used %                 Used By
    1         4                0                IP RACLs
Total Number of TCAM lines used is: 4

========================================================
Arad3/4:
========================================================
 Bank      Used           Used %                 Used By
    1         2                0                IP RACLs
Total Number of TCAM lines used is: 2

show platform arad acl tcam

The show platform arad acl tcam command displays the number of TCAM entries (hardware resources) occupied by the ACL on each forwarding ASIC.

This command applies only to DCS-7500E, DCS-7280E series switches.

Command Mode

EXEC

Command Syntax

show platform arad acl tcam [scope [detail | diff | hw | shadow | summary]

Parameters

scope Specifies the information displayed. Options include:

detail - Displays the ACL TCAM details.
diff - Displays the difference between hardware and shadow.
hw - Displays the ACL entries from hardware.
shadow - Displays the ACL entries from shadow.
summary - Displays the ACL TCAM summary.

Examples

This command displays the number of TCAM entries used by Arad0 ASIC. In this example, apply the ACL on two VLANs (Vl2148 and Vl2700) but number of TCAM entries occupied is only one.

switch# show platform arad acl tcam detail
ip access-list ipAclLimitTest (Shared RACL, 0 rules, 1 entries, direction out, 
state success, Acl Label 2)
Fap: Arad0, Shared: true, Interfaces: Vl2148, Vl2700
Bank Offset Entries
0         0       1
Fap: Arad1, Shared: true, Interfaces: Vl2148
Bank Offset Entries
0         0       1

This command displays the percentage of TCAM utilization per forwarding ASIC.

switch# show platform arad acl tcam summary
The total number of TCAM lines per bank is 1024.
========================================================
Arad0:
========================================================
 Bank   Used                  Used %             Used By
    0      1                       0   IP Egress PACLs/RACLs
Total Number of TCAM lines used is: 1
========================================================
Arad1:
========================================================
 Bank   Used                   Used %            Used By
    0      1                        0   IP Egress PACLs/RACLs
Total Number of TCAM lines used is: 1

show platform arad mapping

The show platform arad mapping command displays the mapping between the interfaces and the forwarding ASICs.

Command Mode

EXEC

Command Syntax

show platform arad chip_name mapping

Parameter

chip_name Specifies the Arad chip name.

Example

This command displays the mapping between the interfaces and the forwarding ASICs on the Arad3/0 chip.

switch# show platform arad arad3/0 mapping
Arad3/0  Port                      SysPhyPort    Voq   ( Fap,FapPort)    Xlge     Serdes
-------------------------------------------------------------------------------
         Ethernet3/1/1                     34    288        (0  ,  2)     n/a        (20)
...............................................................................

show platform fap acl

The show platform fap acl command displays the ACL information of Sand platform devices.

Command Mode

Privileged EXEC

Command Syntax

Parameters

ipkgv - Displays the ACL Ingress Interface Specification (IPKGV) information.
l4ops - Displays the ACL Layer 4 Options (L4OPS) information.
mirroring - Displays the mirroring ACL information.
opkgv - Displays the ACL Egress Interface Specification (OPKGV) information.
pmf - Displays the Pmf.
tcam - Displays the ACL TCAM information.
udf - Displays the ACL UDF information.
vsicfg - Displays the ACL Virtual Switch Instance (VSI) CONFIG information.

Guidelines

Supported on DCS-7280SE and DCS-7500E series platforms only.

Example

This command displays the brief information of all installed mirroring ACLs.

switch(config)# show platform fap acl mirroring

==============
 Aggregate ACLs
==============

 (list2:0->2) type=2; version=0
  - list2 [ prio 0 ] => session 2

 (list1:10->1,list3:20->3) type=0; version=13
  - list3 [ prio 20 ] => session 3
  - list1 [ prio 10 ] => session 1

======================
 Interface-ACL Mapping
======================

  Ethernet1 => (list1:10->1,list3:20->3) [ ipv4 ]
  Ethernet33 => (list2:0->2) [ mac ]

show platform fap acl tcam

The show platform fap tcam command displays the number of TCAM entries (hardware resources) occupied by the ACL on each forwarding ASIC of Sand platform devices.

Command Mode

Privileged EXEC

Command Syntax

show platform fap acl tcam [detail | diff | hw | shadow | summary]

Parameter

detail - Displays the number of TCAM entries (hardware resources) occupied by the ACL on each forwarding ASIC.
diff - Displays the difference between hardware and shadow.
hw - Displays ACL entries from hardware.
shadow - Displays ACL entries from shadow.
summary - Displays the percentage of TCAM utilization per forwarding ASIC.

Example

This command displays the number of TCAM entries and other ACL TCAM detail.

switch# show platform fap acl tcam detail
ip access-list ipAcl0000 (RACL, 1 rules, 2 entries, direction in, state success)
 Shared: false
 Interface: Vlan0002
 -------------------
 Fap: Arad3/0
 Bank Offset Entries
 1         0       2
 Interface: Vlan0003
 -------------------
 Fap: Arad3/0
 Bank Offset Entries
 1         2       2
 Fap: Arad3/4
 Bank Offset Entries
 1         0       2

show platform fap acl tcam hw

The show platform fap acl tcam hw command displays the TCAM entries configured for each TCAM bank including policy-maps and corresponding traffic match.

This command applies only to DCS-7280(E/R), DCS-7500(E/R) series switches.

Command Mode

EXEC

Command Syntax

show platform fap fap_name acl tcam hw

Parameters

fap_name - Specifies the switch chip-set name.

Example

This command displays the TCAM entries configured for each TCAM bank including policy maps and corresponding traffic matches.

switch# show platform fap Arad1 acl tcam hw 
================================================================================
Arad1 Bank 0 Type: dbPdpIp, dbPdpIp6, dbPdpMpls, dbPdpNonIp, dbPdpTunnel
================================================================================
----------------------------------------------------
|Offs|X|PR|TT|R|QI|V6MC|DPRT|SPRT|F|DEST |V|ACT  |H|
----------------------------------------------------
|29  |4|59|  | |01|    |    |    | |     |3|0008f|0|
|    |4|59|  | |01|    |    |    | |     |0|00000|0|
|30  |4|33|  | |01|    |    |    | |     |3|0008f|0|
|    |4|33|  | |01|    |    |    | |     |0|00000|0|
|31  |4|32|  | |01|    |    |    | |     |3|0008f|0| 
|    |4|32|  | |01|    |    |    | |     |0|00000|0|
|32  |4|  |  | |01|ff02|    |    | |     |3|00097|0|
|    |4|  |  | |01|ff02|    |    | |     |0|00000|0|
|33  |4|06|  | |01|    |    |00b3| |26ffd|3|0009b|0|
|    |4|06|  | |01|    |    |00b3| |26ffd|0|00000|0|
|34  |4|06|  | |01|    |00b3|    | |26ffd|3|0009b|0|
----------------------------------------------
|Offs|X|R|QI|DAHI|PT|DALO    |DEST |V|ACT  |H|
----------------------------------------------
-----------------------------------------------------------------------------
|Offs|X|TT0|QI|FOI|TT1|DEST |TT1P |PT|VX_DP|PN|F|MC|O|V|HDR OFFSETS |ACT  |H|
================================================================================
Arad1 Bank 1 Type: dbIpQos
================================================================================
----------------------------------------------------------------------
|Offs|X|TC|CL|DPRT|SPRT|VQ|L4OPS |PP|PR|F|V4_DIP  |V4_SIP  |V|ACT  |H|
----------------------------------------------------------------------
|0   |0|  |  |    |    |  |      |01|  | |        |        |3|00000|0|
|    |0|  |  |    |    |  |      |01|  | |        |        |0|00000|0|
----------------------------------------------------------------------
<-------OUTPUT OMITTED FROM EXAMPLE-------->

show platform fap acl tcam summary

The show platform fap acl tcam summary command displays for each forwarding ASIC, the number of TCAM entries consumed per ACL type, and in which TCAM bank the entries are installed. A mirroring ACL does not consume TCAM resources unless attached to a mirroring source interface, and a mirroring destination is configured. If the mirroring destination is a GRE tunnel, at least one nexthop entry for the tunnel destination must be resolved before a TCAM entry is installed.

Command Mode

EXEC

Command Syntax

show platform fap acl tcam summary

Example

This command displays the number of TCAM entries consumed per ACL type, the bank installed, and ASIC. Three TCAM entries are consumed across two forwarding ASICs, two for IP ACLs, and one for MAC ACLs.

switch# show platform fap acl tcam summary
========================================================
 Arad0:
========================================================
    Bank   Used Used %    Used By
    0, 1      2      0    IP Mirroring
 Total Number of TCAM lines used is: 4
========================================================
 Arad1:
========================================================
   Bank   Used            Used %                 Used By
      2      1                 0           Mac Mirroring

show platform trident tcam

The show platform trident tcam command displays the TCAM entries configured for each TCAM group including policy maps and corresponding hits.

Command Mode

EXEC

Command Syntax

Parameters

no parameters - Displays TCAM entries for each TCAM group.
acl - Displays the trident ACL information.
cpu-bound - Displays the trident cpu-bound information.
detail - Lists all TCAM entries.
directed-broadcast - Allows inbound broadcast IP packets with Source IP address as one of the permitted broadcast host.
entry - Displays the TCAM entry information.
mirror - Displays the trident Mirroring ACL information.
pbr - Displays the trident PBR ACL information.
pipe - Allows to specify a pipe for filtering.
qos - Displays the trident QOS information.
shared - Displays the ACL Sharing information.
summary - Displays the TCAM allocation information.

Guidelines

Applies only to DCS-7010, DCS-7050/DCS-7050X, DCS7250X, DCS-7300X series switches.

Examples

This command displays the Trident mirroring ACL information.

switch(config)# show platform trident tcam mirror
=== Mirroring ACLs on switch Linecard0/0 ===

Session: mir-sess2

INGRESS ACL mirAcl2* uses 2 entries
 Assigned to ports: Ethernet32/1

This command displays the allowed IP Destination address from the in coming packets.

switch# show platform trident tcam directed-broadcast
DirectedBroadcast Feature Tuples.
Src Ip          Dst Ip          Action          Hits
--------------- --------------- ------- ------------
10.1.1.1        192.164.2.15    Permit             0
20.1.1.1        192.164.2.15    Permit             0
30.1.1.1        192.164.2.15    Permit             0
10.1.1.1        192.166.2.15    Permit             0
20.1.1.1        192.166.2.15    Permit             0
30.1.1.1        192.166.2.15    Permit             0
10.1.1.1        192.168.2.255   Permit             0
20.1.1.1        192.168.2.255   Permit             0
30.1.1.1        192.168.2.255   Permit             0
*               192.164.2.15    Deny               0
*               192.166.2.15    Deny               0
*               192.168.2.255   Deny               0

This command displays detailed information for the TCAM group.

switch# show platform trident tcam detail
=== TCAM detail for switch Linecard0/0 ===
TCAM group 9 uses 42 entries and can use up to 1238 more.
 Mlag control traffic uses 4 entries.
    589826                0 hits - MLAG - SrcPort UDP Entry
    589827                0 hits - MLAG - DstPort UDP Entry
    589828                0 hits - MLAG - SrcPort TCP Entry
    589829                0 hits - MLAG - DstPort TCP Entry
 CVX traffic reserves 6 entries (0 used).
 L3 Control Priority uses 23 entries.
    589836                0 hits - URM - SelfIp UDP Entry
    589837                0 hits - URM - SelfIp TCP Entry
589848                0 hits - OSPF - unicast
    589849            71196 hits - OSPFv2 - Multicast
    589850                0 hits - OSPFv3 - Multicast
    589851                0 hits - OSPF Auth ESP - Multicast
    589852                0 hits - OSPF Auth ESP - Unicast
    589853                0 hits - IP packets with GRE type and ISIS protocol
    589854                0 hits - RouterL3 Vlan Priority 6,7 Elevator
    589855                0 hits - RouterL3 DSCP 48-63 Elevator
    589856                0 hits - RouterL3 Priority Elevator
    589857                0 hits - NextHopToCpu, Glean
    589858                0 hits - L3MC Cpu OIF
 IGMP Snooping Flooding reserves 8 entries (6 used).
589864                0 hits - IGMP Snooping Restricted Flooding L3 from local 
mlag peer
    589865                0 hits - IGMP Snooping Restricted Flooding L3
 L4 MicroBfd traffic reserves 1 entries (0 used).
TCAM group 13 uses 99 entries and can use up to 1181 more.
 Dot1x MAB traffic uses 1 entries.
    851968                0 hits - Dot1xMab Rule

<-------OUTPUT OMITTED FROM EXAMPLE-------->

ck338.22:14:38(config-pmap-qos-policy1)#

show route-map

The show route-map command displays the contents of configured route maps.

Command Mode

EXEC

Command Syntax

show route-map [map_name]

Parameters

no parameter Displays the content of all configured route maps.
map_name Displays the content of the specified route map.

Examples

This command displays the map1 route map.

switch(config)# show route-map map1
route-map map1 permit 10
  Description:
  Match clauses:
  SubRouteMap:
  Set clauses:
    set as-path prepend last-as 12
    set as-path prepend auto auto

This command displays the map route map.

switch> show route-map map
route-map map permit 5
  Match clauses:
    match as 456
Set clauses:
route-map map permit 10
  Match clauses:
match ip next-hop 2.3.4.5
    match as-path path_2
  Set clauses:
    set local-preference 100

system profile

The system profile command creates a new Ternary Content-Addressable Memory (TCAM) profile in the running configuration.

The default system profile and no system profile commands delete non-default TCAM profiles from the running configuration.

Command Mode

Hardware TCAM

Command Syntax

default system profile

no system profile

Parameters

profile_name - Creates a profile with the specified name.
default - Creates a default profile.
mirroring-acl - Creates a mirroring-ACL profile.
pbr-match-nexthop-group - Creates a pbr-match-nexthop-group profile.
qos - Creates a Quality of Service (QoS) profile.
tap-aggregation-default - Creates a tap-aggregation-default profile.
tap-aggregation-extended - Creates a tap-aggregation-extended profile.
tc-counters - Creates a tc-counters profile.

Guideline

Compatible with the DCS-7280SE and DCS-7500E series switches only.

Examples

These commands create a mirroring-ACL profile.

switch(config)# hardware tcam
switch(config-hw-tcam)# system profile mirroring-acl
switch(config-hw-tcam)# show hardware tcam profile
                     Configuration        Status
FixedSystem          mirroring-acl        mirroring-acl
switch(config-hw-tcam)#

These commands delete non-default TCAM profiles.

switch(config)# hardware tcam
switch(config-hw-tcam)#show hardware tcam profile
                     Configuration        Status
Linecard9            mirroring-acl        mirroring-acl
Linecard8            mirroring-acl        mirroring-acl
Linecard3            mirroring-acl        mirroring-acl
Linecard4            mirroring-acl        mirroring-acl
Linecard6            mirroring-acl        mirroring-acl
switch(config-hw-tcam)# default system profile
switch(config-hw-tcam)# show hardware tcam profile
                     Configuration        Status
Linecard9            default              default
Linecard8            default              default
Linecard3            default              default
Linecard4            default              default
Linecard6            default              default
switch(config-hw-tcam)#

These commands delete TCAM profiles.

switch(config-hw-tcam)# show hardware tcam profile
                     Configuration        Status
Linecard9            tc-counters          tc-counters
Linecard8            tc-counters          tc-counters
Linecard3            tc-counters          tc-counters
Linecard4            tc-counters          tc-counters
Linecard6            tc-counters          tc-counters
switch(config-hw-tcam)# no system profile
switch(config-hw-tcam)# show hardware tcam profile
                     Configuration        Status
Linecard9            default              default
Linecard8            default              default
Linecard3            default              default
Linecard4            default              default
Linecard6            default              default
switch(config-hw-tcam)#

DirectFlow

This section describes Arista's DirectFlow implementation. Topics in this section include:

Introduction
DirectFlow Configuration
DirectFlow Feature Interactions
DirectFlow Commands

Introduction

DirectFlow allows you to define flows consisting of conditions to match, and actions to perform, that are a superset of the OpenFlow 1.0 specification. DirectFlow runs alongside the existing L2/L3 forwarding plane, enabling a network architecture that incorporates new capabilities such as TAP aggregation and custom traffic engineering, alongside traditional forwarding models. DirectFlow does not require a controller or any third party integration, as flows can be installed via the CLI.

DirectFlow exposes the underlying forwarding ASIC's capabilities through a programmable interface like EAPI or the standard CLI.

DirectFlow works in conjunction with all other aspects of standard Layer 2 or Layer 3 bridging or forwarding, and DirectFlow traffic is subject to the standard packet processing pipeline within the ASIC. You can think of DirectFlow as a stage in packet processing that processes traffic after ingress checks and before any egress actions.

DirectFlow enables you to configure flows that consist of matching criteria and actions, and to modify how traffic is processed, by overriding the L2 lookup decision or rewriting a MAC address or VLAN for example.

Features like MAC learning, STP state checks, ingress or egress VLAN membership checks on ports, ACLs, QoS, and others are all respected by DirectFlow. Traffic that does not match any programmed flow is processed normally, while traffic that matches programmed flows is now subject to the actions specified in the flows.

DirectFlow Flows

You can define a relative priority between flows and define idle or hard timeouts for the flow. DirectFlow also enables you to insert a flow entry that matches on specified criteria, and define actions to be taken on traffic that matches the specified matching conditions. You can define flows to match on TCP flags, IPv6 source and destination addresses, input ports, and more.

For more information, see:

DirectFlow Non-persistent Flows
Supported Matches
Supported Actions

DirectFlow Non-persistent Flows

DirectFlow enables you to configure flows that are not visible in the startup or running configurations and do not persist over a reboot. This feature is designed to be used for flows that are configured by a custom agent using the EOS SDK or eAPI and age out (expire) after a specified time period.

For example, if you are using a custom agent that reacts to traffic sent to the CPU (the redirect to CPU action), and you want to use a flow that will drop all matching traffic for 5 minutes, the agent can program a non-persistent flow that expires after a hard timeout of 300 seconds.

Using a non-persistent flow for this purpose ensures that other administrator actions (for example, saving the configuration) do not result in the flow being resurrected on startup or reverting to the saved configuration. It also removes the need for the agent to delete the expired flow.

Note: By default, all DirectFlow flows are persistent. You must use the no persistent command to configure a non-persistent flow.

Supported Matches

DirectFlow supports all matches on VLAN, ether type, source or destination MAC address, COS, source or destination IP address, IP protocol, IP TOS, L4 source, destination ports, ICMP type, and code.

In addition, DirectFlow also allows matching on:

TCP flags
IPv6 source address
IPv6 destination address
Traffic injected from the CPU
Input port

DirectFlow also permits re-using the same flow on multiple input ports, saving valuable TCAM space.

Supported Actions

DirectFlow supports the following actions:

Setting the source or destination MAC address
VLAN
COS
IP TOS
Transmit queue
Output port list and mirroring traffic pre-modification (ingress mirror) and post-modification (egress mirror)
Redirect to CPU

The redirect to CPU action is useful in cases in which a custom agent is running on EOS and you want to trap specific traffic (matching traffic) and send the trapped traffic to the agent.

DirectFlow Configuration

Consider the following when using DirectFlow.

DirectFlow takes effect ONLY after exiting the individual flow configuration sub-mode.
Match criteria are connected with Boolean AND operators. Therefore they must all match for the condition to be true and action to be taken.
CLI is automatically set to match the ethertype to IP if IP fields (such as source or destination address or L4 ports) are chosen as part of other match/ action commands.
In a single flow, only the following fields can be matched along with IPv4 or IPv6 source and destination addresses:
- VLAN priority
- VLAN ID
- EtherType
- Source interface
- Class of Service (CoS)

Commands Used to Enable DirectFlow, Configure and Display Flows

A number of different commands are provided for the DirectFlow feature. The different commands enable you to enter the DirectFlow configuration mode, enable DirectFlow, configure flows, and display configured flows.

Note: ALL match criteria specified in a flow definition must match in the packet for the actions specified to be applied to the traffic.

Enter the DirectFlow Configuration Mode

The directflow command places the switch in DirectFlow configuration mode.

switch(config)# directflow
switch(config-directflow)#

Enable DirectFlow

The shutdown (DirectFlow) command determines if the configuration takes effect or not. To enable DirectFlow, enter the following command.

switch(config-directflow)# no shutdown

Create the Flow

The flow (DirectFlow) command creates a new flow entry. It must be unique or it will be overwritten by an existing entry.

switch(config-directflow)# flow Test-1
switch(config-directflow-Test-1)#

Create the DirectFlow Match Criteria

The match (DirectFlow-flow mode) command allows you to configure a rule or a flow which match on L2, L3, L4 fields of a packet and specify a certain action to either modify, drop or redirect the packet.

switch(config-directflow-Test-1)# match ethertype ip
switch(config-directflow-Test-1)# match source ip 10.10.10.10

Action Set

The action set (DirectFlow-flow mode) command allows you to configure a packet to be routed out a layer three interface using a DirectFlow entry.

switch(config-directflow-Test-1)# action egress mirror ethernet 7
switch(config-directflow-Test-1)# action set destination mac 0000.aaaa.bbbb

Finalize the Flow

DirectFlow flows do not take effect until you exit the configuration sub-mode for the specified flow. Use the exit command to finalize the flow and put it into effect.

switch(config-directflow-Test-1)# exit
switch(config-directflow)#

Redirect to CPU

The action output interface cpu (DirectFlow-flow mode) command allows you to configure flows so that traffic that matches the matching conditions specified in the flow is redirected to the CPU.

switch(config)# directflow
switch(config-directflow)# flow redirect-http-cpu
switch(config-directflow-redirect-http=cpu)# match ip protocol tcp
switch(config-directflow-redirect-http-cpu)# match destination port 80
switch(config-directflow-redirect-http-cpu)# action output interface cpu

Configuring a Non-persistent Flow

DirectFlow flows are persistent by default. Use the no persistent command to configure non-persistent flows.

switch config)# directflow
switch(config-directflow)# flow example-non-persistent
switch(config-directflow-example-non-persistent)# match input interface ethernet 25
switch(config-directflow-example-non-persistent)# action drop
switch(config-directflow-example-non-persistent)# no persistent 
switch(config-directflow-example-non-persistent)# timeout hard 300

Display Details for Configured Flows

The detail option of the show directflow flows command enables you to display the details of configured flows. You can use this command to verify that a non-persistent flow is deleted after the timeout period configured for the flow has elapsed.

The following example shows the use of this command to view the configuration of a non-persistent flow before the timeout period has elapsed, and a second time, after the timeout period has expired.

The initial use of the command displays the flow configuration (before the timeout expires).

switch(config-directflow)# show directflow flows example-non-persistent detail 
Flow example-non-persistent: (Flow programmed)
 persistent: False
 priority: 0
 hard timeout: 300
 idle timeout: 0
 match:
  ingress interface: 
      Et25
 actions:
  drop
 matched: 0 packets, 0 bytes

The second use of the command displays the flow details (after the timeout expires). The output shows that the flow is no longer programmed.

switch(config-directflow)# show directflow flows example-non-persistent detail
Flow example-non-persistent: (Flow not programmed)
persistent: False
priority: 0
hard timeout: 300
idle timeout: 0
match:
  ingress interface: 
      Et25
actions:
  drop
matched: 0 packets, 0 bytes

DirectFlow Feature Interactions

DirectFlow flow entries can have one of the following actions:

A set of egress ports for sending a matched packet
Copy to CPU
Redirect to CPU
Drop
No specified action (in this case, the traffic is output normally).

The only exception is the ingress or egress mirroring action, where the DirectFlow entry causes the packet to be mirrored.

When the ingress or egress packets are mirrored, the original traffic is sent out normally.

Bridging Features

DirectFlow entries have precedence over all entries in the MAC table, including static MAC entries and static MAC drop entries. Packets that do not match DirectFlow entries are forwarded based on the MAC address table.
VLANs: DirectFlow entries can modify the VLAN of a packet. MAC learning takes place in the original VLAN for DirectFlow entries that modify the VLAN. The modified packet will be subject to VLAN membership checks on the egress port. If a packet has no VLAN tag, DirectFlow assumes it came in on the native VLAN for the ingress interface. A VLAN override causes the packet to obey the VLAN rules on the egress port.
Q-in-Q: Q-in-Q is supported as DirectFlow entries match only on the outer tag.
Counters: All packets that match DirectFlow entries cause interface counters to increment as usual.

Spanning Tree

DirectFlow runs alongside MSTP, RSTP, and PVST. DirectFlow entries do not match on packets that ingress an STP discarding port. DirectFlow entries that cause a packet to be forwarded out an STP discarding port will result in the packets being dropped on egress.

When STP is enabled, BPDUs will always be trapped to the CPU. When STP is disabled, BPDUs will be subject to DirectFlow entries and not be copied to the CPU by default.

LLDP, LAGs, and LACP

LLDP packets are always trapped to the CPU. DirectFlow entries can never match LLDP packets.
LAGs are fully supported, and can be part of a match criteria and part of an output action to an interface.
LACP packets are always trapped to CPU. DirectFlow entries can never match LACP packets.

sFlow

sFlow is unaffected by DirectFlow.

IGMP Snooping

IGMP control packets are trapped to the CPU when IGMP Snooping is enabled. DirectFlow entries can match IGMP Snooping control traffic and override the trap to CPU.

Link-local-multicast packets are flooded in hardware in the VLAN via a TCAM entry. DirectFlow entries can match link-local-multicast packets and change the flooding behavior. As DirectFlow entries have to specify output interfaces or drop, the action will conflict and so matching DirectFlow entries will get precedence.

When IGMP snooping is enabled, unknown IPV4 multicast packets are flooded to the multicast-router ports in the VLAN. If DirectFlow entries match unknown IPV4 multicast packets, they will override the flooding behavior.

Data packets in groups under IGMP snooping control are sent to the group members through a MAC table entry. Matching DirectFlow entries override the MAC table entries.

ACLs

DirectFlow entries are lower priority than any configured Port ACLs (ingress). Packets coming in on a port that match DirectFlow entries obey any configured ACL on that port, and will only apply to packets that have a permit action.

DirectFlow entries are higher priority than any configured RACLs. Packets coming in on an L3 interface that match DirectFlow entries ignore any RACLs configured on that interface.

DirectFlow entries are lower priority than any configured Egress ACLs.

Layer Three Features and DirectFlow

DirectFlow runs alongside IP routing. If a packet is routed out a layer three interface using a DirectFlow entry, the actions associated with the entry will have to specify the new source MAC and destination MAC for the packet, as well as the physical port or LAG. If there are no output ports specified in an entry, packets that match that entry will be dropped.

Unicast Routing

When unicast routing is enabled, DirectFlow entries that match take precedence for all packets that would have been otherwise been routed. The three exceptions are the ingress mirror, egress mirror and copy-to-CPU actions where the packets will be routed normally in addition to the action being performed. Routed packets that do not match DirectFlow entries are forwarding based on the L3 lookup.

Multicast Routing

When multicast routing is enabled, DirectFlow entries that match take precedence for all packets that would have otherwise been multicast routed. The packets are not replicated based on the hardware multicast tables, but are forwarded strictly according to the actions specified by the DirectFlow entry. The entry can specify a set of output interfaces, which will result in the packet being replicated based on the DirectFlow entry.

Displaying DirectFlow Configurations

The show directflow flows command displays the contents of the flow table, showing each entry with its match rules, actions, and packet counters.

This example shows the status of a default (persistent) flow.

switch(config-directflow)# show directflow flows
Flow Test1:
priority: 0
match:
ingress interface: Ethernet1
   ethertype ip 
source ip address: 10.10.10.10
actions:
output mirror: Ethernet2 
matched: 0 packets, 0 bytes
switch(config-directflow)#

This example shows the status of a non-persistent flow. The flow will be deleted once 5 minutes have elapsed.

switch(config-directflow)# show directflow flows example-non-persistent 
Flow example-non-persistent:
 persistent: False
 priority: 0
 hard timeout: 300
 idle timeout: 0
 match:
   ingress interface: 
       Et25
 actions:
   drop
 matched: 0 packets, 0 bytes

DirectFlow Commands

DirectFlow Global Configuration Mode

directflow

DirectFlow Configuration Commands

action drop (DirectFlow-flow mode)
action mirror (DirectFlow-flow mode)
action output (DirectFlow-flow mode)
action output interface cpu (DirectFlow-flow mode)
action set (DirectFlow-flow mode)
flow (DirectFlow)
match (DirectFlow-flow mode)
persistent
priority (DirectFlow-flow mode)
shutdown (DirectFlow)
timeout (DirectFlow-flow mode)

DirectFlow and Clear Commands

show directflow
show directflow flows

action drop (DirectFlow-flow mode)

The action drop command configures packets that match an entry to be dropped.

The no action drop and default action drop commands remove the statement from the DirectFlow configuration mode.

Command Mode

Directflow-flow Configuration

Command Syntax

action drop

no action drop

default action drop

Example

This command sets the action for packets from Test-1 to be dropped.

switch(config-directflow-Test-1)# action drop
switch#

action mirror (DirectFlow-flow mode)

The action mirror command can be used to ingress or egress mirror traffic to a mirror destination. This requires a mirror destination to be setup on the switch. If a packet comes in or goes out an interface that is part of another mirror session, then the destination for that destination as well as the DirectFlow destination will receive a copy of the packet.

The no action mirror and default action mirror commands remove the statement from DirectFlow configuration mode.

Command Mode

Directflow-flow Configuration

Command Syntax

action DIRECTION mirror INT_NAME

no action DIRECTION mirrorINT_NAME

default action DIRECTION mirror INT_NAME

Parameters

DIRECTION transmission direction of traffic to be mirrored.
- ingress mirrors before any rewrites.
- egress mirrors after rewrites.
INT_NAME Source interface for the mirroring session.
- ethernet e_range Ethernet interfaces specified by e_range.
- port-channel p_range Port channel interfaces specified by p_range.

Example

This command configures mirror traffic to ethernet 2.

switch(config-directflow)# flow Test1
switch(config-directflow-Test1)# match ethertype ip
switch(config-directflow-Test1)# match source ip 10.10.10.10
switch(config-directflow-Test1)# action egress mirror ethernet 2
switch(config-directflow-Test1)#

action output (DirectFlow-flow mode)

The action output command configures an Ethernet or port channel interface as the output of a specified port mirroring session.

The no action output and default action outputcommands remove the statement from DirectFlow configuration mode.

Command Mode

Directflow-flow Configuration

Command Syntax

action output DESTINATION

no action output DESTINATION

default action output DESTINATION

Parameters

DESTINATION transmission direction of traffic to be mirrored.

all mirrors transmitted and received traffic.
flood mirrors received traffic only.
interface ethernet e_range Ethernet interfaces specified by e_range.
interface port-channel p_range Port channel interfaces specified by p_range.
nexthop vrf vrf_name ip_addr. If the next hop is reachable in the default VRF, the default VRF does not need to be specified.

Examples

This command configures interface ethernet 7 as the output for the mirroring session.

switch(config-directflow-Test1)# action output interface ethernet 7
switch(config-directflow-Test1)#

The following commands configure a flow redirecting all traffic from 10.10.1.2 to e_range next hop assuming an appropriately configured TCAM profile.

switch(config-directflow)# flow flow-sip-10_10_1_2-redirect-to-10_30_1_2
switch(config-directflow-Test1)# match ethertype ip
switch(config-directflow-Test1)# match source ip 10.10.1.2
switch(config-directflow-Test1)# action output nexthop 10.30.1.2
switch(config-directflow-Test1)#

action output interface cpu (DirectFlow-flow mode)

The action output interface cpu command configures the action (other commands are used to define the traffic matching conditions).

The no action output interface cpu and default action output commands remove the statement from DirectFlow configuration mode.

Command Mode

Directflow-flow Configuration

Command Syntax

action output DESTINATION

no action output DESTINATION

default action output DESTINATION

Parameters

DESTINATION transmission direction of traffic to be mirrored.

all mirrors transmitted and received traffic.
flood mirrors received traffic only.
interface cpu Ethernet interfaces specified by e_range.

Examples

This command configures interface ethernet 7 as the output for the mirroring session.

switch(config-directflow-Test1)# action output interface ethernet 7 
switch(config-directflow-Test1)#

These commands configure the action to redirect traffic matching the flow to the CPU and the matching conditions for the flow.

switch (config)# directflow
switch(config-directflow)# flow redirect-http-cpu
switch(config-directflow-redirect-http=cpu)# match ip protocol tcp
switch{config-directflow-redirect-http-cpu)# match destination p cpuort 80
switch(config-directflow-redirect-http-cpu)# action output interface

action set (DirectFlow-flow mode)

The action set command allows you to configure a packet to be routed out a layer three interface using a DirectFlow entry. The actions associated with the entry will have to specify the new source MAC and destination MAC for the packet, as well as the physical port or LAG. If there are no output ports specified in an entry, packets that match that entry will be dropped.

The no action set and default action set commands remove action set statement from DirectFlow configuration mode.

Command Mode

Directflow-flow Configuration

Command Syntax

action set CONDITION

no action set CONDITION

default action set CONDITION

Parameters

CONDITION specifies parameter and value. Options include:

cos 0 to 7 Cost of service.
destination mac mac_addr Dotted hex notation.
ip tos 0 to 255 Type of service.
source mac mac_addr Dotted hex notation.
traffic-class 0 to 7 Dotted hex notation.
vlan 0 to 4094 Number of VLAN.

The no action set and default action set commands require only the CONDITION type without a specific condition value.

Example

These commands change the destination MAC of the frame.

switch(config-directflow)# flow Test1
switch(config-directflow-Test1)# action egress mirror ethernet 7
switch(config-directflow-Test1)# action set destination mac 0000.aaaa.bbbb

directflow

The directflow command places the switch in DirectFlow configuration mode.

The no directflow and default directflow commands delete the DirectFlow configuration mode statements from running-config.

DirectFlow configuration mode is not a group change mode; running-config is changed immediately upon entering commands. The exit command returns the switch to global configuration mode.

Command Mode

Global Configuration

Command Syntax

directflow

no directflow

default directflow

Commands Available in DirectFlow-Flow configuration mode:

flow (DirectFlow)
shutdown (DirectFlow)

Examples

This command places the switch in DirectFlow configuration mode.
```
switch(config)# directflow
switch(config-directflow)#
```
This command returns the switch to global management mode.
```
switch(config-directflow)# exit
switch(config)#
```

flow (DirectFlow)

The flow command places the switch in flow configuration mode.

The flow command specifies the name of the flow that subsequent commands modify and creates a newflow definition if it references a nonexistent flow. All changes in a flow configuration mode edit session are pending until the session ends:

The exit command saves pending changes to running-config and returns the switch to DirectFlow configuration mode. Changes are also saved by entering a different configuration mode.
The abort command discards pending changes, returning the switch to DirectFlow configuration mode.

The no flow and default flow commands delete the specified role by removing the role and its statements from running-config.

Command Mode

DirectFlow Configuration

Command Syntax

flow flow_name

no flow flow_name

default flow flow_name

Parameter

flow_name Name of flow.

Commands Available in DirectFlow-Flow configuration mode:

action drop (DirectFlow-flow mode)
action mirror (DirectFlow-flow mode)
action output (DirectFlow-flow mode)
action set (DirectFlow-flow mode)
match (DirectFlow-flow mode)

match (DirectFlow-flow mode)

The match command allows you to configure a rule or a flow which could match on L2, L3, L4 fields of a packet and specify a certain action to modify, drop or redirect the packet.

All traffic ingressing on the switch will be matched against the flows installed. In cases where none of the packets match, normal switching or routing behavior will take over. When multiple entries match a packet, precedence is given to the entry that was installed first.

The no match and default match commands remove the match statement from the configuration mode.

Command Mode

Directflow-flow Configuration

Command Syntax

match CONDITION

no match CONDITION

default match CONDITION

Parameters

CONDITION specifies criteria for evaluating a route. Options include:

cos 0 to 7 cost of service.
destination ip ipv4_sub destination IPv4 subnet. L3 fields valid only if ethertype is IP (0x0800).
destination mac mac_addr Add to the existing community. Dotted hex notation.
destination mac mac_addr mask mac_mask Add to the sting community. Dotted hex notation.
destination port 0 to 65535 Fields accepted only if protocol is TCP|UDP.
ethertype 0 to 65535 Layer 4 destination port.
ethertype ARP Layer 4 destination port.
ethertype IP Layer 4 destination port.
icmp code 0 to 255 Fields accepted only if protocol is ICMP.
icmp type 0 to 255 Fields accepted only if protocol is ICMP.
input interface ethernet e_num Ethernet interface specified by e_num.
input interface port-channel p_num Port channel interface specified by p_num.
ip protocol 0 to 255 Type of service.
ip protocol icmp L3 fields valid only if ethertype is IP (0x0800).
ip protocol tcp L3 fields valid only if ethertype is IP (0x0800).
ip protocol udp L3 fields valid only if ethertype is IP (0x0800).
ip tos 0 to 255 L3 fields valid only if ethertype is IP (0x0800).
source ip ipv4_subnet L3 fields valid only if ethertype is IP (0x0800).
source mac mac_addr Add to the existing community. Dotted hex notation.
source mac mac_addr mask mac_mask Add to the sting community. Dotted hex notation.
source port 0 to 65535 Fields accepted only if protocol is TCP| UDP.
tcp flag ack Layer 4 destination port.
tcp flag fin Layer 4 destination port.
tcp flag psh Layer 4 destination port.
tcp flag rst Layer 4 destination port.
tcp flag syn Layer 4 destination port.
tcp flag urg Layer 4 destination port.
tcp flag urg Layer 4 destination port.
vlan 1 to 4094 mask 1 to 4095 Number of VLAN.

The no match and default match commands require only the CONDITION type without a specific condition value.

Example

This command creates the rules to match on Ethertype IP and Source IP 10.10.10.10.

switch(config-directflow)# flow Test1
switch(config-directflow-Test1)# persistent
switch(config-directflow-Test1)# match ethertype ip
switch(config-directflow-Test1)# match source ip 10.10.10.10

persistent

DirectFlow flows are persistent by default. Once finalized, they appear in the running configuration, and if saved to startup config they will persist over a reboot. The no form of the persistent command prevents the flow from showing up in running config, ensuring that it will not persist over a reboot.

Command Mode

Directflow-flow Configuration

Command Syntax

persistent

no persistent

Example

These commands create and enable a non-persistent DirectFlow flow.

switch(config)# directflow
switch(config-directflow)# flow example-non-persistent
switch(config-directflow-example-non-persistent)# match input interface ethernet 25
switch(config-directflow-example-non-persistent)# action drop
switch(config-directflow-example-non-persistent)# no persistent 
switch(config-directflow-example-non-persistent)# timeout hard 300
switch(config-directflow-example-non-persistent)# exit
switch(config-directflow)#

priority (DirectFlow-flow mode)

The priority command sets the priority for the flow match rules. Each flow-table entry has an optional priority field, with a higher number indicating a higher priority. Flows with the same priority may be loaded in any order, and the order may be changed at any time. If multiple entries match a packet, precedence is given to the entry that was installed first.

Priority numbers range from 0 to 65535. The default is 0. The higher priority rules match first.

The no priority and default priority commands remove priority statement from the DirectFlow configuration mode.

Command Mode

Directflow-flow Configuration

Command Syntax

priority priority_value

no priority

default priority

Parameter

priority_value priority xxx. Value ranges from 0 to 65535. Default is 0.

Example

These commands assign the priority of 150 to flow Test-1.

switch(config-directflow-Test-1)# priority 150
switch(config-directflow-Test-1)#

show directflow

The show directflow command displays summary information for DirectFlow. With the counters or details options, it displays counters or details for all flows configured on the switch.

Command Mode

EXEC

Command Syntax

show directflow [counters | details]

Examples

This command displays summary information for DirectFlow.

switch# show directflow
DirectFlow configuration: Enabled
Total matched: 0 packets
Total programmed flows: 3 flows
switch#

This command displays counters for all DirectFlow flows configured on the switch.

switch# show directflow counters
Flow Name      Source      Matched packets      Matched bytes
---------      ------      ---------------      -------------
test3          config      0                     0
test2          config      0                     0
test1          config      0                     0

Total matched packets: 0
switch>

This command displays details for all DirectFlow flows configured on the switch.

switch# show directflow detail
Flow test3: (Flow programmed)
  persistent: True
  priority: 0
  priorityGroupType: default
  tableType: ifp
  hard timeout: 0
  idle timeout: 0
  match:
    Ethernet type: 0x86dd
    source IPv6 address: fcaa::/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
  actions:
    output interfaces:
        Et32
  source: config
  matched: 0 packets, 0 bytes
Flow test2: (Flow programmed)
  persistent: True
  priority: 0
  priorityGroupType: default
  tableType: ifp
  hard timeout: 0
  idle timeout: 0
  match:
    Ethernet type: IPv4
    source IPv4 address: 10.1.2.12/255.255.255.255
    IPv4 protocol: TCP
    destination TCP/UDP port or ICMP type: 8080
  actions:
    output interfaces:
        Et3/1
  source: config
  matched: 0 packets, 0 bytes
Flow test1: (Flow programmed)
  persistent: True
  priority: 0
  priorityGroupType: default
  tableType: ifp
  hard timeout: 0
  idle timeout: 0
  match:
    ingress interface:
        Et1/1
  actions:
    output interfaces:
        Et2/1
  source: config
  matched: 0 packets, 0 bytes
Flows: 3 programmed, 0 rejected

show directflow flows

The show directflow flows command displays the contents of the flow table, showing each entry with its match rules, actions, and packet counters. Including the name of a specific flow limits the output to information about the specified flow.

Command Mode

EXEC

Command Syntax

show directflow flows [flow_name [counters | detail]]

Parameters

flow_name name of flow for which to display information. If no flow name is entered, command displays information for all flows.
counters displays DirectFlow counters for the specified flow.
detail displays detailed information for the specified flow.

Examples

This command displays the contents of the flow table.

switch# show directflow flows
Flow test3:
  persistent: True
  priority: 0
  priorityGroupType: default
  tableType: ifp
  hard timeout: 0
  idle timeout: 0
  match:
    Ethernet type: 0x86dd
    source IPv6 address: fcaa::/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
  actions:
    output interfaces:
        Et32
  source: config
  matched: 0 packets, 0 bytes
Flow test2:
  persistent: True
  priority: 0
  priorityGroupType: default
  tableType: ifp
  hard timeout: 0
  idle timeout: 0
  match:
    Ethernet type: IPv4
    source IPv4 address: 10.1.2.12/255.255.255.255
    IPv4 protocol: TCP
    destination TCP/UDP port or ICMP type: 8080
  actions:
    output interfaces:
        Et3/1
  source: config
  matched: 0 packets, 0 bytes
Flow test1:
  persistent: True
  priority: 0
  priorityGroupType: default
  tableType: ifp
  hard timeout: 0
  idle timeout: 0
  match:
    ingress interface:
        Et1/1
  actions:
    output interfaces:
        Et2/1
  source: config
  matched: 0 packets, 0 bytes

This command displays information about flow test-1.

switch# show directflow flows test-1
Flow test1:
  persistent: True
  priority: 0
  priorityGroupType: default
  tableType: ifp
  hard timeout: 0
  idle timeout: 0
  match:
    ingress interface:
        Et1/1
  actions:
    output interfaces:
        Et2/1
  source: config
  matched: 0 packets, 0 bytes

This command displays detailed information for flow test-1.

switch# show directflow flows test-1 detail
switch>show directflow flows test1 detail
Flow test1: (Flow programmed)
  persistent: True
  priority: 0
  priorityGroupType: default
  tableType: ifp
  hard timeout: 0
  idle timeout: 0
  match:
    ingress interface:
        Et1/1
    source Ethernet address: 00:aa:aa:aa:aa:aa/ff:ff:ff:ff:ff:ff
    VLAN ID: 10
  actions:
    output interfaces:
  copy ingress to mirror dest interfaces: Ethernet1
    forward normally
  source: config
  matched: 0 packets, 0 bytes

This command displays detailed information for all flows regardless of their status as installed, rejected, configured or others.

switch# show directflow detail
Flow test-3: (Flow programmed)
  persistent: False
  priority: 0
  priorityGroupType: default
  hard timeout: 0
  idle timeout: 0
  match:
    ingress interface:
        Et11
  actions:
    copy ingress to mirror dest interfaces: Ethernet1
    forward normally
  source: config
  matched: 0 packets, 0 bytes
Flow test-1: (Flow programmed)
  persistent: True
  priority: 0
  priorityGroupType: default
  hard timeout: 0
  idle timeout: 0
  match:
    ingress interface:
        Et10
    source Ethernet address: 00:aa:aa:aa:aa:aa/ff:ff:ff:ff:ff:ff
    VLAN ID: 10
  actions:
    copy ingress to mirror dest interfaces: Ethernet1
    forward normally
  source: config
  matched: 0 packets, 0 bytes
Flow test-2: (Flow rejected due to invalid match criteria)
  persistent: True
  priority: 0
  priorityGroupType: default
  hard timeout: 0
  idle timeout: 0
  match:
    Ethernet type: IPv4
    IPv4 protocol: ICMP
    source TCP/UDP port or ICMP type: 3
    destination TCP/UDP port or ICMP type: 6
  actions:
    copy ingress to mirror dest interfaces: Ethernet1
    forward normally
  source: config
  matched: 0 packets, 0 bytes
Flows: 2 programmed, 1 rejected

This command displays counters for flow test-1.

switch# show directflow flows test-1 counters
Flow Name     Source      Matched packets    Matched bytes
---------     ------      ---------------    -------------
test1         config                    0                0

This command displays match counters per flow.

switch# show directflow counters
Flow Name     Source      Matched packets    Matched bytes
---------     ------      ---------------    -------------
test1         config                    0              146
Total matched packets: 1

shutdown (DirectFlow)

The shutdown command, in DirectFlow mode, disables DirectFlow on the switch. DirectFlow is disabled by default.

The no shutdown command re-enables DirectFlow.

Command Mode

Directflow Configuration

Command Syntax

shutdown

no shutdown

default shutdown

Examples

These commands enable DirectFlow on the switch.

switch(config)# directflow
switch(config-directflow)# no shutdown
switch(config-directflow)#

This command disables DirectFlow Flow.

switch(config-directflow-Test1)# shutdown

timeout (DirectFlow-flow mode)

The timeout command, in DirectFlow mode, command configures the connection timeout period for connection sessions. The connection timeout period defines the interval between a users most recently entered command and an automatic connection shutdown. Automatic connection timeout is disabled by setting the idle-timeout to zero, which is the default setting.

Command Mode

Directflow-flow Configuration

Command Syntax

timeout [hard | idle]

no timeout

Parameters

idle session idle timeout length.
- 0 Automatic connection timeout is disabled.
- 1-4294967295 Automatic timeout period (seconds).
hard session hard timeout length.
- 0 Automatic connection timeout is disabled.
- 1-4294967295

Example

These commands enable a hard timeout period of 5 seconds on the switch.

switch(config)# directflow 
switch(config-directflow-Test1)# timeout hard 5
switch(config-directflow-Test1)#

These commands enable DirectFlow on the switch.

switch(config)# directflow
switch(config-directflow-Test1)# no timeout hard
switch(config-directflow-Test1)#

Decap Groups

These sections describe the Decap Groups features:

Decap Groups Overview
Configuring Decap Groups
Configuring Generic UDP Encapsulation (GUE) Decap Groups
Decap Groups Commands

Decap Groups Overview

The Decap Group feature provides a data structure that receives encapsulated packets and extracts the payload. The switch then processes or forwards the extracted payload as required. Although packets cannot transmit through Decap Groups, use Nexthop Groups to create a reverse path for a packet. Decap Groups support payload extraction of packets received from Generic Routing Encapsulation (GRE) and IP-in-IP tunnels.

The Decap capabilities also support the Generic UDP Encapsulation (GUE). GUE provides a general method for encapsulating packets of random IP protocols within a UDP tunnel and contains an extensible header format with optional data.

The switch identifies a GUE packet based on the outer UDP destination port, terminates the tunnel based on the outer destination IP address, and removes the outer IP/UDP encapsulation. The outer UDP destination port also determines if the inner payload source as IP or MPLS. For IP payloads, the first instance of the inner payload distinguishes between IPv4 addresses and IPv6 addresses. The decapsulated packet then forwards to IP or MPLS forwarded based on the inner payload.

Decap Groups have the following constraints:

Destination IP addresses terminate tunnels and the source IP address has no impact.
Packets matching a decap group do not process through the ingress interface and VLAN.
During a tunnel termination, an ingress ACL filters the inner header of each decap group packet.
Decap Groups do not support VRF.

The decap support over GUE has the following constraints:

Does not support outer UDP checksum validation.
Does not support outer IP options handling.
Does not perform outer IP TTL check.
Does not provide exception handling on inner IP packets. Specifically, packets with inner IP TTL=1 or IP options attempt to forward in HW.
The DCS-7020, DCS-7280R, DCS-7280R2, DCS-7500R, and DCS-7500R2 switch series do not support VXLAN with GUE decap option on.
If enabling GUE with outer IP hashing, inner IP fields are not included in the load balance key of MPLS over GRE packets in tc-counters TCAM profile on DCS-7020, DCS-7280R, DCS-7280R2, DCS-7500R, and DCS-7500R2 switch series.

The tunnel type and decap IP address define the Decap Groups:

Tunnel type specifies the tunnel protocol that the switch uses to extract payload.
Decap IP address specifies the IP address where the switch receives decap group packets.

Decap Groups support Generic Routing Encapsulation (GRE) and IP-in-IP tunnels.

Configuring Decap Groups

Configure Decap Groups using the decap-group configuration mode. The decap-group configuration mode changes the running-configimmediately after entering commands. However, when exiting, the decap-group configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.

Specify the static CLI entry for the incoming label with the mpls static command.
Specify the tunnel type with the tunnel type (Decap Group) command.
Specify the Decap IP address with the tunnel decap-ip (Decap Group) command.
Add the locally configured IP addresses to the Layer 3 interfaces using the tunnel decap-interface (Decap Group) command for a specified decap group.

Decap groups do not define a default destination address or tunnel type. You must configure both parameters. A decap group can contain multiple tunnel decap-ip statements.

Examples

Use this command to define a static CLI entry for the incoming-label.

switch(config)# mpls static top-label 3400 ethernet 3/3/3 10.14.4.4 pop payload-type ipv4

Use this command to create a decap group named DC-1 and configure the group to terminate packets from GRE tunnel packets with the destination IP address of 10.14.3.2.

switch(config)# ip decap-group DC-1
switch(config-dg-DC-1)# tunnel type gre
switch(config-dg-DC-1)# tunnel decap-ip 10.14.3.2
switch(config-dg-DC-1)# show active
 ip decap-group DC-1
   tunnel type gre
   tunnel decap-ip 10.14.3.2
switch(config-dg-DC-1)# end
switch(config)#

Configuring Generic UDP Encapsulation (GUE) Decap Groups

The ip decap-group configuration specifies the GUE tunnel termination as follows:

switch(config)# ip decap-group test
switch(config-dg-test)# tunnel type UDP
switch(config-dg-test)# tunnel decap-ip 2.2.2.2
switch(config-dg-test)# tunnel decap-interface et1

Configure the global UDP destination port to payload type mapping:

switch(config)# ip decap-group type udp destination port 6080 payload ip
switch(config)# ip decap-group type udp destination port 5555 payload mpls

Note: Each payload type can be mapped to only one UDP port. Otherwise, the following error occurs:

switch(config)#ip decap-group type udp destination port 6080 payload ip
% There can be only one UDP destination port per payload type

MPLS over GUE Decap Group Configuration

The MPLS over GUE Decap Group requires the following platform configurations. First, the mpls-over-gre must be enabled since this supports the MPLS-over-GRE support in hardware:

switch(config)# platform fap mpls-over-gre

Then enable outer IP hashing:

(config)# load-balance policies 
switch(config-load-balance-policies)# load-balance sand profile default 
! profile default is a reserved profile
! profile default is the current global profile
switch(config-sand-load-balance-profile-default)# packet-type gue outer-ip

Decap Groups Commands

Decap Groups Configuration Commands

ip decap-group
tunnel decap-interface
tunnel decap-ip
tunnel type

Decap Groups Show Command

show ip decap-group

ip decap-group

The ip decap-group command places the switch in decap-group configuration mode which permits the creation or modification of Decap Groups. A Decap Group provides a data structure that defines a method of extracting the payload from an encapsulated packet received on the switch receives at a specified IP address.

Decap Groups do not specify a default IP address group or tunnel type. These parameters must be explicitly configured before a Decap Group can function.

Commands entered in the decap-group configuration modeimmediately change the running-config. Exiting the decap-group configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.

The no ip decap-group and default ip decap-group commands delete previously configured commands in the specified decap-group mode.

Command Mode

Global Configuration

Command Syntax

ip decap-group group_name

no ip decap-group group_name

default ip decap-group group_name

Parameters

group_name Decap group name.

Examples

This command creates a decap group named DC-1.

switch(config)# ip decap-group DC-1
switch(config-dg-DC-1)#

This command exits the decap-group mode for the DC-1 decap group.
```
switch(config-dg-DC-1)# exit
switch(config)#
```

This command delete the decap group named DC-1.

switch(config)# no ip decap-group DC-1
switch(config)#

show ip decap-group

The show ip decap-group command displays the IP decap groups available on the switch.

Command Mode

Global Configuration

Command Syntax

show ip decap-group [decap-group name | dynamic]

Parameters

decap-group name The decap group name.
dynamic Displays the dynamic entries only.

Related Commands

show ip decap-group
tunnel decap-ip
tunnel type

Examples

This command displays the IP decap groups that are available in a switch.

switch(config)# show ip decap-group
NOTE: "D" column indicates dynamic entries
D | Name                | Type       | Info            | Version | Addr Type
--|---------------------|------------|-----------------|---------|--------
* | d1                  | GRE        | 1.2.3.4         |         |
* | d2                  | IP-in-IP   | Ethernet12/3    | IPv4    | primary
  | gre-with-intf       | GRE        |                 |         |
  | ipip-with-decapall  | IP-in-IP   | all             | IPv4    | all
  | ipip-with-decapall  | IP-in-IP   | all             | IPv6    | all
  | ipip-with-intf      | IP-in-IP   | Ethernet11/3    | IPv6    | all
  | ipip-with-intf      | IP-in-IP   | Ethernet11/3    | IPv4    | primary
* | ipip-with-ip        | IP-in-IP   | 1001::1         | IPv6    |
* | ipip-with-ip        | IP-in-IP   | 1.1.1.1         | IPv4    |
  | p1                  | GRE        | 100.100.100.100 |         |
  | p2                  | UNKNOWN    |                 |         |

This command displays the UDP decap groups that are available in a switch.

switch(config)# show ip decap-group
NOTE: "D" column indicates dynamic entries
D | Name    | Type  | Info       | Version | Address  | UDP Dest | Payload
  |         |       |            |         | Type     | Port     | Type
--|---------|-------|------------|---------|----------|----------|-----------
  | foo     | UDP   | Ethernet1  | IPv4    |  primary | 6080     | ip
  |         |       |            |         |          | 5555     | mpls
  | bar     | UDP   | 2.2.2.2    | IPv4    |          | 6080     | ip
  |         |       |            |         |          | 5555     | mpls

The following command displays the decap-groups configured in HW:

switch(config)# show platform fap decap-group
DecapIp                                   	LIF
-------------------------------------------   ---------
2.2.2.2                                  	|  	0
3.3.3.3                                  	|  	1

tunnel decap-interface

The tunnel decap-interface command adds all locally configured IP addresses to the specific Layer 3 interface per Decap Group.

The no tunnel decap-interface command and the default tunnel decap-interface command restores the default state by removing the locally added IP addresses from the Decap Group.

Command Mode

Decap-Group Configuration

Command Syntax

tunnel decap-interface{ Ethernet | Loopback | Management | Port-Channel | Tunnel | Vlan | VXLAN | all}

no tunnel decap-interface {Ethernet | Loopback | Management | Port-Channel | Tunnel | Vlan | VXLAN | all}

default tunnel decap-interface{Ethernet | Loopback | Management | Port-Channel | Tunnel | Vlan | VXLAN | all}

Parameters

Ethernet e_num - Ethernet interface specified by e_num. The Ethernet port number ranges from 1 to 36.
Loopback l_num - Loopback interface specified by l_num. The loopback interface number ranges from 0 to 1000.
Management m_num - Management interface specified by m_num. The management port number ranges from 1 to 1.
Port-channel p_num - Port-channel interface specified by p_num. Options include the following:
- Port-channel interface number. The port-channel interface number ranges from 1 to 2000.
- Port-channel sub interface number. The port-channel sub interface number 1-2000,1-4094.
tunnel t_num Tunnel interface specified by t_num. The tunnel interface number ranges from 0 to 255.
vlan v_num VLAN interface specified by v_num. The VLAN interface number ranges from 1 to 4094.
VXLAN vx_num VXLAN interface specified by vx_num. The VXLAN tunnel interface number ranges from 1 to 1.
all address-family This parameter configures all L3 interfaces as a decap interface.

Example

These commands add locally configured IP addresses to the interface ethernet 1/1 for the dg1 Decap Group.

switch(config)# ip decap-group dg1
switch(config-dg-dg1)# tunnel decap-interface Ethernet1/1

switch(config-dg-dg1)# show active
ip decap-group dg1
   tunnel type ipip
   tunnel decap-interface Ethernet1/1
   tunnel decap-interface all address-family ipv6 address all

tunnel decap-ip

The tunnel decap-ip command specifies the IP address of packets handled by the Decap-Group Configuration Mode for the Decap Group. A Decap Group provides a data structure that defines a method of extracting the payload from an encapsulated packet received on the switch from a specified IPv4 or IPv6 address.

Decap Groups do not define a default decap-ip address. A Decap Group does not become functional until you specify an IP address. Decap Groups can contain only one tunnel decap-ip statement. Subsequent commands replace any previously configured statements.

Command Mode

Decap-Group Configuration

Command Syntax

tunnel decap-ip [ipv4_address | ipv6_address]

Parameters

ipv4_addr - Specify an IPv4 address
ipv6_addr - Specify an IPv6 address.

Related Commands

The ip decap-group command places the switch in decap-group configuration mode.
The tunnel type command specifies the tunnel protocol for extracting payload.
The show ip decap-group command.

Guidelines

A decap group does not specify a default IP address group or tunnel type. These parameters must be explicitly configured before a decap group can function.

Example

These commands configure 10.14.3.2 as the decap-IP address for the DC-1 decap group.

switch(config)# ip decap-group DC-1
switch(config-dg-DC-1)# tunnel decap-ip 10.14.3.2
switch(config-dg-DC-1)# show active
 ip decap-group DC-1
   tunnel decap-ip 10.14.3.2
switch(config-dg-DC-1)#

tunnel type

The tunnel type command specifies the tunnel protocol for extracting payload from encapsulated packets that arrive on the IP address specified for the configuration mode decap group. Supported tunnel protocols include General Routing Encapsulation (GRE) and IP-in-IP.

Decap groups do not define a default tunnel type. A decap group does not become functional until an IP address is specified. Decap groups can contain only one tunnel decap-ip statement. Subsequent commands replace previously configured statements.

Command Mode

Decap-group Configuration

Command Syntax

tunnel type gre

Related Commands

The ip decap-group command places the switch in decap-group configuration mode.
The tunnel decap-ip command specifies the IP address of packets handled by the decap group.
The show ip decap-group command.

Guidelines

A decap group does not specify a default IP address group or tunnel type. These parameters must be explicitly configured before a decap group can function.

Example

This command configures decap group DC-1 to terminate packets from GRE tunnel packets.

switch(config)# ip decap-group DC-1
switch(config-dg-DC-1)# tunnel type gre
switch(config-dg-DC-1)# show active
 ip decap-group DC-1
   tunnel type gre
switch(config-dg-DC-1)#

IPv6

EOS supports Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) for routing packets across network boundaries. This section describes Arista’s implementation of IPv6 and includes these topics:

Introduction
IPv6 Description
Configuring IPv6
IPv6 Commands

Introduction

Routing transmits network layer data packets over connected independent subnets. Each subnet is assigned an IP address range and each device on the subnet is assigned an IP address from that range.

Connected subnets have IP address ranges that do not overlap. A router is a network device connecting multiple subnets. Routers forward inbound packets to the subnet whose address range includes the packets’ destination address.

IPv4 and IPv6 are Internet layer protocols that define packet-switched inter-networking, including source-to-destination datagram transmission across multiple networks. The switch supports IP version 4 (IPv4) and IP version 6 (IPv6).

IPv6 is described by RFC 2460: Internet Protocol, Version 6 (IPv6) Specification. RFC 2463 describes ICMPv6 for IPv6. ICMPv6 is a core protocol of the Internet Protocol suite.

IPv6 Description

Internet Protocol version 6 (IPv6) consists ofa communications protocol used for relaying network packets across a set of connected networks using the Internet Protocol suite. EOS assigns a 128 bit IP address that identifies its network location to each network device.

IPv6 specifies a packet format that minimizes router processing of packet headers. Since the IPv4 and IPv6 packet headers differ significantly, the protocols cannot interoperate. Many transport and application-layer protocols require little or no change to operate over IPv6.

IPv6 Address Format
IPv6 DHCP Snooping
Neighbor Discovery Protocol
IPv6 Duplicate Address Detection Proxy

IPv6 Address Format

IPv6 addresses have 128 bits, represented by eight 16-bit hexadecimal numbers separated by colons. IPv6 addresses abbreviate as follows:

Leading zeros in each 16-bit number may be omitted.
One set of consecutive 16-bit numbers that equal zero may be replaced by a double colon.

Example

The following three IPv6 hexadecimal number representations refer to the same address:

d28e:0000:0000:0000:0234:812f:61ed:4419
d28e:0:0:0:234:812f:61ed:4419
d28e::234:812f:61ed:4419

IPv6 addresses typically denote a 64-bit network prefix and a 64-bit host address.

Unicast and Anycast Addressing

Unicast addressing defines a one-to-one association between the destination address and a network endpoint. Each destination address uniquely identifies a single receiver endpoint. Anycast addressing defines a one-to-one-of-many association, for example, packets to a single member of a group of potential receivers identified by the same destination address.

Compose unicast and anycast addresses as follows:

A 64-bit network prefix that identifies the network segment.
A 64-bit interface identifier based on interface MAC address.

The format of a network address identifies the scope of the address:

Global address - Valid in all networks and connect with other addresses with global scope anywhere or to addresses with link-local scope on the directly attached network.
Link-local address - Scope extends only to the link to which the interface is directly connected. Link-local addresses do not route from the link.

The switch creates the link-local addresses and you cannot configure it. The following figure depicts the switch’s link local address derivation method.

Multicast Addressing

Multicast addressing defines a one-to-many association. Packets simultaneously route from a single sender to multiple endpoints in a single transmission. The network replicates packets as required by network links that contain a recipient endpoint. EOS assigns one multicast address to an interface for each multicast group of an interface.

A solicited-node multicast address consists of an IPv6 multicast address whose scope extends only to the link to the directly connected interface. All IPv6 hosts have at least one address per interface. Neighbor Discovery Protocol uses solicited-node multicast addresses to obtain Layer 2 link-layer addresses of other nodes.

IPv6 DHCP Snooping

Dynamic Host Configuration Protocol (DHCP) snooping is a Layer 2 feature that is configured on LAN switches. The Arista EOS switch supports Option-37 insertion that allows relay agents to provide remote-id information in DHCP request packets. DHCP servers use this information to determine the originating port of DHCP requests and associate a corresponding IP address to that port. DHCP servers use port information to track host location and IP address usage by authorized physical ports.

DHCP snooping uses the information option (Option-37) to include the switch MAC address (router-id) along with the physical interface name and VLAN number (remote-id) in DHCP packets. After adding the information to the packet, the DHCP relay agent forwards the packet to the DHCP server as specified by the DHCP protocol.

Neighbor Discovery Protocol

The Neighbor Discovery Protocol (RFC 4861) operates with IPv6 to facilitate the following tasks for nodes within a specified prefix space:

Auto-configuring a node IPv6 address.
Sensing other nodes on the link.
Discovering the link-local addresses of other nodes on the link.
Detecting duplicate IPv6 addresses.
Discovering available routers.
Discovering DNS servers
Discovering the link address prefix.
Maintaining path reachability data to other active neighbor nodes.

The Neighbor Discovery Protocol protocol defines five different ICMPv6 packet types:

Router Solicitation
Router Advertisement
Neighbor Solicitation
Neighbor Advertisement
Redirect

IPv6 Duplicate Address Detection Proxy

Overview

IPv6 Duplicate Address Detection Proxy ensures that all IPv6 addresses assigned on a network segment are unique. After a host verifies the uniqueness of the IPv6 address, it enables DAD on the network.

However, if two network segments cannot communicate with each other, IPv6 DAD cannot perform and duplicate addresses may be assigned to the same interface. To prevent this, a proxy for IPv6 hosts must be assigned on the network and it responds on behalf of the address owner when the address already exists.

Configuring IPv6

These sections describe IPv6 configuration tasks:

Configuring IPv6 on the Switch
Configuring IPv6 on an Interface
Configuring IPv6 Duplicate Address Detection Proxy on an Interface
Configuring IPv6 DHCP Snooping
Viewing IPv6 Network Components
DHCP Relay Agent for IPv6
TCP MSS Clamping for IPv6

Configuring IPv6 on the Switch

Configure IPv6 to route unicast packets, perform static routing, and Equal Cost Multi-path routing on a switch. This section covers the following topics:

Enabling IPv6 Unicast Routing on the Switch
Configuring Default and Static IPv6 Routes
IPv6 ECMP

Enabling IPv6 Unicast Routing on the Switch

The ipv6 unicast-routing command enables the forwarding of IPv6 unicast packets. When routing is enabled, the switch attempts to deliver inbound packets to destination addresses by forwarding them to interfaces or next hop addresses specified by the IPv6 routing table.

Example

This command enables IPv6 unicast-routing.

switch(config)# ipv6 unicast-routing
switch(config)#

Configuring Default and Static IPv6 Routes

The ipv6 route command creates an IPv6 static route to a destination with an IPv6 prefix, and the source uses an IPv6 address or a routable interface port. When multiple routes exist to a destination prefix, the route with the lowest administrative distance takes precedence.

y default, EOS assigns an administrative distance of1 to static routes.

Assigning a higher administrative distance to a static route allows dynamic routing data to override the static route. For example, an OSPF intra-area route, with a default distance of 110, overrides a static route with a distance value of 200.

Example

Use the following command to create an IPv6 static route.

switch(config)# ipv6 route 10:23:31:00:01:32:93/24 vlan 300
switch(config)#

The default route denotes the packet forwarding rule that takes effect if no other route exists for a specified IPv6 address. EOS sends all packets without destinations in the routing table to the destination specified by the default route.

The IPv6 default route source uses ::/0 as an IP address. EOS refers to the default route destination as the default gateway.

Example

Use the following command to create a default route and establish fd7a:629f:52a4:fe61::2 as the default gateway address.

switch(config)# ipv6 route ::/0 fd7a:629f:52a4:fe61::2
switch(config)#

Configuring Link-Local Next Hop Autodiscovery for IPv6 Static Routes

IPv6 static routes support link-local next hop addresses on point-to-point interfaces, but in deployments that rely on Zero Touch Provisioning (ZTP) to activate switches with static routes, specifying link-local addresses in configuration templates becomes challenging. Link-Local addresses vary per switch and interface and does not allow the use of a single template across multiple deployments.

EOS supports automatic discovery of link-local next-hop using the IPv6 Router Advertisements to discover the neighbor link-local address and use it as the next-hop for the static routes. Configuring this feature enables simpler and more scalable ZTP deployment and eliminates the need to specify link-local addresses in configuration templates.

Use the following command to enable automatic link-local next-hop discovery on a specified point-to-point interface, Ethernet 1:

switch(config)# ipv6 route 2001:db8:100::/6 next-hop auto p2p Ethernet1
switch(config)#

IPv6 ECMP

Multiple routes configured to the same destination with the same administrative distance comprise an Equal Cost Multi-Path (ECMP) route. The switch spreads outbound traffic across all ECMP route paths equally and assigns the same tag value to each path. Commands that change the tag value of any ECMP path change the tag value of all paths in the ECMP.

Resilient ECMP is available for IPv6 routes. Equal Cost Multipath Routing (ECMP) and Load Sharing describes resilient ECMP. The ipv6 hardware fib ecmp resilience command implements IPv6 resilient ECMP.

Example

This command implements IPv6 resilient ECMP by configuring a hardware ECMP table space of 15 entries for IPv6 address 2001:db8:0::/64. A maximum of five next-hop addresses can be specified for the address. When the table contains five addresses, each appears in the table three times. When the table contains fewer than five addresses, ECMP duplicates each address until 15 table entries exist.

switch(config)# ipv6 hardware fib ecmp resilience 2001:db8:0::/64 capacity 5 redundancy 3
switch(config)#

Configuring IPv6 on an Interface

This section covers the following topics:

Enabling IPv6 on an Interface
Assigning an IPv6 Address to an Interface
IPv6 Neighbor Discovery
IPv6 Router Preference
Configuring uRPF

Enabling IPv6 on an Interface

The ipv6 enable command enables IPv6 in the Configuration Mode if it does not have a configured IPv6 address. It also configures the interface with an IPv6 address.

The no ipv6 enable command disables IPv6 on an interface not configured with an IPv6 address. This command does not disable interfaces configured with an IPv6 address.

Example

This command enables IPv6 on interface vlan 200.

switch(config)# interface vlan 200
switch(config-vl200)# ipv6 enable
switch(config-vl200)#

Assigning an IPv6 Address to an Interface

The ipv6 address command enables IPv6 in the Interface Configuration Mode, assigns a global IPv6 address to the interface, and defines the prefix length. Routable interfaces support this command. Multiple global IPv6 addresses can be assigned to an interface. EOS supports Stateless Address Auto Configuration (SLAAC).

Examples

Use the following commands to configure an IPv6 address with subnet mask for vlan 200:

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 address 10:23:31::1:32:93/64
switch(config-if-Vl200)#

Use the following commands to configure an IPv6 address using SLAAC:

switch(config)#interface vlan 200
switch(config-if-vl200)#ipv6 address auto-config
switch(config-if-vl200)#

IPv6 Neighbor Discovery

The IPv6 Neighbor Discovery protocol defines a method for nodes to perform the following network maintenance tasks:

Determine Layer 2 addresses for neighbors known to reside on attached links.
Detect changed Layer 2 addresses.
Purge invalid values from the neighbor cache table.
Find neighboring routers to forward packets.
Track neighbor reachability status.

The RFC 2461 defines IPv6 Neighbor Discovery. IPv6 Stateless Address Autoconfiguration is described by RFC 2462.

The following sections describe Neighbor Discovery configuration tasks.

Reachable Time

The ipv6 nd reachable-time command specifies the time period that EOS includes in the reachable time field of Router Advertisements (RAs) sent from the configuration mode interface. The reachable time defines the period that a remote IPv6 node becomes reachable after a reachability confirmation event.

Example

Use these commands to configure the entry of 25000 (25 seconds) in the reachable time field of RAs sent from vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd reachable-time 25000
switch(config-if-Vl200)# show active
   interface Vlan200
   ipv6 address fd7a:4321::1/64 
   ipv6 nd reachable-time 25000 
switch(config-if-Vl200)#

Router Advertisement Interval

The ipv6 nd ra interval command configures the interval between IPv6 RA transmissions from the configuration mode interface.

Example

These commands configure a RA transmission interval of 60 seconds on interface vlan 200, then displays the interface status.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra interval 60
switch(config-if-Vl200)# show active
interface Vlan200
   ipv6 nd ra interval 60
switch(config-if-Vl200)#

Router Lifetime

The ipv6 nd ra lifetimecommand specifies the value EOS places in therouter lifetime field of IPv6 RAs sent from the IPv6 interface.

If you configure the value as 0, IPv6 peers connected to the specified interface remove the switch from the lists of default routers. Values greater than 0 indicate the time in seconds that peers should keep the router on their default router lists without receiving further RAs from the switch. Unless set to 0, the router lifetime value should be equal to or exceed the interval between unsolicited RAs sent on the interface.

Example

Use the following command to configure the switch to set 2700 as the router lifetime field of RAs transmitted from interface vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra lifetime 2700
switch(config-if-Vl200)# show active
interface Vlan200
   ipv6 nd ra lifetime 2700
switch(config-if-Vl200)#

Router Advertisement Prefix

The ipv6 nd prefix command configures neighbor discovery router advertisement prefix inclusion for RAs sent from the configuration mode interface.

By default, all prefixes configured as IPv6 addresses are advertised in the interface’s RAs. The ipv6 nd prefix command with the no-advertise option prevents advertising of the specified prefix without affecting the advertising of other prefixes specified as IPv6 addresses. When an interface configuration includes at least one ipv6 nd prefix command that enables prefix advertising, RAs advertise only prefixes specified through ipv6 nd prefix commands.

Commands enabling prefix advertising also specify the advertised valid and preferred lifetime periods. Default periods are 2,592,000 (valid) and 604,800 (preferred) seconds.

Example

These commands enable neighbor discovery advertising for IPv6 address 3012:D678::/64, specifying a valid lifetime of 1,296,000 seconds and the default preferred lifetime.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd prefix 3012:D678::/64 1296000
switch(config-if-Vl200)#

Router Advertisement Suppression

The ipv6 nd ra disabled command suppress IPv6 RA transmissions on the configuration mode interface. By default, only unsolicited RAs that are transmitted periodically are suppressed. The all option configures the switch to suppress all RAs, including those responding to a router solicitation.

Example

This command suppresses all RAs on interface vlan 200.

switch(config)# interface vlan 200
switch(config-vl200)# ipv6 nd ra disabled all
switch(config-vl200)#

Router Advertisement MTU Suppression

The ipv6 nd ra mtu suppress command suppresses the router advertisement MTU option on the IPv6 interface. The MTU option causes an identical MTU value to advertise from all nodes on a link. By default, EOS does not suppress the router advertisement MTU option.

Example

Use the following command to suppress the MTU option on interface vlan 200.

switch(config)# interface vlan 200
switch(config-vl200)# ipv6 nd ra mtu suppress
switch(config-vl200)#

Router Advertisement Flag Configuration

The following commands set the specified configuration flag in IPv6 RAs transmitted from the configuration mode interface:

The ipv6 nd managed-config-flag command sets the managed address configuration flag. This bit instructs hosts to use stateful address autoconfiguration.
The ipv6 nd other-config-flag command sets the other stateful configuration flag. This bit indicates availability of autoconfiguration information, other than addresses. Hosts should use stateful autoconfiguration when available. The setting of this flag has no effect if the managed address configuration flag is set.
These commands configure the switch to set the managed address configuration flag in advertisements sent from interface vlan 200.
```
switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd managed-config-flag
switch(config-if-Vl200)#
```
These commands configure the switch to set the other stateful configuration flag in advertisements sent from interface vlan 200.
```
switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd other-config-flag
switch(config-if-Vl200)#
```

IPv6 Router Preference

The IPv6 Router Preference protocol supports an extension to RA messages for communicating default router preferences and more specific routes from routers to hosts. This provides assistance to hosts when selecting a router. RFC 4191 describes the IPv6 Router Preference Protocol.

The ipv6 nd router-preference command specifies the value that the switch enters in the Default Router Preference (DRP) field of RAs sent from the IPv6 interface. The default field entry value is medium.

Example

Use the following command to configure the switch as a medium preference router on RAs sent from interface vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd router-preference medium
switch(config-if-Vl200)#

Configuring uRPF

Unicast Reverse Path Forwarding (uRPF) verifies the accessibility of source IP addresses in forwarded packets from the switch. Unicast Reverse Path Forwarding (uRPF) describes uRPF. Enable uRPF for IPv6 packets entering the IPv6 interface using the ipv6 verify command.

uRPF defines two operational modes:

Strict Mode -uRPF verifies that a packet received on the interface has a routing table entry specified for a return packet.
Loose Mode - uRPF validation does not consider the inbound packet ingress interface only that a valid return path exists.

Example

This command enables uRPF Strict Mode on theinterface vlan 100. If the interface has a default route configured, all inbound packets pass the uRPF check as valid.

switch(config)# interface vlan 100
switch(config-if-Vl100)# ipv6 verify unicast source reachable-via rx allow-default
switch(config-if-Vl100)# show active
 interface Vlan100
   ipv6 verify unicast source reachable-via rx allow-default
switch(config-if-Vl100)#

Configuring IPv6 Duplicate Address Detection Proxy on an Interface

Configure IPv6 DAD on an interface, and add an IPv6 address on the interface. Then enable IPv6 on the interface. You can configure this in conjunction with IPv6 ND Proxy.

Example Configuration

Use the following commands on interface Ethernet 1:

switch(config-if-Et1/1#ipv6 nd dad proxy 
switch(config-if-Et1/1#ipv6 address 2001:db8:1::/64
switch(config-if-Et1/1#ipv6 enable

To set the expiration time for the Neighbor Cache Table, use the following command:

switch(config-if-Et1/1#ipv6 nd cache expire 1800

The expiration time has a default value of 14400 seconds (4 hours).

Displaying IPv6 DAD Proxy Information

To display the configuration output, use the show ipv6 nd dad interface Ethernet1 command:

switch#show ipv6 nd dad interface
 Ethernet1
 ipv6 nd proxy prefix connected
 ipv6 nd dad proxy
 ipv6 address 2001:db8:3::/64

Displaying IPv6 Network Components

Displaying RIB Route Information

Use the show rib route ipv6 command to view the IPv6 Routing Information Base (RIB) information.

Example

This command displays IPv6 RIB BGP routes.

switch# show rib route ipv6 bgp
VRF name: default, VRF ID: 0xfe, Protocol: bgp
Codes: C - Connected, S - Static, P - Route Input
       B - BGP, O - Ospf, O3 - Ospf3, I - Isis
       > - Best Route, * - Unresolved Nexthop
       L - Part of a recursive route resolution loop
 B    2001:10:1::/64 [200/42]
         via 2001:10:1::100 [0/1]
            via Ethernet1, directly connected
>B    2001:10:100::/64 [200/200]
         via 2001:10:1::100 [0/1]
            via Ethernet1, directly connected
>B    2001:10:100:1::/64 [200/0]
         via 2001:10:1::100 [0/1]
            via Ethernet1, directly connected
>B    2001:10:100:2::/64 [200/42]
         via 2001:10:1::100 [0/1]
            via Ethernet1, directly connected

switch#

Displaying the FIB and Routing Table

The show ipv6 route command displays routing table entries in the Forwarding Information Base (FIB), including static routes, routes to directly connected networks, and dynamically learned routes. Multiple equal cost paths to the same prefix display contiguously as a block, with the destination prefix displayed only on the first line.

Example

This command displays a route table entry for a specific IPv6 route.

switch> show ipv6 route fd7a:3418:52a4:fe18::/64
IPv6 Routing Table - 77 entries
Codes: C - connected, S - static, K - kernel, O - OSPF, B - BGP, R - RIP, A - 
Aggregate

O   fd7a:3418:52a4:fe18::/64 [10/20]
     via f180::21c:73ff:fe00:1319, Vlan3601
     via f180::21c:73ff:fe00:1319, Vlan3602
     via f180::21c:73ff:fe00:1319, Vlan3608
     via f180::21c:73ff:fe0f:6a80, Vlan3610
     via f180::21c:73ff:fe00:1319, Vlan3611

switch>

Displaying the Route Age

The show ipv6 route age command displays the IPv6 route age to the specified IPv6 address or prefix.

Example

This command displays the route age for the specified prefix.

switch> show ipv6 route 2001::3:0/11 age
IPv6 Routing Table - 74 entries
Codes: C - connected, S - static, K - kernel, O - OSPF, B - BGP, R - RIP, A - 
Aggregate

C 2001::3:0/11 age 00:02:34
switch>

Displaying Host Routes

The show ipv6 route host command displays all host routes in the IPv6 host forwarding table. Host routes are those whose destination prefix is the entire address (prefix = /128). Each displayed host route displays the purpose of the route:

F - Displays static routes from the FIB.
R - Displays routes defined because the IP address is an interface address.
A - Displays routes to any neighboring host with the switch that has an ARP entry.

Example

This command displays all IPv6 host routes in the host forwarding table.

switch# show ipv6 route host
R - receive F - FIB, A - attached

 F  ::1 to cpu
 A  fee7:48a2:0c11:1900:400::1 on Vlan102
 R  fee7:48a2:0c11:1900:400::2 to cpu
 F  fee7:48a2:0c11:1a00::b via fe80::21c:73ff:fe0b:a80e on Vlan3902
 R  fee7:48a2:0c11:1a00::17 to cpu
 F  fee7:48a2:0c11:1a00::20 via fe80::21c:73ff:fe0b:33e on Vlan3913
 F  fee7:48a2:0c11:1a00::22 via fe80::21c:73ff:fe01:5fe1 on Vlan3908
                            via fe80::21c:73ff:fe01:5fe1 on Vlan3902

switch#

Displaying Route Summaries

The show ipv6 route summary command displays the current number of routes of the IPv6 routing table in summary format.

Example

This command displays the route source and the corresponding number of routes in the IPv6 routing table.

switch> show ipv6 route summary   
Route Source    Number Of Routes
------------------ ----------------
   connected                      2
   static                         0
   ospf                           5
   bgp                            7
   isis                           0
   internal                       1
   attached                       0
   aggregate                      2

   Total Routes                   17
switch>

TCP MSS Clamping for IPv6

TCP MSS Clamping limits the value of the Maximum Segment Size (MSS) in the TCP header of TCP SYN packets transiting a specified Ethernet or tunnel interface. Setting the MSS ceiling can avoid IP fragmentation in tunnel scenarios by ensuring that the MSS is low enough to account for the extra overhead of GRE and tunnel outer IP headers. Use TCP MSS Clamping when connecting through a GRE tunnel to cloud providers that require asymmetric routing.

When configuring MSS clamping on an interface, if the TCP MSS value in a SYN packet transiting that interface exceeds the configured ceiling limit, the configured limit overwrites the TCP MSS value, and the TCP checksum recomputes and updates.

By default, the software datapath handles TCP MSS Clamping. However, the hardware configuration can support the process to minimize possible packet loss and reduce the number of TCP sessions that the switch can establish per second.

Configuring the TCP MSS Ceiling on an IPv6 Interface

Set the TCP MSS Ceiling limit on an interface using command tcp mss ceiling ipv6. This also enables TCP MSS Clamping on the switch.

Note: TCP MSS Clamping routes all TCP SYN packets through software, even on interfaces with no TCP MSS Ceiling configured no hardware support. This significantly limits the number of TCP sessions the switch can establish per second, and can potentially cause packet loss if the CPU traffic exceeds control plane policy limits.

On platform switches DCS-7280R3, DCS-7500R3 Line Cards and DCS-7800R3 Line Cards, the following limitations apply:

This command works only on egress packets.
Unicast packets entering the switch support TCP MSS Ceiling and the configuration has no effect on GRE transit packets
or GRE decap, even if the egress interface has TCP MSS Ceiling configured.
EOS does not support TCP MSS Ceiling on L2 (switchport) interfaces.
VXLAN, Loopback or management interfaces do not support TCP MSS Ceiling.
Only hardware TCP MSS clamping is supported on release EOS-4.26.1F and later.

Example

These commands configure interface ethernet 26 as a routed port, then specify a maximum TCP MSS Ceiling value of 1436 bytes for TCP SYN packets exiting that port.

switch(config)# interface ethernet 26
switch(config-if-Et5)# no switchport
switch(config-if-Et5)# tcp mss ceiling ipv6 1436 egress
switch(config-if-Et5)#

IPv6 Commands

Global Configuration Commands

ipv6 hardware fib aggregate-address
ipv6 hardware fib ecmp resilience
ipv6 hardware fib nexthop-index
ipv6 neighbor
ipv6 neighbor cache persistent
ipv6 route
ipv6 unicast-routing

Privileged EXEC Commands

EXEC Commands

show ipv6 dhcp relay counters
show ipv6 dhcp snooping counters
show ipv6 dhcp snooping hardware
show ipv6 hardware fib aggregate-address
show ipv6 interface
show ipv6 nd dad proxy
show ipv6 nd ra internal state
show ipv6 neighbors
show ipv6 route
show ipv6 route age
show ipv6 route host
show ipv6 route interface
show ipv6 route match tag
show ipv6 route summary
show platform fap mroute ipv6
show rib route ipv6

clear ipv6 dhcp relay counters

The clear ipv6 dhcp relay counters command resets the DHCP relay counters. If you do not specify a port, the command clears the counters for the switch and for all interfaces. Otherwise, the command clears the counter for the specified interface.

Command Mode

Privileged EXEC

Command Syntax

clear ipv6 dhcp relay counters [port]

Parameters

port - Specify the interface to access the neighbor. Options include the following:

no parameter - Removes all dynamic entries.
interface ethernet e_num - Specify the Ethernet interface by e_num.
interface loopback l_num - Specify the Loopback interface by l_num.
interface port-channel p_num - Specify the Port-channel interface by p_num p_num.
interface vlan v_num - Specify the VLAN interface by v_num.

Example

These commands clear the DHCP relay counters for interface ethernet 4 and shows the counters before and after the clear command.

switch(config)# show ipv6 dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  376  376    0 | 4 days, 19:55:12 ago
 All Resp |  277  277    0 |
          |                |
Ethernet4 |  207  148    0 | 4 days, 19:54:24 ago


switch(config)# interface ethernet 4
switch(config-if-Et4)# clear ipv6 dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  380  380    0 | 4 days, 21:19:17 ago
 All Resp |  281  281    0 |
          |                |
Ethernet4 |    0    0    0 |4 days, 21:18:30 ago
These commands clear all DHCP relay counters on the switch.
switch(config-if-Et4)# exit

switch(config)# clear ipv6 dhcp relay counters

switch(config)# show ipv6 dhcp relay counters
          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|-------------
  All Req |    0    0    0 |  0:00:03 ago
 All Resp |    0    0    0 |
          |                |
Ethernet4 |    0    0    0 | 0:00:03 ago
switch(config)#

clear ipv6 dhcp snooping counters

The clear ipv6 dhcp snooping counters command resets the DHCP snooping packet counters.

Command Mode

Privileged EXEC

Command Syntax

clear ipv6 dhcp snooping counters [counter_type]

Parameters

counter_type - Specifies the type of counter to reset.
no parameter - Clears the counters for each VLAN.
debug - Clears aggregate counters and drop cause counters.

Examples

This command clears the number of DHCP packets sent and received on each VLAN.

switch# clear ipv6 dhcp snooping counters
switch# show ipv6 dhcp snooping counters

     | Dhcpv6 Request Pkts | Dhcpv6 Reply Pkts | 
Vlan |  Rcvd   Fwdd   Drop |  Rcvd  Fwdd  Drop | Last Cleared
-----|------ ------ -------|------ ----- ------|------------- 
2789 |     1      1      0 |     1     1     0 |  0:03:09 ago

This command clears the number of DHCP packets sent on the switch.

switch# clear ipv6 dhcp snooping counters debug
switch# show ipv6 dhcp snooping counters debug

Counter                       Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received                                      1                 1
Forwarded                                     1                 1
Dropped - Invalid VlanId                      0                 0
Dropped - Parse error                         0                 0
Dropped - Invalid Dhcp Optype                 0                 0
Dropped - Invalid Remote-ID Option            0                 0
Dropped - Snooping disabled                   0                 0

Last Cleared:  0:04:29 ago

clear ipv6 neighbors

The clear ipv6 neighbors command removes the specified dynamic IPv6 neighbor discovery cache entries. Commands that do not specify an IPv6 address remove all dynamic entries for the listed interface. Commands that do not specify an interface remove all dynamic entries.

Command Mode

Privileged EXEC

Command Syntax

clear ipv6 neighbors [port][dynamic_ipv6]

Parameters

port Interface through which neighbor is accessed. Options include the following:
- no parameter - Removes all dynamic entries.
- interface ethernet e_num - Specify the Ethernet interface by e_num.
- interface loopback l_num - Specify the Loopback interface by l_num.
- interface port-channel p_num - Specify the Port-channel interface by p_num p_num.
- interface vlan v_num - Specify the VLAN interface by v_num.
dynamic_ipv6 - Specifies the address of entry to remove. Options include the following:
- no parameter - Removes all dynamic entries for specified interface.
- ipv6_addr - Removes the IPv6 address of the entry.

Example

This command removes all dynamic neighbor entries for vlan 200.

switch# clear ipv6 neighbors vlan 200
switch#

ipv6 address

The ipv6 address command assigns a global IPv6 address to the IPv6 interface, and defines the prefix length. Routable interfaces support this command. Multiple global IPv6 addresses can be assigned to an interface. The IPv6 address or prefix can be supplied manually, or configured using Stateless Address Auto Configuration.

The no ipv6 address and default ipv6 address commands remove the IPv6 address assignment from the configuration mode interface by deleting the corresponding ipv6 address command from running-config. If the command does not include an address, all address assignments are removed from the interface. IPv6 remains enabled on the interface after the removal of all IPv6 addresses only ifipv6 enable command is configured on the interface.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 address [ ipv6_address | ipv6_prefix | auto-config ]

no ipv6 address { ipv6_address | ipv6_prefix | auto-config }

default ipv6 address { ipv6_address | ipv6_prefix | auto-config }

Parameter

ipv6_address - Specify the IPv6 address to assign to the interface.

ipv6_prefix - Specify the IPv6 prefix assigned to the interface (CIDR notation).

auto-config - Use SLAAC auto-configuration.

Example

These commands configure an IPv6 address and prefix length for interface vlan 200:

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 address 10:23:31:00:01:32:93/64
switch(config-if-Vl200)#

ipv6 dhcp relay always-on

The iv6p dhcp relay always-on command enables the switch DHCP relay agent on the switch regardless of the DHCP relay agent status on any interface. By default, the DHCP relay agent is enabled only if at least one routable interface is configured with an ipv6 dhcp relay destination statement.

The no ipv6 dhcp relay always-on and default ipv6 dhcp relay always-on commands remove the ipv6 dhcp relay always-on command from running-config.

Command Mode

Global Configuration

Command Syntax

ipv6 dhcp relay always-on

no ipv6 dhcp relay always-on

default ipv6 dhcp relay always-on

Example

This command enables the DHCP relay agent.

switch(config)# ipv6 dhcp relay always-on
switch(config)#

ipv6 dhcp relay destination

The ipv6 dhcp relay destination command enables the DHCPv6 relay agent and sets the destination address on the configuration mode interface.

The no ipv6 dhcp relay destination and default ipv6 dhcp relay destination commands remove the corresponding ipv6 dhcp relay destination command from running-config. When the commands do not list an IPv6 address, all ipv6 dhcp relay destination commands are removed from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 dhcp relay destination [ipv6_addr][source-address ipv6_addr]

no ipv6 dhcp relay destination [ipv6_addr]

default ipv6 dhcp relay destination [ipv6_addr]

Parameters

ipv6_addr DCHP Server’s IPv6 address.
source-address ipv6_addr specify the source IPv6 address to communicate with DHCP server.

Guidelines

If the source-address parameter is specified, then the DHCP client receives an IPv6 address from the subnet of source IP address. The source-address must be one of the configured addresses on the interface.

Example

This command enables the DHCPv6 relay agent and sets the destination address to 2001:0db8:0:1::1 on interface ethernet 4.

switch(config)# interface ethernet 4
switch(config-if-Et4)# ipv6 dhcp relay destination 2001:0db8:0:1::1
switch(config-if-Et4)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCPv6 Relay Link-layer Address Option (79) is disabled
DHCP Smart Relay is disabled
Interface: Ethernet4
  DHCP Smart Relay is disabled
  DHCP servers: 1::1
                2001:db8:0:1::1
switch(config-if-Et4)#

ipv6 dhcp relay option link-layer address

The ipv6 dhcp relay option link-layer address command enables the DHCPv6 relay agent to configure the client link layer address option to solicit and request messages. In other words, the command enables the link layer address option (79) in the global configuration mode.

The no ipv6 dhcp relay option link-layer address command disables the link layer address option (79) in the global configuration mode.

Command Mode

Global Configuration

Command Syntax

ipv6 dhcp relay option link-layer address

no ipv6 dhcp relay option link-layer address

default ipv6 dhcp relay option link-layer address

Example

This command enables the insertion of link layer address option (79) in the global configuration mode.

switch(config)# ipv6 dhcp relay option link-layer address

ipv6 dhcp relay option remote-id

The ipv6 dhcp relay option command configures DHCPv6 Relay Option 37, Remote-ID, to add the MAC address, interface ID or name, and hostname as the remote-id format. The no version of the command removes the configuration from the running-config.

Command Mode

Global Configuration

Command Syntax

ipv6 dhcp relay option remote-id format {%m:%h:%p | %m:%i | %m:%p}

no ipv6 dhcp relay option remote-id format {%m:%h:%p | %m:%i | %m:%p}

Parameters

remote-id - Add Option 37 to the DHCP Relay configuration.
format - Select one of the following as the format for the remote-id:
- %m:%h:%p - Specify the MAC address, hostname, and interface name as the remote-id.
- %m:%i - Specify the MAC address and interface ID as the remote-id.
- %m:%p - Specify the MAC address and interface name as the remote-id.

Example

Use the following command to specify using the MAC address, hostname, and interface name for the Remote-ID:

switch(config)# ipv6 dhcp relay option remote-id format %m:%h:%p

ipv6 enable

The ipv6 enable command enables IPv6 on the configuration mode interface. Assigning an IPv6 address to an interface also enables IPv6 on the interface.

The no ipv6 enable and default ipv6 enable command remove the corresponding ipv6 enable command from running-config. This action disables IPv6 on interfaces that are not configured with an IPv6 address.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 enable

no ipv6 enable

default ipv6 enable

Example

This command enables IPv6 on interface vlan 200.

switch(config)# interface vlan 200
switch(config-vl200)# ipv6 enable
switch(config-vl200)#

ipv6 hardware fib aggregate-address

The ipv6 hardware fib aggregate-address command specifies the routing table repository of specified IPv6 route.

By default, routes that are created statically through the CLI or dynamically through routing protocols are initially stored in software routing tables, then entered in the hardware routing table by the routing agent. This command prevents the entry of the specified route into the hardware routing table. Specified routes that are in the hardware routing table are removed by this command. Specific routes that are encompassed within the specified route prefix are affected by this command.

The no ipv6 hardware fib aggregate-address and default ipv6 hardware fib aggregate-address commands remove the restriction from the hardware routing table for the specified routes by removing the corresponding ipv6 hardware fib aggregate-address command from running-config.

Command Mode

Global Configuration

Command Syntax

ipv6 hardware fib aggregate-address ipv6_prefix summary-only software-forward

no ipv6 hardware fib aggregate-address ipv6_prefix

default ipv6 hardware fib aggregate-address ipv6_prefix

Parameters

ipv6_prefix IPv6 prefix that is restricted from the hardware routing table (CIDR notation).

Example

These commands configure a hardware routing restriction for an IPv6 prefix, then displays that restriction.

switch(config)# ipv6 hardware fib aggregate-address fd77:4890:5313:ffed::/64 
summary-only software-forward
switch(config)# show ipv6 hardware fib aggregate-address
Codes: S - Software Forwarded
S  fd77:4890:5313:ffed::/64

switch(config)#

ipv6 hardware fib ecmp resilience

The ip hardware fib ecmp resilience command configures a fixed number of next hop entries in the hardware ECMP table for the specified IPv6 address prefix. In addition to specifying the maximum number of next hop addresses that the table can contain for the prefix, the command introduces a redundancy factor that allows duplication of each next hop address. The fixed table space for the address is the maximum number of next hops multiplied by the redundancy factor.

The default method of adding or removing next hop entries when required by the active hashing algorithm leads to inefficient management of the ECMP table, which can result in the rerouting of packets to different next hops that breaks TCP packet flows. Implementing fixed table entries for a specified IP address allows data flows that are hashed to a valid next hop number to remain intact. Additionally, traffic is evenly distributed over a new set of next hops.

The no ip hardware fib ecmp resilience and default ip hardware fib ecmp resilience commands restore the default hardware ECMP table management by removing the ip hardware fib ecmp resilience command from running-config.

Command Mode

Global Configuration

Command Syntax

ipv6 hardware fib ecmp resilience net_prfx capacity nhop_max redundancy duplicates

no ipv6 hardware fib ecmp resilience net_addr

default ipv6 hardware fib ecmp resilience net_addr

Parameters

net_prfx IPv6 address prefix managed by command.
nhop_max Specifies maximum number of nexthop entries for specified IP address prefix. Value range varies by platform:
- Helix: <2 to 64>
- Trident: <2 to 32>
- Trident II: <2 to 64>
duplicates Specifies the redundancy factor. Value ranges from 1 to 128.

Example

This command configures a hardware ECMP table space of 15 entries for the IPv6 address 2001:db8:0::/64. A maximum of five nexthop addresses can be specified for the address. When the table contains five nexthop addresses, each appears in the table three times. When the table contains fewer than five nexthop addresses, each is duplicated until the 15 table entries are filled.

switch(config)# ipv6 hardware fib ecmp resilience 2001:db8:0::/64 capacity 5 redundancy 3

ipv6 hardware fib nexthop-index

The ipv6 hardware fib nexthop-index command deterministically selects the next hop used for ECMP routes. By default, routes that are created statically through the CLI or dynamically through routing protocols are initially stored in software routing tables, then entered in the hardware routing table by the routing agent. This command specifies the method of creating an index-offset number that points to the next hop from the list of the route’s ECMP next hops.

The index-offset is calculated by adding the next hop index to a prefix offset.

Next hop index: specified in the command.
Prefix offset: the least significant bits of the route’s prefix.

The command specifies the number of bits that comprise the prefix offset. The prefix offset is set to the prefix when the command specifies a prefix size larger than the prefix. If the command specifies an prefix size of zero, the prefix-offset is also zero and the index-offset is set to the next hop index.

When the index-offset is greater than the number of next hops in the table, the position of the next hop is the remainder of the division of the index-offset by the number of next hop entries.

The no ipv6 hardware fib nexthop-index and default ipv6 hardware fib nexthop-index commands remove the specified nexthop used for ECMP routes by removing the ipv6 hardware fib nexthop-index command from running-config.

Command Mode

Global Configuration

Command Syntax

ipv6 hardware fib nexthop nxthop_index [PREFIX]

no ipv6 hardware fib nexthop

default ipv6 hardware fib nexthop

Parameters

nxthop_index specifies the next hop index. Value ranges from 0 to 32.
PREFIX Number of bits of the route’s prefix to use as the prefix-offset. Value ranges from 0 to 64.
- no parameter The prefix offset is set to zero.
- prefix-bits 0 to 64 Specifies the number bits to use as the prefix-offset.

Example

This command specifies the next hop from the list of ECMP next hops for the route.

switch(config)# ipv6 hardware fib nexthop-index 5 prefix-bits 10

switch> show ip
IP Routing : Enabled
IP Multicast Routing : Disabled
VRRP: Configured on 0 interfaces

IPv6 Unicast Routing : Enabled
IPv6 ECMP Route support : False
IPv6 ECMP Route nexthop index: 5
IPv6 ECMP Route num prefix bits for nexthop index: 10
switch>

ipv6 hardware fib optimize prefixes

The ipv6 hardware fib optimize prefixes command in the Global Configuration Mode reserves IPv6 optimized prefixes on the default and non-default VRFs.

The no version of the command explicitly removes the configuration from the running-config on the switch.

Command Mode

Global Configuration

Command Syntax

ip hardware fib optimize vrf vrf_name prefixes minimum count num_prefixes

no ip hardware fib optimize vrf vrf_name prefixes minimum count num_prefixes

Parameters

vrf vrf_name - Specify the VRF to minimize prefixes.
prefixes minimum count num_prefixes - Specify the minimum number of prefixes to optimize on the VRF.

Example

Use the following command to create reservations for 35 IPv6 optimized prefixes on VRF green:

switch(config)# ipv6 hardware fib optimize vrf green prefixes minimum count 35
            ! Please restart the SandL3Unicast agent to reserve space for optimized FIB prefixes

ipv6 nd dad proxy

IPv6 DAD Proxy can be configured on an interface, and you must configure an IPv6 address on the interface and then enable IPv6 on the interface. You can configure this in conjunction with IPv6 ND Proxy.

Command Mode

Interface-Ethernet Configuration

Command Syntax

ipv6 nd dad proxy

Example

The following example enables IPV6 DAD Proxy on Ethernet1:

switch(config-if-Et1/1#ipv6 nd dad proxy
switch(config-if-Et1/1#ipv6 address 2001:db8:1::/64
switch(config-if-Et1/1#ipv6 enable

ipv6 nd managed-config-flag

The ipv6 nd managed-config-flag command causes the managed address configuration flag to be set in IPv6 RA packets transmitted from the configuration mode interface.

The no ipv6 nd managed-config-flag and default ipv6 nd managed-config-flag commands restore the default setting where the managed address configuration flag is not set in IPv6 RA packets transmitted by the interface by removing the corresponding ipv6 nd managed-config-flag command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd managed-config-flag

no ipv6 nd managed-config-flag

default ipv6 nd managed-config-flag

Example

These commands cause the managed address configuration flag to be set in IPv6 RA packets sent from interface vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd managed-config-flag
switch(config-if-Vl200)#

ipv6 nd ns-interval

The ipv6 nd ns-interval command configures the interval between IPv6 Neighbor Solicitation (NS) transmissions from the configuration mode interface.

The no ipv6 nd ns-interval and default ipv6 nd ns-interval commands return the IPv6 NS transmission interval for the configuration mode interface to the default value of 1000 milliseconds by removing the corresponding ipv6 nd ns-interval command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd ns-interval period

no ipv6 nd ns-interval

default ipv6 nd ns-interval

Parameter

period interval in milliseconds between successive IPv6 neighbor solicitation transmissions. Values range from 1000 to 4294967295. The default period is 1000 milliseconds.

Example

This command configures a neighbor solicitation transmission interval of 30 seconds on interface vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ns-interval 30000
switch(config-if-Vl200)#

ipv6 nd other-config-flag

The ipv6 nd other-config-flag command configures the configuration mode interface to send IPv6 RAs with the other stateful configuration flag set.

The no ipv6 nd other-config-flag and default ipv6 nd other-config-flag commands restore the default setting by removing the corresponding ipv6 nd other-config-flag command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd other-config-flag

no ipv6 nd other-config-flag

default ipv6 nd other-config-flag

Example

These commands configure the switch to set the other stateful configuration flag in advertisements sent from interface vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd other-config-flag
switch(config-if-Vl200)#

ipv6 nd prefix

The ipv6 nd prefix command configures neighbor discovery Router Advertisements (RAs) prefix inclusion for RAs sent from the configuration mode interface.

By default, all prefixes configured as IPv6 addresses are advertised in the interface’s RAs. The ipv6 nd prefix command with the no-advertise option prevents advertising of the specified prefix without affecting the advertising of other prefixes specified as IPv6 addresses. When an interface configuration includes at least one ipv6 nd prefix command that enables prefix advertising, RAs advertise only prefixes specified through ipv6 nd prefix commands.

Commands enabling prefix advertising also specify the advertised valid and preferred lifetime periods. Default periods are 2,592,000 (valid) and 604,800 (preferred) seconds.

The no ipv6 nd prefix and default ipv6 nd prefix commands remove the corresponding ipv6 nd prefix command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd prefix ipv6_prefix LIFETIME [FLAGS]

ipv6 nd prefix ipv6_prefix no-advertise

no ipv6 nd prefix ipv6_prefix

default ipv6 nd prefix ipv6_prefix

Parameters

ipv6_prefix IPv6 prefix (CIDR notation).
no-advertise Prevents advertising of the specified prefix.
LIFETIME Period that the specified IPv6 prefix is advertised (seconds). Options include:
- valid preferred Two values that set the valid and preferred lifetime periods.
- valid One value that sets the valid lifetime. The preferred lifetime is set to the default value.
- no parameter The valid and preferred lifetime periods are set to their default values.

Options for valid: 0 to 4294967295 and infinite. Default value is 2592000 Options for preferred: 0 to 4294967295 and infinite. The default value is 604800. The maximum value (4294967295) and infinite are equivalent settings.

FLAGS on-link and autonomous address-configuration flag values in RAs.
- no parameter both flags are set.
- no-autoconfig autonomous address-configuration flag is reset.
- no-onlink on-link flag is reset.
- no-autoconfig no-onlink both flags are reset.
- no-onlink no-autoconfig both flags are reset.

Example

These commands enable neighbor discovery advertising for IPv6 address 3012:D678::/64, on interface vlan 200, specifying a valid lifetime of 1,296,000 seconds and the default preferred lifetime.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd prefix 3012:D678::/64 1296000

ipv6 nd ra disabled

The ipv6 nd ra disabled command suppress IPv6 Router Advertisement (RA) transmissions on the configuration mode interface. By default, only unsolicited RAs that are transmitted periodically are suppressed. The all option configures the switch to suppress all RAs, including those responding to a router solicitation.

The no ipv6 nd ra disabled and default ipv6 nd ra disabled commands restore the transmission of RAs on the configuration mode interface by deleting the corresponding ipv6 nd ra disabled command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd ra disabled [SCOPE]

no ipv6 nd ra disabled

default ipv6 nd ra disabled

Parameters

SCOPE specifies the RAs that are suppressed.

no parameter Periodic unsolicited RAs are suppressed.
all All RAs are suppressed.

Example

This command suppresses all RAs on interface vlan 200.

switch(config)# interface vlan 200
switch(config-vl200)# ipv6 nd ra disabled all
switch(config-vl200)#

ipv6 nd ra dns-server

The ipv6 nd ra dns-server command configures the IPv6 address of a preferred Recursive DNS Server (RDNSS) for the command mode interface to include in its neighbor-discovery Router Advertisements (RAs). Including RDNSS information in RAs provides DNS server configuration for connected IPv6 hosts without requiring DHCPv6.

Multiple servers can be configured on the interface by using the command repeatedly. A lifetime value for the RDNSS can optionally be specified with this command, and overrides any default value configured for the interface using the ipv6 nd ra dns-servers lifetime command.

The no ipv6 nd ra dns-server and default ipv6 nd ra dns-server commands remove the corresponding ipv6 nd ra dns-server command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd ra dns-server ipv6_addr SERVER_LIFE

no ipv6 nd ra dns-server ipv6_addr

default ipv6 nd ra dns-server ipv6_addr

Parameters

ipv6_addr RDNSS address to be included in RAs from the command mode interface.
SERVER_LIFE maximum lifetime value for the specified RDNSS entry. This value overrides any default lifetime value. Value should be between the RA interval configured on the interface and two times that interval. Options include:
- no parameter lifetime period is the default lifetime period configured on the interface. If no lifetime period is configured on the interface, the default value is 1.5 times the maximum RA interval set by the ipv6 nd ra interval command.
- lifetime 0 the configured RDNSS is not to be used.
- lifetime 1 to 4294967295 specifies the lifetime period for this RDNSS in seconds.

Example

This command configures the RDNSS at 2001:0db8:0:1::1 as a preferred RDNSS for interface vlan 200 to include in its neighbor-discovery route advertisements, and sets its lifetime value to 300 seconds.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra dns-server 2001:0db8:0:1::1 lifetime 300
switch(config-if-Vl200)#

ipv6 nd ra dns-servers lifetime

The ipv6 nd ra dns-servers lifetime command sets the default value that the configuration mode interface uses for the lifetime of any Recursive DNS Server (RDNSS) configured on the interface. A lifetime value set for an individual RDNSS overrides this value. The lifetime value is the maximum amount of time after a route advertisement packet is sent that the RDNSS referenced in the packet may be used for name resolution.

The no ipv6 nd ra dns-servers lifetime and default ipv6 nd ra dns-servers lifetime commands remove the default lifetime value from the interface by removing the corresponding ipv6 nd ra dns-servers lifetime command from running-config. When there is no default RDNSS lifetime value configured on the interface, an RDNSS without a custom lifetime value will default to 1.5 times the RA interval configured on the interface. A lifetime of zero seconds means that the RDNSS must not be used for name resolution.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd ra dns-servers lifetime period

no ipv6 nd ra dns-servers lifetime

default ipv6 nd ra dns-servers lifetime

Parameters

period the RDNSS lifetime value for the configuration mode interface. Options include:

0 any RDNSS configured on the command mode interface without a custom lifetime value must not be used.
1 to 4294967295 maximum RDNSS lifetime value for the configuration mode interface. This value is overridden by any lifetime value set with the ipv6 nd ra dns-server command. Should be between the router advertisement interval configured on the interface and two times that interval.

Example

This command sets the default RDNSS maximum lifetime value for interface vlan 200 to 350 seconds.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra dns-servers lifetime 350 
switch(config-if-Vl200)#

ipv6 nd ra dns-suffix

The ipv6 nd ra dns-suffix command creates a DNS Search List (DNSSL) for the command mode interface to include in its neighbor-discovery Router Advertisements as defined in RFC 6106 . The DNSSL contains the domain names of DNS suffixes for IPv6 hosts to append to short, unqualified domain names for DNS queries.

Multiple DNS domain names can be added to the DNSSL by using the command repeatedly. A lifetime value for the DNSSL can optionally be specified with this command, and overrides any default value configured for the interface using the ipv6 nd ra dns-suffixes lifetime command.

The no ipv6 nd ra dns-suffix and default ipv6 nd ra dns-suffix commands remove the corresponding ipv6 nd ra dns-suffix command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd ra dns-suffix domain SUFFIX_LIFE

no ipv6 nd ra dns-suffix ipv6_addr

default ipv6 nd ra dns-suffix ipv6_addr

Parameters

domain domain suffix for IPv6 hosts to append to short, unqualified domain names for DNS queries. Suffix must contain only alphanumeric characters, “.” and “-” and must begin and end with an alphanumeric character.
SUFFIX_LIFE maximum lifetime value for the specified domain suffix. This value overrides any default lifetime value. Value should be between the RA interval configured on the interface and two times that interval. Options include:
- no parameter lifetime period is the default lifetime period configured on the interface. If no lifetime period is configured on the interface, the default value is 1.5 times the maximum RA interval set by the ipv6 nd ra interval command.
- lifetime 0 the configured domain suffix is not to be used.
- lifetime 1 to 4294967295 specifies the lifetime period for this domain suffix in seconds.

Example

These commands create a DNSSL for interface vlan 200 to include in its neighbor-discovery route advertisements, and set its lifetime value to 300 seconds.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra dns-suffix test.com lifetime 300
switch(config-if-Vl200)#

ipv6 nd ra dns-suffixes lifetime

The ipv6 nd ra dns-suffixes lifetime command sets the default value that the configuration mode interface uses for the lifetime of any DNS Search List (DNSSL) configured on the interface. A lifetime value set for an individual DNSSL overrides this value. The lifetime value is the maximum amount of time after a route advertisement packet is sent that the DNSSL included in the packet may be used for name resolution.

The no ipv6 nd ra dns-suffixes lifetime and default ipv6 nd ra dns-suffixes lifetime commands remove the default lifetime value from the interface by removing the corresponding ipv6 nd ra dns-suffixes lifetime command from running-config. When there is no default DNSSL lifetime value configured on the interface, a DNSSL without a custom lifetime value will default to 1.5 times the RA interval configured on the interface. A lifetime of zero seconds means that the DNSSL must not be used for name resolution.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd ra dns-suffixes lifetime period

no ipv6 nd ra dns-suffixes lifetime

default ipv6 nd ra dns-suffixes lifetime

Parameters

period the DNSSL lifetime value for the configuration mode interface. Options include:

0 any DNSSL configured on the command mode interface without a custom lifetime value must not be used.
1 to 4294967295 maximum DNSSL lifetime value for the configuration mode interface. This value is overridden by any lifetime value set with the ipv6 nd ra dns-suffix command. Should be between the RA interval configured on the interface and two times that interval.

Example

This command sets the default DNSSL maximum lifetime value for interface vlan 200 to 350 seconds.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra dns-suffixes lifetime 350
switch(config-if-Vl200)#

ipv6 nd ra hop-limit

The ipv6 nd ra hop-limit command sets a suggested hop-limit value to be included in Router Advertisement (RA) packets. The hop-limit value is to be used by attached hosts in outgoing packets.

The no ipv6 nd ra hop-limit and default ipv6 nd ra hop-limit commands remove the corresponding ipv6 nd ra hop-limit command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd ra hop-limit quantity

no ipv6 nd ra hop-limit lifetime

default ipv6 nd ra hop-limit lifetime

Parameters

quantity the hop-limit value to be included in RA packets sent by the configuration mode interface. Options include:

0 indicates that outgoing packets from attached hosts are to be immediately discarded.
1 to 255 number of hops. The default value is 64.

Example

These commands include a hop-limit value of 100 in RA packets sent by interface vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra hop-limit
switch(config-if-Vl200)#

ipv6 nd ra interval

The ipv6 nd ra interval command configures the interval between IPv6 Router Advertisement transmissions from the configuration mode interface.

The no ipv6 nd ra interval and default ipv6 nd ra interval commands return the IPv6 RA transmission interval for the configuration mode interface to the default value of 200 seconds by removing the corresponding ipv6 nd ra interval command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd ra interval [SCALE] ra_period [minimum_period]

no ipv6 nd ra interval

default ipv6 nd ra interval

Parameters

SCALE timescale in which command parameter values are expressed.
- no parameter seconds.
- msec milliseconds.
ra_period maximum interval between successive IPv6 RA transmissions. The default period is 200 seconds.
- 4 - 1800 valid range when SCALE is set to default value (seconds).
- 500 - 1800000 valid range when SCALE is set to msec.
minimum_period minimum interval between successive IPv6 RA transmissions. Must be smaller than ra_period. By default, a minimum period is not defined.
- no parameter Command does not specify a minimum period.
- 3 - 1799 valid range when scale is set to default value (seconds).
- 375 - 1799999 valid range when scale is set to msec.

Example

These commands configure a RA transmission interval of 60 seconds on VLAN interface interface vlan 200, then displays the interface status.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra interval 60
switch(config-if-Vl200)# show active
interface Vlan200
   ipv6 nd ra interval 60
switch(config-if-Vl200)#

ipv6 nd ra lifetime

The ipv6 nd ra lifetime command specifies the value that the switch places in the router lifetime field of IPv6 Router Advertisements sent from the configuration mode interface.

If the value is set to 0, IPv6 peers connected to the specified interface will remove the switch from their lists of default routers. Values greater than 0 indicate the time in seconds that peers should keep the router on their default router lists without receiving further RAs from the switch. Unless the value is 0, the router lifetime value should be equal to or greater than the interval between unsolicited RAs sent on the interface.

The no ipv6 nd ra lifetime and default ipv6 nd ra lifetime commands return the IPv6 RA lifetime data entry filed for the configuration mode interface to the default value of 1800 seconds by removing the corresponding ipv6 nd ra lifetime command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd ra lifetime ra_lifetime

no ipv6 nd ra lifetime

default ipv6 nd ra lifetime

Parameters

ra_lifetime router lifetime period (seconds). Default value is 1800. Options include:

0 Router should not be considered as a default router.
1 - 65535 Lifetime period advertised in RAs. Should be greater than or equal to the interval between IPv6 RA transmissions from the configuration mode interface as set by the ipv6 nd ra interval command.

Example

This command configures the switch to enter 2700 in the router lifetime field of RAs transmitted from interface vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra lifetime 2700
switch(config-if-Vl200)# show active
interface Vlan20
   ipv6 nd ra lifetime 2700
switch(config-if-Vl200)#

ipv6 nd ra mtu suppress

The ipv6 nd ra mtu suppress command suppresses the Router Advertisement (RA) MTU option on the configuration mode interface. The MTU option causes an identical MTU value to be advertised by all nodes on a link. By default, the RA MTU option is not suppressed.

The no ipv6 nd ra mtu suppress and default ipv6 nd ra mtu suppress commands restores the MTU option setting to enabled by for the configuration mode interface by removing the corresponding ipv6 nd ra mtu suppress command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd ra mtu suppress

no ipv6 nd ra mtu suppress

default ipv6 nd ra mtu suppress

Example

This command suppresses the MTU option on interface vlan 200.

switch(config)# interface vlan 200
switch(config-vl200)# ipv6 nd ra mtu suppress
switch(config-vl200)#

ipv6 nd ra rx accept default-route

The ipv6 nd ra rx accept default-route command configures the interface to accept the default gateway information from the Router Advertisement (RA) in the interface configuration. EOS disables this parameter by default. The no and default versions of the command disables the feature.

Command Mode

Interface Configuration Mode

Command Syntax

ipv6 nd ra rx accept default

Parameters

ipv6 - Specifies using the IPv6 address family.
nd - Specifies Neighbor Discovery and Router Advertisement.
ra - Specifies using Router Advertisement commands.
rx - Specifies the action on the receiving RA.
accept - Specifies accepting the information on the RA.
default-route- Specifies accepting the default gateway information from the RA.

Example

Use the following commands to add the parameter to interface Ethernet3/1:

switch(config)# interface Ethernet3/1
switch(config-if-Et3/1) ipv6 nd ra rx accept default-route

ipv6 nd reachable-time

The ipv6 nd reachable-time command specifies the time period that the switch includes in the reachable time field of RAs sent from the configuration mode interface. The reachable time defines the period that a remote IPv6 node is considered reachable after a reachability confirmation event.

RAs that advertise zero seconds indicate that the router does not specify a reachable time. The default advertisement value is 0 seconds. The switch reachability default period is 30 seconds.

The no ipv6 nd reachable-time and default ipv6 nd reachable-time commands restore the entry of the default value (0) in RAs sent from the configuration mode interface by deleting the corresponding ipv6 nd reachable-time command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd reachable-time period

no ipv6 nd reachable-time

default ipv6 nd reachable-time

Parameter

period Reachable time value (milliseconds). Value ranges from 0 to 4294967295. Default is 0.

Example

These commands configure the entry of 25000 (25 seconds) in the reachable time field of RAs sent from interface vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd reachable-time 25000
interface Vlan200
   ipv6 address fd7a:4321::1/64
   ipv6 nd reachable-time 25000
switch(config-if-Vl200)#

ipv6 nd router-preference

The ipv6 nd router-preference command specifies the value that the switch enters in the Default Router Preference (DRP) field of Router Advertisements (RAs) that it sends from the configuration mode interface. The default field entry value is medium.

The no ipv6 nd router-preference and default ipv6 nd router-preference commands restore the switch to enter the default DRP field value of medium in RAs sent from the configuration mode interface by deleting the corresponding ipv6 nd router-preference command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 nd router-preference [RANK [high | low | medium]]

no ipv6 nd router-preference

default ipv6 nd router-preference

Parameters

RANK Router preference value. Options include:

high
low
medium

Example

This command configures the switch as a medium preference router on RAs sent from interface vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd router-preference medium
switch(config-if-Vl200)#

ipv6 neighbor cache persistent

The ipv6 neighbor cache persistent command restores the IPv6 neighbor cache after reboot.

The no ipv6 neighbor cache persistent and default ipv6 neighbor cache persistent commands remove the ARP cache persistant configuration from the running-config.

Command Mode

Global Configuration

Command Syntax

ipv6 neighbor cache persistent

no ipv6 neighbor cache persistent

default ipv6 neighbor cache persistent

Example

This command restores the ipv6 neighbor cache after reboot.

switch(config)# ipv6 neighbor cache persistent
switch(config)#

ipv6 neighbor

The ipv6 neighbor command creates an IPv6 neighbor discovery cache static entry. The command converts pre-existing dynamic cache entries for the specified address to static entries.

The no ipv6 neighbor and default ipv6 neighborcommands remove the specified static entry from the IPV6 neighbor discovery cache and delete the corresponding ipv6 neighbor command from running-config. These commands do not affect any dynamic entries in the cache.

Command Mode

Global Configuration

Command Syntax

ipv6 neighbor ipv6_addr PORT mac_addr

no ipv6 neighbor ipv6_address PORT

default ipv6 neighbor ipv6_addr PORT

Parameters

ipv6_addr Neighbor’s IPv6 address.
PORT Interface through which the neighbor is accessed. Options include:
- ethernet e_num Ethernet interface specified by e_num.
- loopback l_num Loopback interface specified by l_num.
- management m_num Management interface specified by m_num.
- port-channel p_num Port-channel interface specified by p_num.
- vlan v_num VLAN interface specified by v_num.
- VXLAN vx_num VXLAN interface specified by vx_num.
- mac_addr Neighbor’s data-link (hardware) address. (48-bit dotted hex notation – H.H.H).

Example

This command will add a static entry to the neighbor discovery cache for the neighbor located at 3100:4219::3EF2 with hardware address 0100.4EA1.B100 and accessible through vlan 200.

switch(config)# ipv6 neighbor 3100:4219::3EF2 vlan 200 0100.4EA1.B100
switch(config)#

ipv6 route

The ipv6 route command creates an IPv6 static route. The destination is a IPv6 prefix; the source is an IPv6 address or a routable interface port. When multiple routes exist to a destination prefix, the route with the lowest administrative distance takes precedence.

By default, the administrative distance assigned to static routes is 1. Assigning a higher administrative distance to a static route configures it to be overridden by dynamic routing data. For example, a static route with a distance value of 200 is overridden by OSPF intra-area routes, which have a default distance of 110.

The command provides these methods of designating the nexthop location:

null0: Traffic to the specified destination is dropped.
IPv6 gateway: Switch identifies egress interface by recursively resolving the next-hop.
Egress interface: Switch assumes destination subnet is directly connected to interface; when routing to any subnet address, the switch sends an ARP request to find the MAC address for the first packet.
Combination Egress interface and IPv6 gateway: Switch does not assume subnet is directly connected to interface; the only ARP traffic is for the nexthop address for the first packet on the subnet. Combination routes are not recursively resolved.

Multiple routes that are configured to the same destination with the same administrative distance comprise an Equal Cost Multi-Path (ECMP) route. The switch attempts to spread outbound traffic across all ECMP route paths equally. All ECMP paths are assigned the same tag value; commands that change the tag value of any ECMP path change the tag value of all paths in the ECMP.

The no ipv6 route and default ipv6 route commands delete static routes by removing the corresponding ipv6 route statements from running-config. Commands not including a source delete all statements to the destination. Only statements with parameters that match specified command arguments are deleted. Parameters that are not in the command line are not evaluated.

Command Mode

Global Configuration

Command Syntax

ipv6 route dest_prefix next-hop [distance][tag_opt][rt_name]

no ipv6 route dest_prefix [nexthop_addr][distance]

default ipv6 route dest_prefix [nexthop_addr][distance]

Parameters

dest_prefix Destination IPv6 prefix (CIDR notation).
next-hop Access method of next hop device. Options include:
- null0 Null0 interface – route is dropped.
- nexthop_addr IPv6 address of nexthop device.
- ethernet e_num Ethernet interface specified by e_num.
- loopback l_num Loopback interface specified by l_num.
- management m_num Management interface specified by m_num.
- port-channel p_num Port-channel interface specified by p_num.
- vlan v_num VLAN interface specified by v_num.
- VXLAN vx_num VXLAN interface specified by vx_num.
- ethernet e_num nexthop_addr Combination route (Ethernet interface and gateway).
- loopback l_num nexthop_addr Combination route (loopback interface and gateway).
- management m_num nexthop_addr Combination route (management interface and gateway).
- port-channel p_num nexthop_addr Combination route (port channel interface and gateway).
- vlan v_num nexthop_addr Combination route (VLAN interface and gateway).
- VXLAN vx_num nexthop_addr Combination route (VXLAN interface and gateway).
distance administrative distance assigned to route. Options include:
- no parameter route assigned default administrative distance of one.
- 1 to 255 The administrative distance assigned to route.
TAG_OPT static route tag. Options include:
- no parameter assigns default static route tag of 0.
- tag 0 to 4294967295 Static route tag value.
RT_NAME Associates descriptive text to the route. Options include:
- no parameter No text is associated with the route.
- name descriptive_text The specified text is assigned to the route.
auto p2p interface Specify automatic link-local next-hop discovery on an interface.

Example

This command creates an IPv6 static route.

switch(config)# ipv6 route 10:23:31:00:01:32:93/24 vlan 300

ipv6 unicast-routing

The ipv6 unicast-routing command enables the forwarding of IPv6 unicast packets. When routing is enabled, the switch attempts to deliver inbound packets to destination addresses by forwarding them to interfaces or next hop addresses specified by the IPv6 routing table.

The no ipv6 unicast-routing and default ip ipv6 unicast-routing commands disable IPv6 unicast routing by removing the ipv6 unicast-routing command from running-config. Dynamic routes added by routing protocols are removed from the routing table. Static routes are preserved by default; the delete-static-routes option removes static entries from the routing table.

IPv6 unicast routing is disabled by default.

Command Mode

Global Configuration

Command Syntax

ipv6 unicast-routing

no ipv6 unicast-routing [DELETE_ROUTES]

default ipv6 unicast-routing [DELETE_ROUTES]

Parameters

DELETE_ROUTES Resolves routing table static entries when routing is disabled.

no parameter Routing table retains static entries.
delete-static-routes Static entries are removed from the routing table.

Example

This command enables IPv6 unicast-routing.

switch(config)# ipv6 unicast-routing
switch(config)#

ipv6 verify

The ipv6 verify command configures Unicast Reverse Path Forwarding (uRPF) for inbound IPv6 packets on the configuration mode interface. uRPF verifies the accessibility of source IP addresses in packets that the switch forwards.

uRPF defines two operational modes: strict mode and loose mode.

Strict mode: uRPF also verifies that a packet is received on the interface that its routing table entry specifies for its return packet.
Loose mode: uRPF validation does not consider the inbound packet’s ingress interface.

The no ipv6 verify and default ipv6 verify commands disable uRPF on the configuration mode interface by deleting the corresponding ipv6 verify command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 verify unicast source reachable-via RPF_MODE

no ipv6 verify unicast

default ipv6 verify unicast

Parameters

RPF_MODE Specifes the uRPF mode. Options include:

any Loose mode.
rx Strict mode.
rx allow-default Strict mode. All inbound packets are forwarded if a default route is defined.

Guidelines

The first IPv6 uRPF implementation briefly disables IPv6 unicast routing. Subsequent ip verify commands on any interface do not disable IPv6 routing.

Example

This command enables uRPF strict mode on interface vlan 100. When a default route is configured on the interface, all inbound packets are checked as valid.

switch(config)# interface vlan 100
switch(config-if-Vl100)# ipv6 verify unicast source reachable-via rx allow-default
switch(config-if-Vl100)# show active
 interface Vlan100
   ipv6 verify unicast source reachable-via rx allow-default
switch(config-if-Vl100)#

ipv6 dhcp snooping

The ipv6 dhcp snooping command enables DHCP snooping globally on the switch.

The no ipv6 dhcp snooping and default ipv6 dhcp snooping commands disable global DHCP snooping by removing the ipv6 dhcp snooping command from running-config.

Command Mode

Global Configuration

Command Syntax

ipv6 dhcp snooping [remote-id option | vlan [$ | vlan-range]]

no ipv6 dhcp snooping [remote-id option | vlan [$ | vlan-range]]

default ipv6 dhcp snooping [remote-id option | vlan [$ | vlan-range]]

Parameters

remote-id option configures the remote ID option.
vlan enables IPv6 DHCP snooping for a specific VLAN. Numbers range from 1 to 4094.
$ end of range.
vlan-range VLANs based on the snooping enabled. Formats include a number, a number range, or a comma-delimited list of numbers and ranges. Numbers range from 1 to 4094.

Examples

The following configuration enables IPv6 DHCP snooping feature at the global level.

switch(config)# ipv6 dhcp snooping
switch(config)# ipv6 dhcp snooping remote-id option
switch(config)# ipv6 dhcp snooping vlan <vlan|vlan-range>

The following command display IPv6 DHCP snooping state.

switch(config)# ipv6 dhcp snooping
switch(config)# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
  2789-2790
DHCPv6 Snooping is operational on following VLANs:
  2789
Insertion of Option-37 is enabled

pim ipv6 sparse-mode

The pim ipv6 sparse-mode command enables PIM Sparse Mode (PIM-SM) and IGMP (router mode) on the configuration mode interface.

Note: PIM and multicast border router (MBR) must be mutually exclusive on an interface. If the interface is configured as an MBR, do not enable PIM on the interface.

The no pim ipv6 sparse-mode and default pim ipv6 sparse-mode commands restore the default PIM and IGMP (router mode) settings of disabled on the configuration mode interface by removing the pim ipv6 sparse-mode command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel

Configuration Interface-VLAN Configuration

Command Syntax

pim ipv6 sparse-mode

no pim ipv6

no pim ipv6 sparse-mode

default pim ipv6

default pim ipv6 sparse-mode

Example

This command enables pim ipv6 sparse-mode on interface vlan 4 interface.

switch(config)# interface vlan 4
switch(config-if-Vl4)# pim ipv6 sparse-mode
switch(config-if-Vl4)#

show ipv6 dhcp relay counters

The show ipv6 dhcp relay counters command displays the number of DHCP packets received, forwarded, or dropped on the switch and on all interfaces enabled as DHCP relay agents.

Command Mode

EXEC

Command Syntax

show ipv6 dhcp relay counters

Example

This command displays the IP DHCP relay counter table.

switch> show ipv6 dhcp relay counters
          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  376  376    0 | 4 days, 19:55:12 ago
 All Resp |  277  277    0 |
          |                |
Ethernet4 |  207  148    0 | 4 days, 19:54:24 ago

switch>

show ipv6 dhcp snooping

The show ipv6 dhcp snooping command displays information about the DHCP snooping configuration.

Command Mode

EXEC

Command Syntax

show ipv6 dhcp snooping

Related Commands

Example

This command displays the switch’s DHCP snooping configuration.

switch# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
  2789-2790
DHCPv6 Snooping is operational on following VLANs:
  2789
Insertion of Option-37 is enabled

show ipv6 dhcp snooping counters

The show ipv6 dhcp snooping counters command displays counters that track the quantity of DHCP request and reply packets that the switch receives. Data is either presented for each VLAN or aggregated for all VLANs with counters for packets dropped.

Command Mode

EXEC

Command Syntax

show ipv6 dhcp snooping counters [COUNTER_TYPE]

Parameters

COUNTER_TYPE The type of counter that the command displays.
no parameter command displays counters for each VLAN.
debug command displays aggregate counters and drop cause counters.

Examples

This command displays the number of DHCP packets sent and received on each VLAN.

switch# show ipv6 dhcp snooping counters

     | Dhcpv6 Request Pkts | Dhcpv6 Reply Pkts | 
Vlan |  Rcvd   Fwdd   Drop |  Rcvd  Fwdd  Drop | Last Cleared
-----|------ ------ -------|------ ----- ------|------------- 
2789 |     1      1      0 |     1     1     0 |  0:03:09 ago

This command displays the number of DHCP packets sent on the switch.

switch# show ipv6 dhcp snooping counters debug

Counter                       Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received                                      1                 1
Forwarded                                     1                 1
Dropped - Invalid VlanId                      0                 0
Dropped - Parse error                         0                 0
Dropped - Invalid Dhcp Optype                 0                 0
Dropped - Invalid Remote-ID Option            0                 0
Dropped - Snooping disabled                   0                 0

Last Cleared:  0:04:29 ago

show ipv6 dhcp snooping hardware

The show ipv6 dhcp snooping hardware command displays internal hardware DHCP snooping status on the switch.

Command Mode

EXEC

Command Syntax

show ipv6 dhcp snooping hardware

Example

This command displays DHCP snooping hardware status.

switch# show ipv6 dhcp snooping hardware
DHCPv6 Snooping is enabled
DHCPv6 Snooping is enabled on following VLANs:
    2789
    Vlans enabled per Slice
        Slice:  Linecard0-0
        2789
        Slice:  Linecard0-1
        2789
        Slice:  Linecard0-2
        2789
        Slice:  Linecard0-3
        2789

show ipv6 hardware fib aggregate-address

The show ipv6 hardware fib aggregate-address command displays the IPv6 prefixes that are restricted from entry into the hardware routing table. The ipv6 hardware fib aggregate-address command configures IPv6 prefix restictions.

Command Mode

EXEC

Command Syntax

show ipv6 address fib aggregate-address [ADDRESS][RESTRICTION]

Parameters

ROUTE_FILTER filters by IPv6 address. Options include:
- no parameter Displays all routes.
- ipv6_addr Command displays only specified address.
- ipv6_prefix Command displays addresses filtered by specified prefix (CIDR notation).
RESTRICTION filters by route restriction.
- no parameter displays routes restricted from the hardware routing table.
- software-forward displays routes restricted from the hardware routing table.

Example

This command displays the routes that are restricted from the hardware routing table.

switch> show ipv6 hardware fib aggregate-address
Codes: S - Software Forwarded
S  fd77:4890:5313:aaed::/64
S  fd77:4890:5313:ffed::/64

switch>

show ipv6 interface

The ipv6 interface command displays the status of specified routed interfaces that are configured for IPv6.

Command Mode

EXEC

Command Syntax

show ipv6 interface [INTERFACE_NAME][INFO_LEVEL]

Parameters

INTERFACE_NAME interfaces for which command displays status.
- no parameter all routed interfaces.
- ethernet e_num Ethernet interface specified by e_num.
- loopback l_num Loopback interface specified by l_num.
- management m_num Management interface specified by m_num.
- port-channel p_num Port-Channel Interface specified by p_num.
- vlan v_num VLAN interface specified by v_num.
- VXLAN vx_num VXLAN interface specified by vx_num.
INFO_LEVEL amount of information that is displayed. Options include:
- no parameter command displays data block for each specified interface.
- brief command displays table that summarizes IPv6 interface data.

Example

This command displays the status of interface vlan 903.

switch> show ipv6 interface vlan 903
Vlan903 is up, line protocol is up (connected)
  IPv6 is enabled, link-local is fe80::21c:73ff:fe01:21e/64
  Global unicast address(es):
    fd7a:629f:52a4:fe10::3, subnet is fd7a:629f:52a4:fe10::/64
  Joined group address(es):
    ff02::1
    ff02::1:ff01:21e
    ff02::1:ff00:3
    ff01::2
switch>

show ipv6 nd dad proxy

Display information about the IPv6 Duplicate Address Detection (DAD) feature configured on an interface.

Command Mode

Interface-Ethernet Configuration

Command Syntax

show ipv6 nd dad proxy

Example

The following example displays information about IPV6 DAD Proxy on Ethernet1:

switch# show ipv6 nd dad interface ethernet1/1
Ethernet1/1
ipv6 nd proxy prefix connected
ipv6 nd dad proxy
ipv6 address 2001:db8:3::/64

show ipv6 nd ra internal state

The ipv6 nd ra internal state command displays the state of the IPv6 Router Advertisement (RA) daemon for the specified routable interface.

Command Mode

EXEC

Command Syntax

show ipv6 nd ra internal state [INTERFACE_NAME]

Parameters

INTERFACE_NAME interfaces for which command displays status.

no parameter all routed interfaces.
ethernet e_num Ethernet interface specified by e_num.
loopback l_num Loopback interface specified by l_num.
management m_num Management interface specified by m_num.
port-channel p_num Port-Channel Interface specified by p_num.
vlan v_num VLAN interface specified by v_num.
VXLAN vx_num VXLAN interface specified by vx_num.

Example

This command displays the IPv6 RA daemon for vlan 1243.

switch> show ipv6 nd ra internal state vlan 1243
INTERFACE: Vlan3908
                                ifindex : 0x00000021
                                    mtu : 9212
                            numIpv6Addr : 2
                   numPrefixToAdvertise : 0
                    numPrefixToSuppress : 0
                             RaSuppress : 0
                          RsRspSuppress : 0
                      raIntervalMaxMsec : 200000
                      raIntervalMinMsec : 0
                      managedConfigFlag : 0
                        otherConfigFlag : 0
                          raMtuSuppress : 0
                             raLifetime : 1800
                         reacheableTime : 0
                       routerPreference : 0
                             lastRaTime : 2012-05-01 09:22:57.020634
                      lastRsRspSentTime :
                            nextTimeout : 171.474535 (sec)
                  raNotSentIntfNotReady : 0
                              numRaSent : 219
                              numRsRcvd : 0
                        numRsSuppressed : 0
                           numRsRspSent : 0
            numRsDroppedInvalidHopLimit : 0
            numPktDroppedUnexpectedType : 0
                            initialized : 1

show ipv6 neighbors

The show ipv6 neighbors command displays the IPv6 neighbor discovery cache. The command provides filters to restrict the list to a specified IPv6 address or routable interface.

Command Mode

EXEC

Command Syntax

show ipv6 neighbors [PORT][SOURCE][INFO_LEVEL]

Parameters

PORT Filters by interface through which neighbor is accessed. Options include:
- no parameter all routed interfaces.
- ethernet e_num Ethernet interface specified by e_num.
- loopback l_num Loopback interface specified by l_num.
- management m_num Management interface specified by m_num.
- port-channel p_num Port-channel interface specified by p_num.
- vlan v_num VLAN interface specified by v_num.
- VXLAN vx_num VXLAN interface specified by vx_num.
SOURCE Filters by neighbor IPv6 address. Options include:
- no parameter all IPv6 neighbors.
- ipv6_addr IPv6 address of individual neighbor.
INFO_LEVEL amount of information that is displayed. Options include:
- no parameter command displays the discovery cache for the specified interfaces.
- summary command displays summary information only.

Example

This command displays the IPv6 neighbor discovery cache for IPv6 address fe80::21c:73ff:fe01:5fe1.

switch> show ipv6 neighbors fe80::21c:73ff:fe01:5fe1
IPv6 Address                              Age Hardware Addr    State Interface
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Et12
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Po999
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Vl102
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Vl103
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Vl205
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Vl207
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Vl3901
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Vl3902
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Vl3903
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Vl3904
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Vl3905
fe80::21c:73ff:fe01:5fe1                    0 001c.d147.8214   REACH Vl3996

show ipv6 route

The show ipv6 route command displays IPv6 routing table entries that are in the Forwarding Information Base (FIB), including static routes, routes to directly connected networks, and dynamically learned routes. Multiple equal cost paths to the same prefix are displayed contiguously as a block, with the destination prefix displayed only on the first line.

The show running-config command displays all configured routes.

Command Mode

EXEC

Command Syntax

show ipv6 route [ADDRESS][ROUTE_TYPE][INFO_LEVEL]

Parameters

ADDRESS, when present, is always listed first. All other parameters can be placed in any order.

ADDRESS filters routes by IPv6 address or prefix.
- no parameter all routing table entries.
- ipv6_address routing table entries matching specified IPv6 address.
- ipv6_prefix routing table entries matching specified IPv6 prefix (CIDR notation).
ROUTE_TYPE filters routes by specified protocol or origin.
- no parameter all routing table entries.
- aggregate entries for BGP aggregate routes.
- bgp entries added through BGP protocol.
- connected entries for routes to networks directly connected to the switch.
- kernel entries appearing in Linux kernel but not added by EOS software.
- isis entries added through IS-IS protocol.
- ospf entries added through OSPF protocol.
- static entries added through CLI commands.
INFO_LEVEL Filters entries by next hop connection.
- no parameter filters routes whose next hops are directly connected.
- detail displays all routes.

Examples

This command displays a route table entry for a specific IPv6 route.

switch> show ipv6 route fd7a:3418:52a4:fe18::/64
IPv6 Routing Table - 77 entries
Codes: C - connected, S - static, K - kernel, O - OSPF, B - BGP, R - RIP, A - 
Aggregate

O   fd7a:3418:52a4:fe18::/64 [10/20]
     via fe80::21c:73ff:fe00:1319, Vlan3601
     via fe80::21c:73ff:fe00:1319, Vlan3602
     via fe80::21c:73ff:fe00:1319, Vlan3608
     via fe80::21c:73ff:fe0f:6a80, Vlan3610
     via fe80::21c:73ff:fe00:1319, Vlan3611

This example displays an IPv6 route with Forwarding Equivalency Class (FEC) with an IPv6 next hop and an IPv4 next hop route.

# show ipv6 route 2001:1::/64
VRF: default
Routing entry for 2001:1::/64
Source Codes:
      C - connected, S - static, K - kernel, O3 - OSPFv3,
      B - Other BGP Routes, A B - BGP Aggregate, R - RIP,
      I L1 - IS-IS level 1, I L2 - IS-IS level 2, DH - DHCP,
      NG - Nexthop Group Static Route, M - Martian,
      DP - Dynamic Policy Route, L - VRF Leaked,
      G  - gRIBI, RC - Route Cache Route,
      CL - CBF Leaked Route
                
B I      2001:1::/64 [200/0]
            via 2001:2:0:40::2, Ethernet1
            via 10.0.0.2, Ethernet3, backup

show ipv6 route age

The show ipv6 route age command displays the IPv6 route age to the specified IPv6 address or prefix.

Command Mode

EXEC

Command Syntax

show ipv6 route ADDRESS age

Parameters

ADDRESS filters routes by IPv6 address or prefix.

ipv6_address routing table entries matching specified address (A:B:C:D:E:F:G:H).
ipv6_prefix routing table entries matching specified IPv6 prefix (A:B:C:D:E:F:G:H/PL).

Example

This command displays the route age for the specified prefix.

switch> show ipv6 route 2001::3:0/11 age
IPv6 Routing Table - 74 entries
Codes: C - connected, S - static, K - kernel, O - OSPF, B - BGP, R - RIP, A - 
Aggregate

C 2001::3:0/11 age 00:02:34

show ipv6 route host

The show ipv6 route host command displays all host routes in the IPv6 host forwarding table. Host routes are those whose destination prefix is the entire address (prefix =/128). Each displayed host route is labeled with its purpose:

F static routes from the FIB.
A routes to any neighboring host for which the switch has an ARP entry.
R routes defined because the IP address is an interface address.

Command Mode

EXEC

Command Syntax

show ipv6 route host

Example

This command displays all IPv6 host routes in the host forwarding table.

switch> show ipv6 route host
R - receive F - FIB, A - attached

 F  ::1 to cpu
 A  fee7:48a2:0c11:1900:400::1 on Vlan102
 R  fee7:48a2:0c11:1900:400::2 to cpu
 F  fee7:48a2:0c11:1a00::b via fe80::21c:73ff:fe0b:a80e on Vlan3902
 R  fee7:48a2:0c11:1a00::17 to cpu
 F  fee7:48a2:0c11:1a00::20 via fe80::21c:73ff:fe0b:33e on Vlan3913
 F  fee7:48a2:0c11:1a00::22 via fe80::21c:73ff:fe01:5fe1 on Vlan3908
                            via fe80::21c:73ff:fe01:5fe1 on Vlan3902

show ipv6 route interface

The show ipv6 route interface command displays routing table entries on a specified routed port.

Command Mode

EXEC

Command Syntax

show ipv6 route [ADDRESS] interface PORT_NAME [INFO_LEVEL]

Parameters

ADDRESS, when present, is always listed first. All other parameters can be placed in any order.

ADDRESS filters routes by IPv6 address or prefix.
- no parameter all routing table entries.
- ipv6_address routing table entries matching specified IPv6 address.
- ipv6_prefix routing table entries matching specified IPv6 prefix (CIDR notation).
PORT_NAME interfaces for which command displays status.
- ethernet e_num Ethernet interface specified by e_num.
- loopback l_num Loopback interface specified by l_num.
- management m_num Management interface specified by m_num.
- port-channel p_num Port-Channel Interface specified by p_num.
- vlan v_num VLAN interface specified by v_num.
- VXLAN vx_num VXLAN interface specified by vx_num.
INFO_LEVEL Filters entries by next hop connection.
- no parameter filters routes whose next hops are directly connected.
- detail displays all routes.

Example

This command displays the IPv6 routes in interface ethernet 8.

switch> show ipv6 route interface ethernet 8
IPv6 Routing Table - 77 entries
Codes: C - connected, S - static, K - kernel, O - OSPF, B - BGP, R - RIP, A - 
Aggregate

O   fd7a:629f:63af:1232::/64 [150/11]
     via fe80::823c:73ff:fe00:3640, Ethernet8
O   fd7a:629f:63af:4118::/64 [150/11]
     via fe80::823c:73ff:fe00:3640, Ethernet8
O   fd7a:629f:63af:4119::/64 [150/11]
     via fe80::823c:73ff:fe00:3640, Ethernet8
O   fd7a:629f:63af:411a::/64 [150/11]
     via fe80::823c:73ff:fe00:3640, Ethernet8
O   fd7a:629f:63af:fe78::/64 [150/11]
     via fe80::823c:73ff:fe00:3640, Ethernet8
C   fd7a:629f:63af:fe88::/64 [0/1]
     via ::, Ethernet12
O   fd7a:629f:63af:fe8c::/64 [10/20]
     via fe80::21c:73ff:fe00:3640, Ethernet8
C   fe80:0:40::/64 [0/1]
     via ::, Ethernet8

show ipv6 route match tag

The show ipv6 route match tag command displays the route tag assigned to the specified IPv6 address or prefix. Route tags are added to static routes for use by route maps.

Command Mode

EXEC

Command Syntax

show ipv6 route ADDRESS match tag

Parameters

ADDRESS filters routes by IPv6 address or prefix.

ipv6_address routing table entries matching specified address (A:B:C:D:E:F:G:H).
ipv6_prefix routing table entries matching specified IPv6 prefix (A:B:C:D:E:F:G:H/PL).

Example

This command displays the route tag for the specified prefix.

switch> show ipv6 route 2001:0DB8::/64 match tag
IPv6 Routing Table - 74 entries
Codes: C - connected, S - static, K - kernel, O3 - OSPFv3, B - BGP, R - RIP, A B 
- BGP Aggregate, I L1 - IS-IS level 1, I L2 - IS-IS level 2, DH - DHCP, NG - 
Nexthop Group Static Route, M - Martian, DP - Dynamic Policy Route, L - VRF Leaked

C   2001:0DB8::/64 tag 0

show ipv6 route summary

The show ipv6 route summary command displays the information about the IPv6 routing table.

Command Mode

EXEC

Command Syntax

show ipv6 route summary

Example

This command displays the route source and the corresponding number of routes in the IPv6 routing table.

switch> show ipv6 route summary   
Route Source       Number Of Routes
------------------ ----------------
   connected                      2
   static                         0
   ospf                           5
   bgp                            7
   isis                           0
   internal                       1
   attached                       0
   aggregate                      2

   Total Routes                   17

show platform fap mroute ipv6

The show platform fap mroute ipv6 command enables PIM Sparse Mode (PIM-SM) and IGMP (router mode) on the configuration mode interface.

Command Mode

EXEC

Command Syntax

show platform fap mroute ipv6

Example

This command enables PIM sparse mode on VLAN 4 interface.

switch# show platform fap mroute ipv6
Jericho0 Multicast Routes:
--------------------------
Location  GroupId Group               Source         IIF      McId    OIF
FLP/TT    FLP/TT  TT                  FLP            FLP      FLP     FLP
----------------------------------------------------------------------------------------------------
4096/2048 1/1     ff33::1:0:0:23/128  101:1::2/128   Vlan1357 21504   Vlan1044(Et7/1) Vlan1123(Et9/1)
                                                                      Vlan1200(Et8/1) Vlan1223(Et2/1)
                                                                      Vlan1226(Et5/1) Vlan1232(Et3/1)
                                                                      Vlan1307(Et6/1) Vlan1337(Et4/1)

show rib route ipv6

The show rib route ipv6 command displays a list of IPv6 Routing Information Base (RIB) routes.

Command Mode

EXEC

Command Syntax

show rib route ipv6 [vrf vrf_name] [PREFIX][ROUTE TYPE]

Parameters

vrf vrf_name displays RIB routes from the specified VRF.
PREFIX displays routes filtered by the specified IPv6 information. Options include:
- ipv6_address displays RIB routes filtered by the specified IPv6 address.
- ipv6_subnet_mask displays RIB routes filtered by the specified IPv6 address and subnet mask.
- ipv6_prefix displays RIB routes filtered by the specified IPv6 prefix.
ROUTE TYPE displays routes filtered by the specified route type. Options include:
- bgp displays RIB routes filtered by BGP.
- connected displays RIB routes filtered by connected routes.
- dynamicPolicy displays RIB routes filtered by dynamic policy routes.
- host displays RIB routes filtered by host routes.
- isis displays RIB routes filtered by ISIS routes.
- ospf displays RIB routes filtered by OSPF routes.
- ospf3 displays RIB routes filtered by OSPF3 routes.
- reserved displays RIB routes filtered by reserved routes.
- route-input displays RIB routes filtered by route-input routes.
- static displays RIB routes filtered by static routes.

Examples

This command displays IPv6 RIB BGP routes.

switch# show rib route ipv6 bgp
VRF name: default, VRF ID: 0xfe, Protocol: bgp
Codes: C - Connected, S - Static, P - Route Input
       B - BGP, O - Ospf, O3 - Ospf3, I - Isis
       > - Best Route, * - Unresolved Nexthop
       L - Part of a recursive route resolution loop
 B    2001:10:1::/64 [200/42]
         via 2001:10:1::100 [0/1]
            via Ethernet1, directly connected
>B    2001:10:100::/64 [200/200]
         via 2001:10:1::100 [0/1]
            via Ethernet1, directly connected
>B    2001:10:100:1::/64 [200/0]
         via 2001:10:1::100 [0/1]
            via Ethernet1, directly connected
>B    2001:10:100:2::/64 [200/42]
         via 2001:10:1::100 [0/1]
            via Ethernet1, directly connected

This command displays IPv6 RIB connected routes.

switch# show rib route ipv6 connected
VRF name: default, VRF ID: 0xfe, Protocol: connected
Codes: C - Connected, S - Static, P - Route Input
       B - BGP, O - Ospf, O3 - Ospf3, I - Isis
       > - Best Route, * - Unresolved Nexthop
       L - Part of a recursive route resolution loop
>C    2001:10:1::/64 [0/1]
         via 2001:10:1::102, Ethernet1
>C    2001:10:2::/64 [0/1]
         via 2001:10:2::102, Ethernet2
>C    2001:10:3::/64 [0/1]
         via 2001:10:3::102, Ethernet3

Configuring DHCP

Dynamic Host Configuration Protocol (DHCP) for IPv4 and IPv6 dynamically assign network configurations to end hosts without statically configure an IP address for each device on the network. However, the underlying architecture and feature sets require different configurations on the switch.

DHCP IPv4

DHCPv4 acts as an extension of the older BOOTP protocol and relies heavily on Layer 2 broadcasts to assign IPv4 addresses to a new IPv4 client on the network. The core mechanism of DHCPv4, also known as DORA, has the following four step transaction:

Discover (Broadcast) - The client sends out messages to 255.255.255.255 looking for DHCP servers on the network.
Offer (Unicast/Broadcast) - A listening DHCP server returns an IPv4 address to the client.
Request (Broadcast) - The client broadcasts an acceptance message to the DHCP server and rejects unselected DHCP servers.
Acknowledge (Unicast/Broadcast) - The DHCP server finalizes the lease and sends the client a subnet mask, gateway, and DNS servers.

DHCPv4 has the following key features:

Option 82 (Relay Agent Information) - Allows intermediates switches to inject their physical port data (Circuit ID) into the client broadcast messages before forwarding the message to a central DHCP server.
Granular Options - Relies on highly specific integer options including Option 43 for Vendor-specific data such as Wireless Controller IPs, Option 150 for TFTP servers, and Option 67 for bootfiles.
Default Gateway Assignment - The DHCP server provides the client with a default gateway (Option 3).

DHCP IPv6

DHCPv6 eliminates broadcast traffic and operates over IPv6 Multicast and works with ICMPv6 Neighbor Discovery. Instead of DORA, DHCPv6 uses a four step transaction targeting specific multicast groups, such as ff02::1:2, the All-DHCP-Relay-Agents-and-Servers address:

Solicit (Multicast) - The client sends messages on the network looking for a server.
Advertise (Unicast) - The server indicates availability and preference.
Request (Unicast) - The client requests specific parameters from the selected server.
Reply (Unicast) - The server confirms the lease and configuration.

DHCPv6 has the following key features:

Router Advertisements (RA) Dependency - A DHCPv6 client does not send a Solicit message unless a local router first sends an ICMPv6 RA with the M-Flag, Managed Configuration, or O-Flag, Other Configuration, set to 1. The router dictates how the client receives an IP address.
Stateless vs. Stateful
- Stateful (M-Flag) - The DHCPv6 server tracks leases and hands out the actual IPv6 addresses.
- Stateless (O-Flag)- The client uses Stateless Address Autoconfiguration (SLAAC) to generate an IPv6 address and only uses the DHCPv6 server to obtain extra details such as DNS servers or domain names.
Prefix Delegation (DHCPv6-PD) - A downstream router requests an entire routed subnet prefix from an upstream ISP server to assign to local VLANs.
Unified URIs (Option 59) - DHCPv6 does not use legacy options such as separating TFTP IPs and filenames in favor of consolidated URL strings.

Key Architectural Differences


Feature	DHCPv4	DHCPv6
Transport Protocol	UDP Ports 67 (Server) and 68 (Client)	UDP Ports 547 (Server) and 546 (Client)
Initial Discovery	Layer 2 Broadcast (`255.255.255.255`)	Layer 3 Multicast (`ff02::1:2`)
Default Gateway	Provided by the DHCP Server	Provided by ICMPv6 Router Advertisements
Lease Tracking	Always Stateful	Can be Stateful and Stateless
Hardware ID	Relies on the physical MAC Address	Relies on a generated DUID (DHCP Unique Identifier)

DHCP Server

The router with DHCP Server enabled acts as a server that allocates and delivers network addresses with desired configuration parameters to its hosts.

The DHCP server is based on ISC Kea.

The router with an DHCP Server enabled acts as a server that allocates and delivers network addresses with desired configuration parameters to its hosts.

DHCP Server support includes:

DHCPv4 support includes:

Configurable on different interfaces - Routed, VLAN, LAG, Sub-interface, and LAG Sub-interface.
Configurable lease time for allocated network addresses.
Configurable DNS domain.
Configurable DNS servers.
Configurable subnets with parameters:
- Default gateway
- DNS servers
- Ranges
- Lease time

Additional features for DHCP include the following:

Configurable TFTP server
Configurable TFTP bootfile

Additional features for DHCP includes the following:

Configurable Vendor options with sub options
Configurable suboption types including IPv4 address, array of IPv4 addresses, and string
TFTP bootfile now supports an URI

Additional features for DHCP include a configurable static IP address for exclusive use by a given client, based on the client’s MAC address.

Example deployment:

DHCP Server on an aggregation switch, via VXLAN tunnels.

Configuring DHCP Servers

Global DHCP server options are configured per address family and apply to all subnets. Access the commands in the DHCP Server Configuration Mode.

To enter the DHCP server global configuration mode, use the following commands:

switch# configure
switch(config)# dhcp server
switch(config-dhcp-server)#

To disable the DHCP server:

switch(config-dhcp-server)# disabled

Use the following commands to configure the DNS servers. Only two servers can be configured globally per address family.

switch(config-dhcp-server)# dns server ipv4 192.0.2.4 192.0.2.5
switch(config-dhcp-server)# dns server ipv6 2001:db8:0:10::53 2001:db8:0:10::5353

The following commands configure the domain names for allocated IP addresses. For example, add a domain with the name podV4.example.com for DHCPv4 and a domain with the name podV6.example.com for DHCPv6.

switch(config-dhcp-server)# dns domain name ipv4 podV4.example.com
switch(config-dhcp-server)# dns domain name ipv6 podV6.example.com

The following commands configure lease time for the allocated IP addresses. For example, configure the lease time as one (1) day.

switch(config-dhcp-server)# lease time ipv4 1 days 0 hours 0 minutes
switch(config-dhcp-server)# lease time ipv6 1 days 0 hours 0 minutes

The following command configures the TFTP Server-Name. The server can be in the form of either an IPv4 or IPv6 address or a fully qualified domain name. For example, configure the TFTP server with the IPv4 address, 192.0.2.6 and an TFTP server with the IPv6 address, 2601:600:cb02:d070:14b7:6ad0:bedb:ef3:

switch(config-dhcp-server)# tftp server option 66 ipv4 192.0.2.6

The following command configures the TFTP Servers.

switch(config-dhcp-server)# tftp server option 150 ipv4 192.0.2.6 192.0.2.7

The following command configures the TFTP Server Bootfile-Name for IPv4 and IPv6:

switch(config-dhcp-server)# tftp server file ipv4 bootfile.conf
switch(config-dhcp-server)# tftp server file ipv6 bootfile.conf

The following command configures Vendor specific option. To enter the Vendor Option Configuration Mode from the DHCP Server Configuration mode, specify a vendor class identifier, only available in DHCPv4. For example, Vendor option for clients with vendor class identifier vendorClassIDA.

switch(config-dhcp-server)# vendor-option ipv4 vendorClassIDA

The following command configures default. If you do not configure the default, the DHCP Server sends the configured Vendor option to clients requesting a Vendor option with a vendor class identifier that does not match any configured Vendor option.

switch(config-dhcp-server)# vendor-option ipv4 default

The following command configures suboptions for the Vendor. The configuration sends the resulting Vendor option in a hexadecimal format to the desired client. The output displays aVendor option with a suboption with IPv4 address 192.0.2.8, for clients with the vendor class identifier vendorClassIDA, resulting in Vendor option 1:4:c0:0:2:8.

Sub option number is 1
Length of the Data is 4
Data is c0:0:2:8
dhcp server
vendor-option ipv4 vendorClassIDA
sub-option 1 type ipv4-address data 192.0.2.8

The following command configures the Vendor option with IPv4 addresses 192.0.2.8 and 192.0.2.9, for clients with the vendor class identifier vendorClassIDA, resulting in the Vendor option fe:8:c0:0:2:8:c0:0:2:9.

switch(config-dhcp-server)# vendor-option ipv4 vendorClassIDA sub-option 254 type array ipv4-address data 192.0.2.8 192.0.2.9

The following command configures Vendor option with a string “vendor”, for all clients whose vendor class identifier does not match any configured Vendor option, resulting in Vendor option 1e:3:46:4f:4f..

switch(config-dhcp-server)# vendor-option ipv4 default sub-option 30 type string data "vendor"

The following command sets up Vendor option holding two suboptions, suboption 1 holds the IPv4 address 192.0.2.8, and suboption 2 holds a string “vendor”, for all clients whose vendor class identifier does not match any configured Vendor option, resulting in Vendor option 1:4:c0:0:2:8:2:3:46:4f:4f.

switch(config-dhcp-server)# vendor-option ipv4 default sub-option 1 type ipv4-address data 192.0.2.8 sub-option 2 type string data “vendor"

Configuring DHCP Server Subnets

DHCP Server settings can also be configured per subnet and overrides the DHCP Server global mode configurations. There can be multiple subnets configured, but they must not overlap. EOS disables overlapping subnets.

The following command enters DHCP Server subnet mode under the IPv4 address family.

switch# config
switch(config)# dhcp server 
switch(config-dhcp-server)# subnet 192.0.2.0/32

The following command configures the name of the subnet. For example, name subnetv4 for DHCPv4.

switch(config-dhcp-subnet-ipv4)# name subnetv4

The following command configures range of IP addresses of the subnet. The range must be within the subnet mask, otherwise the subnet becomes disabled.

switch(config-dhcp-subnet-ipv4)# range 192.0.2.100 192.0.2.199

The following command configures the DNS servers for a subnet. Configure up to 2 servers per subnet.

switch(config-dhcp-subnet-ipv4-range)# dns server 192.0.2.1 192.0.2.10

The following command configures the lease time for allocated IP addresses of the subnet.

switch(config-dhcp-subnet-ipv4)# lease time ipv4 3 days 0 hours 0 minutes

The following command configures the default-gateway for a subnet.

switch(config-dhcp-server)# subnet 192.0.2.0/32
switch(config-dhcp-subnet-ipv4)# default-gateway 192.0.2.3

The following command configures the TFTP Server-Name for a subnet. The server can be in the form of either an IPv4 address or a fully qualified domain name, but can only be configured for DHCPv4.

switch(config-dhcp-subnet-ipv4)# tftp server option 66 subnet-tftp.example.com

The following command configures a list of TFTP servers. The server can only be in the form of an IP address, but can only be configured for DHCPv4.

switch(config-dhcp-subnet-ipv4)# tftp server option 150 192.0.2.6 192.0.2.7

The following command configures the TFTP server Bootfile-Name for a subnet, but can only be configured for DHCPv4.

switch(config-dhcp-subnet-ipv4)# tftp server file subnet-bootfile.conf

Example DHCP Server Subnets Configuration

switch# config
switch(config)# dhcp server 
switch(config-dhcp-server)# subnet 192.0.2.0/32
switch(config-dhcp-subnet-ipv4)# name subnetv4
switch(config-dhcp-subnet-ipv4)# range 192.0.2.100 192.0.2.199
switch(config-dhcp-subnet-ipv4-range)# dns server 192.0.2.1 192.0.2.10
switch(config-dhcp-subnet-ipv4)# lease time ipv4 3 days 0 hours 0 minutes 
switch(config-dhcp-server)# subnet 192.0.2.0/32
switch(config-dhcp-subnet-ipv4)# default-gateway 192.0.2.3
switch(config-dhcp-subnet-ipv4)# tftp server option 66 subnet-tftp.example.com
switch(config-dhcp-subnet-ipv4)# tftp server option 150 192.0.2.6 192.0.2.7
switch(config-dhcp-subnet-ipv4)# tftp server file subnet-bootfile.conf

The following command configures a static IP address for exclusive use by a client. Enter the DHCP Server Subnet Configuration Mode, (config-dhcp-mac-address-ipv4) from and specify the client MAC Address. The IP address must not be used by another client. Only DHCPv4 addresses allowed for this configuration.

switch(config-dhcp-subnet-ipv4)# reservations 
switch(config-dhcp-sub-v4-reserve)# mac-address 1a1b.1c1d.1e1f
switch(config-dhcp-sub-v4-rsrv-mac-address)# ipv4-address 192.0.2.0

Displaying DHCP Information

Show DHCP Server Information

The following command displays the DHCP Server information.

switch# show dhcp server ipv4
IPv4 DHCP Server is active
Debug log is enabled
DNS server(s): 192.0.2.4 192.0.2.5
DNS domain name: podV4.example.com
Lease duration: 1 days 0 hours 0 minutes
TFTP server: 192.0.2.6 (Option 66)
192.0.2.6 192.0.2.7 (Option 150)
TFTP file: https://This email address is being protected from spambots. You need JavaScript enabled to view it.:123/example/one
Active Leases: 1
IPv4 DHCP interface status:
Interface   Status
-------------------------------------------------
Ethernet1   Inactive (Could not determine VRF)
Ethernet2   Inactive (Not in default VRF)
Ethernet3   Inactive (Kernel interface not created yet)
Ethernet4   Inactive (Not up)
Ethernet5   Inactive (No IP address)
Ethernet6   Inactive (No Link Local address)
Ethernet7   Inactive (DHCP relay is configured for this interface)
Ethernet8   Inactive (DHCP relay is always on)
Ethernet9   Active

Vendor information:
Vendor ID: default
Sub-options         Data       
---------------- ----------------
1          192.0.2.0
2          “vendor”

Vendor ID: vendorClassIDA
Sub-options       Data       
---------------- --------------------
254        192.0.2.8, 192.0.2.9

Subnet: 192.0.2.0/24
Subnet name: subnetFooV4
Range: 192.0.2.100 to 192.0.2.199
DNS server(s): 192.0.2.1 192.0.2.10
Lease duration: 3 days 0 hours 0 minutes
Default gateway address: 192.0.2.3
TFTP server:
 subnet-tftp.example.com (Option 66)
 192.0.2.6 192.0.2.7 (Option 150)
 TFTP boot file: subnet-bootfile.conf
 Active leases: 1
 Reservations:
 MAC address: 1a1b.1c1d.1e1f
 IPv4 address: 192.0.2.201
 MAC address: 2a2b.2c2d.2e2f    
 IPv4 address: 192.0.2.150

Displaying Disabled Subnets

When a subnet becomes disabled, the show dhcp server [ipv4|ipv6] output displays the disabled message under Disabled reason(s). None of the disabled subnets have active leases. Currently, the output displays only 2 disabled reasons.

switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
Interface   Status
-------------------------------------------------
Ethernet1   Active

Subnet: 10.0.0.0/24 (Subnet is disabled)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0
Disabled reason(s):
Overlapping subnets: 10.0.0.0/8 

Subnet: 10.0.0.0/8 (Subnet is disabled)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.5.5.5
Default gateway address: 10.0.0.3
Active leases: 0
Disabled reason(s):
Overlapping subnets: 10.0.0.0/24 

For Overlapping ranges:
switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
Interface   Status
-------------------------------------------------
Ethernet1   Active

Subnet: 10.0.0.0/8 (Subnet is disabled)
Range: 10.0.0.1 to 10.0.0.10
Range: 10.0.0.9 to 10.0.0.12
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0
Disabled reason(s):
Overlapping range: 10.0.0.9 to 10.0.0.12 

E.g. Duplicate static IP address reservation:
Subnet: 10.0.0.0/8 (Subnet is disabled)
Subnet name:
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.5.5.5
Default gateway address: 10.0.0.3
Active leases: 0
Reservations:
MAC address: 1a1b.1c1d.1e1f    
IPv4 address: 10.0.0.11

MAC address: 2a2b.2c2d.2e2f    
IPv4 address: 10.0.0.11

Disabled reason(s):
Duplicate IPv4 address reservation: 10.0.0.11

For DHCPv6, Direct and Relay indicates that the DHCP Server accepts broadcast and relayed messages.

switch# show dhcp server ipv6
IPv6 DHCP server is active
Debug log is enabled     
DNS server(s): fe80::6     
DNS domain name: aristanetworks.example.com        
Lease duration: 1 days 3 hours 30 minutes      
Active leases: 0               
IPv6 DHCP interface status:    
Interface    Status         
--------------- ------         
Ethernet1    Active
Ethernet3    Active        

Subnet: fe80::/10      
Subnet name: foo     
Range: fe80::1 to fe80::3
DNS server(s): fe80::4 fe80::5          
Direct: Inactive (Multiple interfaces match this subnet: Ethernet1 Ethernet3)
Relay: Active            
Active leases: 0

For DHCPv6, a subnet may match only one interface and vice versa. Otherwise the subnet is disabled and no lease assigned for that subnet.

interface Ethernet1
no switchport
ipv6 address 2001:db8:0:10::1/64
dhcp server ipv6
interface Ethernet3
no switchport
ipv6 address 2001:db8:0:11::1/64
dhcp server ipv6
dhcp server
subnet 2001:db8::/56

The following enables DHCPv6 on Ethernet1 (with address fc00::1/7 and fe80::1/10), and then configures subnets fc00::/7 and fe80::/64 for DHCPv6.

interface Ethernet1
no switchport
ipv6 address fc00::1/7
ipv6 address fe80::1/64 link-local 
dhcp server ipv6
dhcp server
subnet fc00::/7
subnet fe80::/64

#show dhcp server ipv6
IPv6 DHCP server is active     
DNS server(s):  fc00::2     
DNS domain name: aristanetworks.example.com        
Lease duration: 1 days 3 hours 30 minutes      
Active leases: 0               
IPv6 DHCP interface status:    
Interface    Status         
--------------- ------         
Ethernet1    Active        

Subnet: fc00::/7      
Subnet name: foo               
Range: fc00::1 to fc00::5       
DNS server(s): fc00::6 fc00::8          
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active

Active leases: 0

Subnet: fe80::/64      
Subnet name: subnetBarV6         
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active

Active leases: 0

Leases

The following output displays the IP addresses allocated by the DHCP Server with the show dhcp server [ipv4|ipv6] leases command. It also displays the expected end time for the address, the time when the address is assigned, and the equivalent MAC address.

switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a

2000:0:0:40::b 
End: 2019/06/20 18:06:33 UTC   
Last transaction: 2019/06/20 14:36:33 UTC      
MAC address: 165a.a86d.ffac

DHCP Server Show Commands

Use the show dhcp server command to display DHCP server information.

DHCPv4 display example:

switch# show dhcp server ipv4
IPv4 DHCP Server is active
Debug log is enabled
DNS server(s): 10.2.2.2
DNS domain name: domainFoo
Lease duration: 1 days 0 hours 0 minutes
TFTP server:
serverFoo (Option 66)
10.0.0.3 (Option 150)
TFTP file: fileFoo
Active Leases: 1
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Inactive (Could not determine VRF)
   Ethernet2   Inactive (Not in default VRF)
   Ethernet3   Inactive (Kernel interface not created yet)
   Ethernet4   Inactive (Not up)
   Ethernet5   Inactive (No IP address)
   Ethernet6   Active

Vendor information:
Vendor ID: default
  Sub-options         Data       
---------------- ----------------
      1          192.0.2.0, 192.0.2.1

Vendor ID: vendorFoo
  Sub-options       Data       
---------------- -----------
      2            192.0.2.2
      3            “Foo”

Subnet: 10.0.0.0/8
Subnet name: subnetFoo
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.1.1.1 10.2.2.2
Lease duration: 3 days 3 hours 3 minutes
Default gateway address: 10.0.0.3
TFTP server:
subnetServerFoo (Option 66)
10.0.0.4 (Option 150)
TFTP boot file: subnetFileFoo
Active leases: 1
Reservations:
MAC address: 1a1b.1c1d.1e1f
IPv4 address: 10.0.0.1

MAC address: 2a2b.2c2d.2e2f    
IPv4 address: 10.0.0.2

For DHCPv6, there are two additional fields in subnet information output, Direct field and the Relay field. These two fields specify if the DHCP Server is accepting broadcast or relayed messages.

The Direct field displays Active when the subnet matches the interface with DHCPv6 configured. This indicates the server is accepting broadcast messages.

The Direct field displays Inactive when there is another existing subnet already matching the interface, or when the subnet matches more than one DHCP configured interface.

Examples of outputs for the DHCPv6 show dhcp server command:

In this example, DHCPv6 is configured with subnet fe80::/10 while being enabled on Ethernet1 with address fe80::1/64 and on Ethernet3 with address fe80::2/64.

switch# show dhcp server ipv6
IPv6 DHCP server is active
Debug log is enabled                                                                                                                                                                                                                     
DNS server(s): fe80::6                                                                                                                                                                                                                     
DNS domain name: testaristanetworks.com                                                                                                                                                                                                        
Lease duration: 1 days 3 hours 30 minutes                                                                                                                                                                                                      
Active leases: 0                                                                                                                                                                                                                               
IPv6 DHCP interface status:                                                                                                                                                                                                                    
   Interface    Status                                                                                                                                                                                                                         
--------------- ------                                                                                                                                                                                                                         
   Ethernet1    Active
   Ethernet3    Active                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
                                                                                                                                                                                                                                               
Subnet: fe80::/10                                                                                                                                                                                                                      
Subnet name: foo                                                                                                                                                                                                                                                                                                                                                                                                                                     
Range: fe80::1 to fe80::3
DNS server(s): fe80::4 fe80::5                                                                                                                                                                                                                                                                                                                                                                                                                                          
Direct: Inactive (Multiple interfaces match this subnet: Ethernet1 Ethernet3)
Relay: Active                                                                                                                                                                                                                            
Active leases: 0

This example illustrates when multiple subnets match an interface. In this example, DHCPv6 is configured with subnets fc00::/7 and fe80::/10 while being enabled on Ethernet1 with address fe80::1/10 and fc00::1/7.

switch# show dhcp server ipv6
IPv6 DHCP server is active                                                                                                                                                                                                                     
DNS server(s):  fc00::2                                                                                                                                                                                                                     
DNS domain name: testaristanetworks.com                                                                                                                                                                                                        
Lease duration: 1 days 3 hours 30 minutes                                                                                                                                                                                                      
Active leases: 0                                                                                                                                                                                                                               
IPv6 DHCP interface status:                                                                                                                                                                                                                    
   Interface    Status                                                                                                                                                                                                                         
--------------- ------                                                                                                                                                                                                                         
   Ethernet1    Active                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
                                                                                                                                                                                                                                               
Subnet: fc00::/7                                                                                                                                                                                                                      
Subnet name: foo                                                                                                                                                                                                                               
Range: fc00::1 to fc00::5                                                                                                                                                                                                       
DNS server(s): fc00::6 fc00::8                                                                                                                                                                                                                                                                                                                                                                                                                                          
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
                                                                                                                                                                                                                                  
Active leases: 0

Subnet: fe80::/10                                                                                                                                                                                                                      
Subnet name: bar                                                                                                                                                                                                                                                                                                                                                                                                                                         
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
                                                                                                                                                                                                                                  
Active leases: 0

When disabled, the show dhcp server command displays the disable message with a reason. The number of active leases of the disabled subnets will be 0. In this example, there are overlapping subnets.

switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Active

Subnet: 10.0.0.0/24 (Subnet is disabled - overlapping subnet 10.0.0.0/8)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0

Subnet: 10.0.0.0/8 (Subnet is disabled - overlapping subnet 10.0.0.0/24)
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0

In this example, the display output shows overlapping ranges.

switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Active

Subnet: 10.0.0.0/8 (Subnet is disabled - range 10.0.0.9-10.0.0.12 overlaps with an existing pool)
Range: 10.0.0.1 to 10.0.0.10
Range: 10.0.0.9 to 10.0.0.12
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0

This example shows duplicate static IP address reservation.

Subnet: 10.0.0.0/8 (Subnet is disabled - ipv4-address 10.0.0.11 is reserved more than once)
Subnet name:
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0
Reservations:
MAC address: 1a1b.1c1d.1e1f    
IPv4 address: 10.0.0.11

MAC address: 2a2b.2c2d.2e2f    
IPv4 address: 10.0.0.11

Use the show dhcp server leases command to display detailed information about the IP addresses allocated by the DHCP Server (including the IP address, the expected end time for that address, the time when the address is handed out, and the equivalent MAC address).

switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a

2000:0:0:40::b                                                                                                                                                                                                                                
End: 2019/06/20 18:06:33 UTC                                                                                                                                                                                                                   
Last transaction: 2019/06/20 14:36:33 UTC                                                                                                                                                                                                      
MAC address: 165a.a86d.ffac

DHCP Relay Global Configuration Mode

Configure DHCP Relay using the dhcp relay command in the global configuration mode. The command places the switch in DHCP Relay mode and allows the configuration of DHCP Relay on several interfaces with a single command. The configuration entered in the DHCP Relay global configuration mode can be overridden by equivalent interface specific commands.

Examples

The dhcp relay command places the switch in the DHCP Relay configuration mode.

switch(config)# dhcp relay
switch(config-dhcp-relay)#

Specify the IP address of the default DHCP or DHCPv6 Server. Multiple IP addresses can be specified and DHCP requests forward to all specified helper addresses. Configure an ip helper-address IP_Address under each desired routing interface.

Use the following commands to forward DHCP broadcast packets received on interface Ethernet1 and Vlan2 to DHCP servers at 10.0.0.1, 10.0.0.2, and to hostname DefaultDHCPHostname:

switch(config)# interface ethernet1
switch(config-if-Et1)# no switchport
switch(config-if-Et1)# ip address 192.168.1.1/16
 
switch(config)# interface vlan2
switch(config-if-Et1)# ip address 172.16.1.1/16
 
switch(config)# dhcp relay
switch(config-dhcp-relay)# server 10.0.0.1
switch(config-dhcp-relay)# server 10.0.0.2
switch(config-dhcp-relay)# server DefaultDHCPHostname

Use the following commands to forward DHCPv6 broadcast packets received on interface ethernet1 to a DHCPv6 Server at fc00::3.

switch(config)# interface ethernet1                     
switch(config-if-Et1)# no switchport                        
switch(config-if-Et1)# ipv6 address fc00::1/10 
 
switch(config)# dhcp relay
switch(config-dhcp-relay)# server fc00::3

The configuration points a routed interface to the specified DHCP and DHCPv6 server, if the configuration meets following criteria:

The default VRF contains the routed interface.
The interface has an IP address configured.
The configuration does not occur on a Management or a Loopback interface.

Use the following commands to remove the default DHCPv4 or DHCPv6 Server.

switch(config)# dhcp relay
switch(config-dhcp-relay)# no server 10.0.0.1
switch(config-dhcp-relay)# no server 10.0.0.2
switch(config-dhcp-relay)# no server DefaultDHCPHostname
switch(config-dhcp-relay)# no server fc00::3

To override the default DHCP Server on an interface, the parameter,ip helper-addressIP_Address, must be used.

Use the following commands to forward a DHCP broadcast packet received on interface Ethernet1 to DHCP Servers at 10.0.0.1, 10.0.0.2 and hostname DefaultDHCPHostname, but VLAN2 broadcasts packets to the DHCP Server at 10.0.0.3 only.

switch(config)# interface ethernet 1
switch(config-if-Et1)# no switchport
switch(config-if-Et1)# ip address 192.168.1.1/16
 
switch(config)# interface vlan2
switch(config-if-Et1)# ip address 172.16.1.1/16
switch(config-if-Et1)# ip helper-address 10.0.0.3
 
switch(config)# dhcp relay
switch(config-dhcp-relay)# server 10.0.0.1
switch(config-dhcp-relay)# server 10.0.0.2
switch(config-dhcp-relay)# server DefaultDHCPHostname

To override the default DHCPv6 Server on an interface, the parameter, ipv6 helper-address IPv6_Address> must be used.

Use the following commands to forward a DHCPv6 broadcast packet received on interface Ethernet1 to DHCPv6 Server at fc00::3, and VLAN2 broadcasts packets to DHCPv6 Server at fc00::4 only.

switch(config)# interface ethernet 1
switch(config-if-Et1)# no switchport
switch(config-if-Et1)# ipv6 address fc00::1/10
 
switch(config)# interface vlan2
switch(config-if-Et1)# ipv6 address fc00::2/10
switch(config-if-Et1)# ipv6 helper-address fc00::4
 
switch(config)# dhcp relay
switch(config-dhcp-relay)# server fc00::3

Configure DHCP Relay for IPv4 unnumbered interfaces by adding a DHCP IPv4 helper address and configuring the vendor option.

Use the information option command to enter DHCP Relay Information Option Configuration Mode:

switch(config)# dhcp relay
switch(config-dhcp-relay)# information option
switch(config-information-option)# vendor-option

Configure Option-37 in DHCPv6 Relay to include the host name of the switch along with MAC address and interface name in the remote id of the option. It requires the remote-id format to be specified in the configuration mode.

Use the following command to add the remote-id:

switch(config)# ipv6 dhcp relay option remote-id format %m:%h:%p

You can disable DHCP or DHCPv6 Relay functionality from a specific interface. This disables both DHCP Relay global and interface mode configurations.

Use the following command to disable DHCP Relay functionality only.

switch(config)# interface vlan3
switch(config-if-Et1)# dhcp relay ipv4 disabled

Use the following to disable DHCPv6 Relay functionality only.

switch(config)# interface vlan3
switch(config-if-Et1)# dhcp relay ipv6 disabled

Displaying DHCP Relay

The show ip dhcp relay command displays all the interfaces enabled with DHCP Relay and the server configured on these interfaces.

Example

switch# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCPv6 Relay Link-layer Address Option (79) is disabled
DHCPv6 Relay Remote ID (Option 37) encoding format: MAC address:interface ID
DHCP Smart Relay is disabled
Default L3 interface DHCP servers:   
  DHCPv4 servers: 10.0.0.1
                  10.0.0.2
                  DefaultDHCPHostname 
  DHCPv6 servers: fc00::3
Interface: Ethernet1
  DHCP Smart Relay is disabled
  DHCPv6 all subnet relaying is disabled 
  Using default DHCPv4 servers        
  Using default DHCPv6 servers
Interface: Ethernet2                  
  DHCP Smart Relay is disabled         
  DHCPv6 all subnet relaying is disabled
  Using default DHCPv4 servers        
  DHCPv6 servers: fc00::4
Interface: Vlan2                   
  DHCP Smart Relay is disabled         
  DHCPv6 all subnet relaying is disabled
  DHCPv4 servers: 11.0.0.3       
  DHCPv6 servers: fc00::4 
Interface: Vlan3           
  DHCP Smart Relay is disabled         
  DHCPv6 all subnet relaying is disabled
  DHCPv4 Relay is disabled            
  DHCPv6 Relay is disabled

Use the show ip dhcp relay command to display DHCP Relay for unnumbered interfaces:

switch# show ip dhcp relay
   DHCP Relay Option (82) is enabled
   DHCP Relay vendor-specific suboption (9) under information option (82)

DHCP Relay Across VRF

The EOS DHCP relay agent supports forwarding of DHCP requests to DHCP servers located in a different VRF to the DHCP client interface VRF. In order to enable VRF support for the DHCP relay agent, Option 82 (DHCP Relay Agent Information Option) must first be enabled. The DHCP relay agent uses Option 82 to pass client specific information to the DHCP server.

These sections describe DHCP Relay across VRF features:

Configuring DHCP Relay
DHCP Relay Global Configuration Mode Show Command

The DHCP relay agent inserts Option 82 information into the DHCP forwarded request, which requires the DHCP server belongs to a network on an interface, and that interface belongs to a different VRF than the DHCP client interface. Option 82 information includes the following:

VPN identifier - The VRF name for the ingress interface of the DHCP request, inserted as sub-option 151.

Table 1. VPN Identifier

SubOpt Len ASCII VRF Identifier

151 7 V R F N A M E
Link selection - The subnet address of the interface that receives the DHCP request, inserted as sub-option 5. After enabling the DHCP smart relay, the link selection fills with the subnet of the active address. The relay agent sets the Gateway IP address (gIPaddr) to its IP address so that DHCP messages can be routed over the network to the DHCP server.
Table 2. Link Selection

SubOpt Len Subnet IP Address

5 4 A1 A2 A3 A4
Server identifier override - The primary IP address of the interface that receives the DHCP request, inserted as sub-option 11. After enabling the DHCP smart relay, the server identifier fills with the active address, one of the primary or secondary addresses chosen by smart relay mechanism.
Table 3. Link Selection

SubOpt Len Overriding Server Identifier Address

11 4 B1 B2 B3 B4
VSS control suboption as suboption 152 - The DHCP server strips out this suboption when sending the response to the relay, indicating that the DHCP server used VPN information to allocate IP address.
Circuit ID - Identifies the circuit, interface or VLAN, on the switch that received the request.
Remote ID - Identifies the remote host.

Table 1. VPN Identifier
SubOpt	Len	ASCII VRF Identifier
151	7	V	R	F	N	A	M	E

Table 2. Link Selection
SubOpt	Len	Subnet IP Address
5	4	A1	A2	A3	A4

Table 3. Link Selection
SubOpt	Len	Overriding Server Identifier Address
11	4	B1	B2	B3	B4

Note: The DHCP server must be capable of handling VPN identifier information in Option 82.

Direct communication between DHCP client and server may not be possible if they reside in separate VRFs. The Server identifier override and Link Selection sub-options set the relay agent to act as the DHCP server, and enable all DHCP communication to flow through the relay agent.

The relay agent adds all the appropriate sub-options, and forwards all request packets, including renew and release,to the DHCP server. When the relay receives the DHCP server response messages, EOS removes Option 82 information and forwards the response to the DHCP client in the client VRF.

Configuring DHCP Relay

EOS inserts the DHCP relay agent information option into DHCP messages relayed to the DHCP server. The ip helper-address command enables DHCP relay on an interface and relays DHCP messages to the specified IPv4 address.

Example

This command enables DHCP relay on the interface ethernet 1/2; and relays DHCP messages to the server at 1.1.1.1.

switch(config)# interface ethernet 1/2
switch(config-if-Et1/2)# ip helper-address 1.1.1.1
switch(config-if-Et1/2)#

The commands provided in the following examples enable the attachment of VRF-related tags in the relay agent information option. If both the DHCP client interface and server interface exist on the same VRF, default or non-default, then EOS does not insert the VRF-related DHCP relay agent information option.

Examples

This command configures the DHCP relay to add option 82 information.
```
switch(config)# ip dhcp relay information option
```

These commands configures two new VRF instances and assign them Route Distinguishers (RDs).

switch(config)# vrf instance mtxxg-vrf
switch(config-vrf-mtxxg-vrf)# router bgp 50
switch(config-router-bgp)# vrf mtxxg-vrf
switch(config-router-bgp-vrf-mtxxg-vrf)# rd 5546:5546
switch(config)# vrf instance qchyh-vrf
switch(config-vrf-qchyh-vrf)# router bgp 50
switch(config-router-bgp)# vrf qchyh-vrf
switch(config-router-bgp-vrf-qchyh-vrf)# rd 218:218

This command configures an interface connected to DHCP client in vrf mtxxg-vrf and assigns an IP address.
```
switch(config)# interface ethernet 9
switch(config-if-Et9)# no switchport
```

This command configures the DHCP client interface in VRF mtxxg-vrf.

switch(config-if-Et9)# vrf mtxxg-vrf
switch(config-if-Et9)# ip address 10.10.0.1/16

This command configures the server interface in VRF qchyh-vrf.

switch(config-if-Et11)# vrf qchyh-vrf
switch(config-if-Et11)# ip address 10.40.0.1/16

This command configures a helper address for a DHCP server in VRF qchyh-vrf.
```
switch(config-if-Et11)# ip helper-address 10.40.2.3 vrf qchyh-vrf
```

Configuring Option 82

Use the following commands to enter Information Option (Option 82) insertion and configure the format of information options:

switch(config)# dhcp relay
switch(config-dhcp-relay)# information option
switch(config-information-option)#

To specify the format for the circuit-id encoding, use the following command:

switch(config-information-option)# circuit-id encoding (%x | %p)

The default format uses string denoted by %p. Setting the encoding to %x enables hex encoding for the circuit ID. The configured value must be a valid hex number. If not configured, DHCP Relay uses the default format.

To specify the format for the remote-id encoding, use the following command:

switch(config-information-option)# remote-id encoding (%x | %p)

The default format uses string denoted by %p. Setting the encoding to %x enables hex encoding for the remote ID. The configured value must be a valid hex number. If not configured, DHCP Relay uses the default format.

DHCP Relay Global Configuration Mode Show Command

Example

This command displays the VRF specifier for the server:

switch# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is enabled
DHCP Smart Relay is disabled
Interface: Ethernet9
Option 82 Circuit ID: Ethernet9
DHCP Smart Relay is disabled
DHCP servers: 10.40.2.3
10.40.2.3:vrf=qchyh-vrf

DHCP Relay in VXLAN EVPN

The ip dhcp relay information option (Global) command enables the configuration of the DHCP server to uniquely identify the origin of the request using a source-interface and the helper address. Configure the source interface with a routable address used by the DHCP server to uniquely identify the DHCP relay agent that forwarded the client request.

Configuring DHCP Relay in VXLAN EVPN (IPv4)

Use the following command to enable the DHCP relay information option (Option 82) required to specify a source interface.

switch(config)# ip dhcp relay information option

The following configures a Loopback interface as the source interface.

switch(config)# interface Loopback1
switch(config-if-Lo1)# ip address 1.1.1.1/24

Use the following commands to configure the Loopback interface as the specified source interface for the helper address.

switch(config)# interface vlan100
switch(config-if-Vl100)# ip helper-address 10.1.1.4 source-interface Loopback1

Use the following commands to configure the Loopback interface when the DHCP server resides in a different VRF (red). The source interface must be configured in the DHCP server VRF for the command to take effect.

switch(config)# interface Loopback3
switch(config-if-Lo3)# vrf red
switch(config-if-Lo3)# ip address 1.1.1.1/24

switch(config)# interface vlan100
switch(config-if-Vl100)# ip helper-address 10.1.1.4 vrf red source-interface Loopback3

The following command disables the use of source interface along with the helper address.

switch(config)# interface vlan100
switch(config-if-Vl100)# no ip helper-address 10.1.1.4 source-interface Loopback1

Configuring DHCP Relay in VXLAN EVPN (IPv6)

Use the following commands to configure a local interface.

switch(config)# interface Loopback2
switch(config-if-Vl100)# ipv6 address 2001::10:20:30:1/128

Use the following commands to configure the Loopback interface as the local interface for the helper address.

switch(config)# interface vlan200
switch(config-if-Vl200)# ipv6 dhcp relay destination 2002::10:20:30:2 local-interface Loopback2

Use the following commands to configure the Loopback interface when the DHCP server is in a different VRF (red). The local interface must be configured in the DHCP server's VRF for the command to take effect.

switch(config)# interface Loopback4
switch(config-if-Lo4)# vrf red
switch(config-if-Lo4)# ipv6 address 2001::10:20:30:1/128

switch(config)# interface vlan200
switch(config-if-Vl200)# ipv6 dhcp relay destination 2002::10:20:30:2 vrf red local-interface Loopback4

Use the following command to disable the use of local interface along with the helper address.

switch(config-if-Vl200)# no ipv6 dhcp relay destination 2002::10:20:30:2 local-interface Loopback4

The following command displays the status of DHCP relay option (Option 82) and lists the configured DHCP servers.

switch# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is enabled
DHCP Smart Relay is disabled
Interface: Vlan100
  Option 82 Circuit ID: Vlan100
  DHCP Smart Relay is disabled
  DHCP servers: 10.1.1.4
Interface: Vlan200
  Option 82 Circuit ID: Vlan100
  DHCP Smart Relay is disabled
  DHCP servers: 2002::10:20:30:2

DHCP Relay Agent for IPv6

Configuring IPv6 DHCP Relay
Displaying IPv6 DHCP Relay Information

Configuring IPv6 DHCP Relay

Configuring the IPv6 DHCP Relay Agent (Global)
Configuring DHCP for IPv6 Relay Agent
Configuring the Client Link Layer Address for the IPv6 DHCP Relay Agent
Configuring DHCPv6 Relay for Option 37
Clearing IPv6 DHCP Relay Counters

Configuring the IPv6 DHCP Relay Agent (Global)

The ipv6 dhcp relay always-on command enables the switch DHCP IPv6 Relay Agent globally regardless of the DHCP IPv6 Relay Agent status on any interface. EOS enables DHCP IPv6 Relay Agent by default if at least one routable interface has an ipv6 dhcp relay destination statement.

Example

This command enables the DHCP relay agent.

switch(config)# ipv6 dhcp relay always-on
switch(config)#

Configuring DHCP for IPv6 Relay Agent

The ipv6 dhcp relay destination command enables the DHCP IPv6 Relay Agent function and specifies the client message destination address on an interface.

Example

This command enables the DHCP IPv6 Relay Agent function and sets the client message destination address to 2001:0db8:0:1::1 on interface ethernet 4.

switch(config)# interface ethernet 4
switch(config-if-Et4)# ipv6 dhcp relay destination 2001:0db8:0:1::1
switch(config-if-Et4)

Configuring the Client Link Layer Address for the IPv6 DHCP Relay Agent

The ipv6 dhcp relay option link-layer address command enables the DHCPv6 relay agent to configure the Client Link Layer Address option to solicit and request messages. In other words, the command enables the Client Link Layer Address option (79) in the Global Configuration Mode. The no ipv6 dhcp relay option link-layer address command disables the link layer address option (79) in the Global Configuration Mode.

Example

This command enables the insertion of Client Link Layer Address option (79) in the Global Configuration Mode.

switch(config)# ipv6 dhcp relay option link-layer address

Configuring DHCPv6 Relay for Option 37

The DHCPv6 Relay Option 37 allows a DHCPv6 relay agent to insert a Remote-ID option (Option 37) into DHCPv6 messages. This option provides the DHCPv6 server with information about the client's location, such as the MAC address of the relay agent, the ingress interface, and the VLAN ID. This is useful for network administrators to track the origin of DHCP requests and to enforce policies based on the client's location.

Use the following command to specify using the MAC address, hostname, and interface name for the Remote-ID:

switch(config)# ipv6 dhcp relay option remote-id format %m:%h:%p

Displaying the Remote-ID Configuration Information

Use the show ip dhcp relay command to display the Option 37 configuration:

switch# show ip dhcp relay
DHCP relay is active
DHCPv6 relay remote ID option (37) encoding format: MAC address:hostname:interface name

Clearing IPv6 DHCP Relay Counters

The clear ipv6 dhcp relay counters command resets the DHCP relay counters. The configuration mode determines which counters to reset:

Global configuratio: - Clears the counters for the switch and for all interfaces.
Interface configuration - Clears the counter for the configuration mode interface.

Examples

These commands clear all DHCP relay counters on the switch.

switch(config-if-Et4)# exit
switch(config)# clear ipv6 dhcp relay counters
switch(config)#

These commands clear the DHCP relay counters for interface ethernet 4.

switch(config)# interface ethernet 4
switch(config-if-Et4)# clear ipv6 dhcp relay counters
switch(config)#

Displaying IPv6 DHCP Relay Information

IPv6 DHCP Relay Status
IPv6 DHCP Relay Counters

IPv6 DHCP Relay Status

The show ip dhcp relay command displays the status of DHCP relay agent parameters on the switch and each interface where at least one feature parameter is listed. The command displays the status for both global and interface configurations.

Example

This command displays the DHCP Agent Relay parameter status.

switch(config)# interface ethernet 1/2
switch(config-if-Et1/2)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCPv6 Relay Link-layer Address Option (79) is disabled
DHCP Smart Relay is disabled
Interface: Ethernet1/2
  DHCP Smart Relay is disabled
  DHCP servers: 1::1
                2001:db8:0:1::1
switch(config-if-Et1/2)#

IPv6 DHCP Relay Counters

The show ipv6 dhcp relay counters command displays the number of DHCP packets received, forwarded, or dropped on the switch and on all interfaces enabled as DHCP relay agents.

Example

This command displays the IP DHCP relay counter table.

switch> show ipv6 dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  376  376    0 | 4 days, 19:55:12 ago
 All Resp |  277  277    0 |
          |                |
Ethernet4 |  207  148    0 | 4 days, 19:54:24 ago

switch>

DHCP Snooping with Bridging

In this configuration, in addition to sending DHCP packets to relay after adding information option, the packets can also bridge within the VLAN. In the bridging mode, the switch intercepts DHCP packets, inserts option-82 if not already present, and bridges the packet within the VLAN. This mode of DHCP snooping can be configured without DHCP relay configuration.

Note: EOS supports DHCP Snooping with Bridging on MLAG configurations.

Configuring DHCP Snooping with Bridging

Following are the steps to configure DHCP snooping with bridging:

Enable DHCP snooping feature using the ip dhcp snooping command.
```
switch# ip dhcp snooping
```
Enable the insertion of option-82 in DHCP request packets using the ip dhcp snooping information option command. By default, option-82 is disabled and must be enabled for DHCP Snooping to be functional.
```
switch# ip dhcp snooping information option
```
Enable DHCP snooping on the corresponding VLANs using the ip dhcp snooping vlan command. By default,EOS disables DHCP snooping on any VLAN.
```
switch# ip dhcp snooping vlan
```
Set the circuit-id information sent in option-82. By default, EOS sends the Interface name and VLAN ID. Remote circuit-id contains the MAC address of the relay agent.
```
switch# ip dhcp snooping information option circuit-id type 2 format
%h:%p  Hostname and interface name
%p:%v  Interface name and VLAN ID
```
Enable bridging capabilities of DHCP snooping using the ip dhcp snooping bridging command. This command enables DHCP snooping with or without DHCP relay configuration.
```
switch# ip dhcp snooping bridging
```

Configuring IPv6 DHCP Snooping

Enabling IPv6 DHCP Snooping

Enabling IPv6 DHCP Snooping

The ipv6 dhcp snooping command enables DHCP snooping globally on the switch. DHCP snooping provides a Layer 2 feature that can be configured on LAN switches. Arista switches support Option-37 insertion that allows relay agents to provide remote-ID information in DHCP request packets.

Note: DHCPv6 VLAN classification and DHCPv4 VLAN classification share same hardware resource.

Examples

The following configuration enables the IPv6 DHCP snooping feature at the global level.

switch(config)# ipv6 dhcp snooping
switch(config)# ipv6 dhcp snooping remote-id option
switch(config)# ipv6 dhcp snooping vlan <vlan|vlan-range>

The following commands display the IPv6 DHCP snooping state.

switch(config)# ipv6 dhcp snooping
switch(config)# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
  2789-2790
DHCPv6 Snooping is operational on following VLANs:
  2789
Insertion of Option-37 is enabled

DHCP Snooping with Bridging Show Commands

The show dhcp snooping displays the DHCP snooping with bridging information.

switch# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
 650
DHCP Snooping bridging is operational on following VLANs:
 650
Insertion of Option-82 is enabled
 Circuit-id sub-option Type: 0
 Circuit-id format: Interface name:Vlan ID
 Remote-id: 00:1c:73:8d:eb:67 (Switch MAC)

Troubleshooting

Configure all the needed commands to enable DHCP snooping and operational on all the VLANs.
show ip dhcp snooping displays the DHCP snooping status.
show ip dhcp snooping counters displays dropped snooped packets.

show ip dhcp snooping counters debug displays the reason for dropped packets.


switch# show ip dhcp snooping counters debug
Counter                           Requests          Responses
----------------------------- ----------------- -----------------
Received                                      3                 2
Forwarded                                     3                 2
Dropped - Invalid VlanId                      0                 0
Dropped - Parse error                         0                 0
Dropped - Invalid Dhcp Optype                 0                 0
Dropped - Invalid Info Option                 0                 0
Dropped - Snooping disabled                   0                 0

Check if the packets are hitting the TCAM rule.

switch# show platform trident tcam detail | grep -i dhcp
DHCP Snooping uses 3 entries.
…
655402               45 hits - DHCP client to relay trap-to-cpu

DHCP Commands

DHCP Server Commands

default-gateway (IPv4)
default-gateway (IPv6)
dhcp server
dhcp server client
dhcp server debug
dhcp server dns
dhcp server lease
dhcp server next-server
dhcp server option
dhcp server private-option
dhcp server subnet client
dhcp server vendor-option ipv4 sub-option
dhcp server subnet
dhcp server tftp
dhcp server vendor-option
dhcp server vendor-option ipv4 sub-option

IPv4 DHCP Snooping Commands

clear ip dhcp snooping counters
ip dhcp snooping
ip dhcp snooping bridging
ip dhcp snooping information option
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping counters
show ip dhcp snooping hardware

IPv4 DHCP Relay Commands

clear ip dhcp relay counters
ip dhcp relay all-subnets
ip dhcp relay all-subnets default
ip dhcp relay always-on
ip dhcp relay information option (Global)
ip dhcp relay information option circuit-id
ip helper-address
show ip dhcp relay
show ip dhcp relay counters

IPv6 DHCP Relay Commands

ipv6 dhcp relay always-on
ipv6 dhcp relay destination
ipv6 dhcp relay option link-layer address
show ipv6 dhcp relay counters

IPv6 DHCP Snooping Commands

ipv6 dhcp snooping
show ipv6 dhcp snooping
show ipv6 dhcp snooping counters
show ipv6 dhcp snooping hardware

clear ip dhcp relay counters

The clear ip dhcp relay counters command resets the DHCP relay counters. The configuration mode determines which counters are reset:.

The Interface configuration command clears the counter for the configuration mode interface.

Command Mode

Privileged EXEC

Command Syntax

clear ip dhcp relay counters [interface_name]

Parameters

interface_name - Specify the interface to clear counters.. Add the following options:

no parameter - Clears counters for the switch and for all interfaces.
interface ethernet e_num - Clears counters for the specified Ethernet interface.
interface loopback l_num - Clears counters for the specified loopback interface.
interface port-channel p_num - Clears counters for the specified port-channel Interface.
interface vlan v_num -Clears counters for the specified VLAN interface.

Examples

These commands clear the DHCP relay counters for vlan 1045 and shows the counters before and after the clear command.

switch# show ip dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  376  376    0 | 4 days, 19:55:12 ago
 All Resp |  277  277    0 |
          |                |
 Vlan1001 |  207  148    0 | 4 days, 19:54:24 ago
 Vlan1045 |  376  277    0 | 4 days, 19:54:24 ago

switch# clear ip dhcp relay counters interface vlan 1045

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  380  380    0 | 4 days, 21:19:17 ago
 All Resp |  281  281    0 |
          |                |
 Vlan1000 |  207  148    0 | 4 days, 21:18:30 ago
 Vlan1045 |    0    0    0 |          0:00:07 ago

These commands clear all DHCP relay counters on the switch.

switch(config-if-Vl1045)# exit
switch(config)# clear ip dhcp relay counters
switch(config)# show ip dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|-------------
  All Req |    0    0    0 |  0:00:03 ago
 All Resp |    0    0    0 |
          |                |
 Vlan1000 |    0    0    0 |  0:00:03 ago
 Vlan1045 |    0    0    0 |  0:00:03 ago

clear ip dhcp snooping counters

The clear ip dhcp snooping counters command resets the DHCP snooping packet counters.

Command Mode

Privileged EXEC

Command Syntax

clear ip dhcp snooping counters [counter_type]

Parameters

counter_type - Specify the type of counter to reset. Options include the following:

no parameter - Counters for each VLAN.
debug - Aggregate counters and drop cause counters.

Examples

This command clears the DHCP snooping counters for each VLAN.

switch# clear ip dhcp snooping counters
switch# show ip dhcp snooping counters

     | Dhcp Request Pkts | Dhcp Reply Pkts |
Vlan |  Rcvd  Fwdd  Drop | Rcvd Fwdd  Drop | Last Cleared
-----|------ ----- ------|----- ---- ------|-------------
 100 |     0     0     0 |    0    0     0 |  0:00:10 ago

switch#

This command clears the aggregate DHCP snooping counters.

switch# clear ip dhcp snooping counters debug
switch# show ip dhcp snooping counters debug

Counter                       Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received                                      0                 0
Forwarded                                     0                 0
Dropped - Invalid VlanId                      0                 0
Dropped - Parse error                         0                 0
Dropped - Invalid Dhcp Optype                 0                 0
Dropped - Invalid Info Option                 0                 0
Dropped - Snooping disabled                   0                 0

Last Cleared:  0:00:08 ago

switch#

clear ipv6 neighbors

Command Mode

Privileged EXEC

Command Syntax

clear ipv6 neighbors [port][dynamic_ipv6]

Parameters

port Interface through which neighbor is accessed. Options include the following:
- no parameter - Removes all dynamic entries.
- interface ethernet e_num - Specify the Ethernet interface by e_num.
- interface loopback l_num - Specify the Loopback interface by l_num.
- interface port-channel p_num - Specify the Port-channel interface by p_num p_num.
- interface vlan v_num - Specify the VLAN interface by v_num.
dynamic_ipv6 - Specifies the address of entry to remove. Options include the following:
- no parameter - Removes all dynamic entries for specified interface.
- ipv6_addr - Removes the IPv6 address of the entry.

Example

This command removes all dynamic neighbor entries for vlan 200.

switch# clear ipv6 neighbors vlan 200
switch#

clear ipv6 dhcp relay counters

Command Mode

Privileged EXEC

Command Syntax

clear ipv6 dhcp relay counters [port]

Parameters

port - Specify the interface to access the neighbor. Options include the following:

no parameter - Removes all dynamic entries.
interface ethernet e_num - Specify the Ethernet interface by e_num.
interface loopback l_num - Specify the Loopback interface by l_num.
interface port-channel p_num - Specify the Port-channel interface by p_num p_num.
interface vlan v_num - Specify the VLAN interface by v_num.

Example

These commands clear the DHCP relay counters for interface ethernet 4 and shows the counters before and after the clear command.

switch(config)# show ipv6 dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  376  376    0 | 4 days, 19:55:12 ago
 All Resp |  277  277    0 |
          |                |
Ethernet4 |  207  148    0 | 4 days, 19:54:24 ago


switch(config)# interface ethernet 4
switch(config-if-Et4)# clear ipv6 dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  380  380    0 | 4 days, 21:19:17 ago
 All Resp |  281  281    0 |
          |                |
Ethernet4 |    0    0    0 |4 days, 21:18:30 ago
These commands clear all DHCP relay counters on the switch.
switch(config-if-Et4)# exit

switch(config)# clear ipv6 dhcp relay counters

switch(config)# show ipv6 dhcp relay counters
          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|-------------
  All Req |    0    0    0 |  0:00:03 ago
 All Resp |    0    0    0 |
          |                |
Ethernet4 |    0    0    0 | 0:00:03 ago
switch(config)#

clear ipv6 dhcp snooping counters

The clear ipv6 dhcp snooping counters command resets the DHCP snooping packet counters.

Command Mode

Privileged EXEC

Command Syntax

clear ipv6 dhcp snooping counters [counter_type]

Parameters

counter_type - Specifies the type of counter to reset.
no parameter - Clears the counters for each VLAN.
debug - Clears aggregate counters and drop cause counters.

Examples

This command clears the number of DHCP packets sent and received on each VLAN.

switch# clear ipv6 dhcp snooping counters
switch# show ipv6 dhcp snooping counters

     | Dhcpv6 Request Pkts | Dhcpv6 Reply Pkts | 
Vlan |  Rcvd   Fwdd   Drop |  Rcvd  Fwdd  Drop | Last Cleared
-----|------ ------ -------|------ ----- ------|------------- 
2789 |     1      1      0 |     1     1     0 |  0:03:09 ago

This command clears the number of DHCP packets sent on the switch.

switch# clear ipv6 dhcp snooping counters debug
switch# show ipv6 dhcp snooping counters debug

Counter                       Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received                                      1                 1
Forwarded                                     1                 1
Dropped - Invalid VlanId                      0                 0
Dropped - Parse error                         0                 0
Dropped - Invalid Dhcp Optype                 0                 0
Dropped - Invalid Remote-ID Option            0                 0
Dropped - Snooping disabled                   0                 0

Last Cleared:  0:04:29 ago

default-gateway

The default-gateway command in DHCP Server Subnet Configuration Mode populates DHCP Option 3 (Router Option) in the DHCP payload sent from the switch to the client and allows communication to another VLAN or network.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

DHCP Server IPv4 Subnet Configuration

Command Syntax

default-gateway

no default-gateway

default default-gateway

Parameters

default-gateway ipv4_address - Add a default gateway to the subnet.

Example

Use the following commands to add the default-gateway, 10.10.10.1, to subnet 172.16.23.11/32:

switch(config)# dhcp server
switch(config-dhcp-server)# subnet 172.16.23.11/32
switchconfig-dhcp-subnet-ipv4)# default-gateway 10.10.10.1
switchconfig-dhcp-subnet-ipv4)#

default-gateway

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

DHCP Server IPv6 Subnet Configuration

Command Syntax

default-gateway

no default-gateway

default default-gateway

Parameters

default-gateway ipv6_address

Example

Use the following commands to add the default-gateway, 2001:db8:cafe:a100::99, to subnet 2001:db8:acad:1::fe21/32:

switch(config)# dhcp server
switch(config-dhcp-server)# subnet 2001:db8:acad:1::fe21/32
switchconfig-dhcp-subnet-ipv6)# default-gateway 2001:db8:cafe:a100::99
switchconfig-dhcp-subnet-ipv6)#

dhcp relay

The dhcp relay command places the switch in the DHCP relay mode. Execute this command in the Global Configuration Mode.

The no dhcp relay command removes DHCP relay configuration from the running-config.

Command Mode

Global Configuration Mode

Command Syntax

dhcp relay

no dhcp relay

Example

The dhcp relay command places the switch in the DHCP relay configuration mode.

switch(config)# dhcp relay
switch(config-dhcp-relay)#

dhcp relay ipv6

The dhcp relay ipv6 command in the DHCP Relay Configuration Mode configures DHCP Relay IPv6 routes and disable DHCP route persistence or synchronize neighbors.

Command Mode

DHCP Relay Configuration

Command Syntax

dhcp relay ipv6 routes [persistence disable] | [sync neighbor [ ipv4 | ipv6]

no dhcp relay ipv6

default dhcp relay ipv6

Parameters

persistence disable - Configure DHCP client requests settings.
sync neighbor [ ipv4 | ipv6] - Configure these settings to retain the DHCP server ID in a request.

Examples

Use the following commands to disable the DHCP IPv6 route persistence:

switch(config)# dhcp relay
switch(config-dhcp-relay)# ipv6 routes persistence disabled
switch(config-dhcp-relay)#

Use the following commands to synchronize with neighbor, 172.16.23.15:

switch(config)# dhcp relay
switch(config-dhcp-relay)# sync neighbor 172.16.23.15
switch(config-dhcp-relay)#

client requests

The client requests command in the DHCP Relay Configuration Mode configures DHCP Relay to evaluate incoming.

Command Mode

DHCP Relay Configuration

Command Syntax

client requests [[cross-vrf server-id preserve] | [flooding suppress]]

no client requests

default client requests

Parameters

client requests - Configure DHCP client requests settings.
cross-vrf server-id preserve - Configure these settings to retain the DHCP server ID in a request.
flooding suppress - Configure these settings to prevent flooding DHCP request packets on the network.

Examples

Use the following commands to preserve the DHCP server ID:

switch(config)# dhcp relay
switch(config-dhcp-relay)# client requests cross-vrf server-id preserve
switch(config-dhcp-relay)#

Use the following commands to suppress DHCP request flooding on the network:

switch(config)# dhcp relay
switch(config-dhcp-relay)# client requests flooding suppress
switch(config-dhcp-relay)#

dhcp server

The dhcp server command places the switch in the DHCP relay mode. Execute this command in the DHCP Server Configuration Mode.

The no dhcp server command removes DHCP relay configuration from the running-config.

Command Mode

Global Configuration Mode

Command Syntax

dhcp server

no dhcp server

Example

The dhcp server command places the switch in the DHCP relay configuration mode.

switch(config)# dhcp server
switch(config-dhcp-server)#

dhcp server client

The dhcp server client command in the IPv4 or IPv6 Subnet Configuration Mode configures client options for the DHCP server. Execute this command under the dhcp server configuration mode.

Command Mode

DHCP Server Configuration

DHCP Server Subnet Configuration

DHCP Server IPv4 or IPv6 Subnet Range Configuration

Command Syntax

Parameters

[ipv4|ipv6] - Select the IP address family.
definition client_class - Add a class for the client definition.
default-gateway - Configure the client class default gateway sent to DHCP clients.
dns - Configure the client class DNS.
lease - Configure the client class lease.
option - Configure the client class DHCP options.
private-option - Configure the client class's private options.
tftp - Configure the client class's TFTP options.

Example

Use the dhcp server client class default-gateway command to add a client definition for the IPv4 DHCP client class default gateway of 10.0.0.1. options.

switch(config-dhcp-server)# client class ipv4 definition test1 default-gateway 10.0.0.1

dhcp server debug

The dhcp server debug log command configures DHCP server debugging configuration. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server debug log file

Parameters

log file - Specify the file location to store debugging logs.

Example

Use the dhcp server log command to add a file location for debugging logs.

switch(config-dhcp-server)#debug log

dhcp server dns

The dhcp server dns command configures DHCP server DNS options. Execute this command in the DHCP Server Configuration Mode and DHCP Server IPv4 Subnet Configuration Mode.

Command Mode

DHCP Server Configuration

DHCP Server IPv4 or IPv6 Subnet Configuration

Command Syntax

dhcp server dns [domain name domain_name ] [server [ipv4|ipv6] ip_address

Parameters

domain name domain_name - Specify the domain name of the DNS server.
server [ipv4|ipv6] ip_address - Specify the DNS server as IPv4 or IPv6 and the IP address of the server.

Example

Use the dhcp server dns command to add an IPv4 DNS server, 192.168.10.5, to the DHCP configuration. options.

switch(config-dhcp-server)# dns server ipv4 192.168.10.5

dhcp server lease

The dhcp server lease command configures DHCP server lease options. Execute this command in the DHCP Server Configuration Mode and DHCP Server IPv4 Subnet Configuration Mode.

Command Mode

DHCP Server Configuration

DHCP Server IPv4 or IPv6 Subnet Configuration

Command Syntax

dhcp server lease time [ipv4|ipv6] days days hourshours minutesminutes

Parameters

[ipv4|ipv6] - Configure the lease for IPv4 or IPv6.
days days - Specify the number of days for the lease to be in effect from 0 to 2000 days.
hourshours - Specify the number of hours for the lease to be in effect from 0 to 23 hours.
minutesminutes - Specify the number of minutes for the lease to be in effect from 0 to 59 minutes.

Example

Use the dhcp server lease command to add an IPv4 lease to be in effect for 10 days, to the DHCP configuration.

switch(config-dhcp-server)# dns lease time ipv4 10 days

dhcp server next-server

The dhcp server next-server command in the DHCP Server Configuration Mode populates a specific legacy field in the DHCP packet header called the siaddr, Server IP address. During initialization, a switch requires information about the location of a DHCP server. After receiving an IP address for the bootstrap process, the switch contacts the TFTP or HTTP server and downloads the configuration file specified in the bootfile command.

Command Mode

DHCP Server Configuration

Command Syntax

next-server ipv4_address

no next-server

Parameters

next-server ipv4_address - Specify the IPv4 address for the DHCP server.

Example

Use the following commands to add the IPv4 address, 172.16.23.3, as the DHCP server:

switch(config)# dhcp server
switch(config-dhcp-server)# next-server 172.16.23.3
switch(config-dhcp-server)#

dhcp server option

The dhcp server option command configures DHCP server options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration

DHCP Server IPv4 or IPv6 Subnet Configuration

Command Syntax

dhcp server option ipv4 code [always-send data type [hex |string] data]] quoted_string hex [client-id disable] hours hours minutes minutes

dhcp server option ipv6 code [always-send data type [hex |string] data]] quoted_string hex [client-id disable] hours hours minutes minutes

Parameters

[ipv4|ipv6] - Configure the option for IPv4 or IPv6.
code- Specify the option number from the DHCP options.
[always-send data type [hex |string] data]] quoted_string hex - Specify to send the option whether or not the client requested it.
type hex data hex_number - Specify the option type
client-id disable - Prevent the DHCPv4 server from sending back the client ID.

Example

Use the dhcp server option command to add an IPv4 DHCP code, 67, to the DHCP configuration.

switch(config-dhcp-server)# option ipv4 option 67

dhcp server private-option

The dhcp server private-option command configures DHCP server private options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server private-option [ipv4|ipv6] code [always-send data type [hex |string] data]] quoted_string hex

Parameters

[ipv4|ipv6] - Configure the option for IPv4 or IPv6.
code- Specify the option number from 224 to 254.
[always-send data type [hex |string] data]] quoted_string >hex - Specify to send the option whether or not the client requested it.

Example

Use the dhcp server option command to add an IPv4 private option code, 225, to always send the option to the DHCP configuration.

switch(config-dhcp-server)# option ipv4 private-option 225 always-send private-option ipv4 225 always-send type string data "Code Sent"

dhcp server subnet

The dhcp server subnet command configures DHCP server subnet options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server subnet ipv4_address ipv6_address

Parameters

ipv4_address - Configure the IPv4 subnet.
ipv6_address - Configure the IPv6 subnet.

Example

Use the dhcp server subnet command to add an IPv4 subnet, 198.168.0.0/24, to the DHCP configuration.

switch(config-dhcp-server)# subnet 198.168.0.0/24

dhcp server subnet client

The dhcp server subnet [ipv4 | ipv6] client command configures client options for the DHCP server. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

Parameters

[ipv4|ipv6] - Select the IP address family.
definition client_class - Add a class for the client definition.
default-gateway ip_address - Configure the client class default gateway sent to DHCP clients.
dns server - Configure the client class DNS.
lease days hourshours minutesminutes - Configure the client class lease in days, hours, and minutes.
name name - Configure the subnet name.
range ip_address_start ip_address_end - Configure the range of IP addresses for the subnet.
reservations mac-address mac_address [hostname | ipv4-address]- Configure the MAC address to use for reservations.
tftp - Configure the client class's TFTP options.

Example

Use the dhcp server subnet ipv4 client class default-gateway command to add a client definition for the IPv4 DHCP client class default gateway of 10.0.0.1. options.

switch(config-dhcp-server)#subnet ipv4 client class ipv4 definition test1 default-gateway 10.0.0.1

dhcp server tftp

The dhcp server tftp command configures DHCP server TFTP options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server tftp server [file [ipv4|ipv6] file_name] [option [150|66]] ipv4

Parameters

file [ipv4|ipv6] file_name - Configure the IPv4 or IPv6 boot file name.
option [150|66]] ipv4 ip_address - Configure the TFTP DHCP option as 150 or 66 with an IPv4 address.

Example

Use the dhcp server tftp command to add option 150 with an IPv4 address 198.168.0.11, to the DHCP configuration.

switch(config-dhcp-server)# tftp option 150 ipv4 198.168.0.11

dhcp server vendor-option

The dhcp server vendor-option command configures the DHCP server vendor identifier options. Execute this command under the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server vendor-option ipv4 vendor_id default vendor_id sub-option sub-option_code

Parameters

vendor_id - Configure the vendor identifier.
default vendor_id - Set as the default vendor specific option.
sub-option sub-option_code - Set the sub-option code from 1-254.

Example

Use the dhcp server vendor-option command to add vendor option, 1:4:c0:0:2:8 , to the DHCP configuration.

switch(config-dhcp-server)# vendor-option ipv4 1:4:c0:0:2:8

dhcp server vendor-option ipv4 sub-option

The dhcp server vendor-option command configures the DHCP server vendor identifier options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server vendor-option ipv4 vendor_id default vendor_id sub-option sub-option_code type [array | ipv4-address | string] array [ipv4-address data ip_address [string data quoted_string

Parameters

vendor_id - Configure the vendor identifier.
default vendor_id - Set as the default vendor specific option.
sub-option sub-option_code - Set the sub-option code from 1-254.

Example

Use the dhcp server vendor-option command to add the vendor option, 1:4:c0:0:2:8, to the DHCP Server configuration.

switch(config-dhcp-server)# vendor-option 1:4:c0:0:2:8

ip dhcp relay all-subnets

The ip dhcp relay all-subnets command configures the DHCP smart relay status in the Interface Configuration Mode. DHCP smart relay supports forwarding DHCP requests with a client secondary IP addresses in the gateway address field. Enabling DHCP smart relay on an interface requires that you enable DHCP relay on that interface.

By default, an interface assumes the global DHCP smart relay setting as configured by the ip dhcp relay all-subnets default command. The ip dhcp relay all-subnets command, when configured, takes precedence over the global smart relay setting.

The no ip dhcp relay all-subnets command disables DHCP smart relay on the configuration mode interface. The default ip dhcp relay all-subnets command restores the interface to the default DHCP smart relay setting, as configured by the ip dhcp relay all-subnets default command, by removing the corresponding ip dhcp relay all-subnets or no ip dhcp relay all-subnets statement from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ip dhcp relay all-subnets

no ip dhcp relay all-subnets

default ip dhcp relay all-subnets

Examples

This command enables DHCP smart relay on VLAN interface 100.

switch(config)# interface vlan 100
switch(config-if-Vl100)# ip helper-address 10.4.4.4
switch(config-if-Vl100)# ip dhcp relay all-subnets
switch(config-if-Vl100)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: Vlan100
  DHCP Smart Relay is enabled
  DHCP servers: 10.4.4.4
switch(config-if-Vl100)#

This command disables DHCP smart relay on VLAN interface 100.

switch(config-if-Vl100)# no ip dhcp relay all-subnets
switch(config-if-Vl100)# show active
 interface Vlan100
   no ip dhcp relay all-subnets
   ip helper-address 10.4.4.4
switch(config-if-Vl100)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: Vlan100
  DHCP Smart Relay is disabled
  DHCP servers: 10.4.4.4
switch(config-if-Vl100)#

This command enables DHCP smart relay globally, configures VLAN interface 100 to use the global setting, then displays the DHCP relay status.

switch(config)# ip dhcp relay all-subnets default
switch(config)# interface vlan 100
switch(config-if-Vl100)# ip helper-address 10.4.4.4
switch(config-if-Vl100)# default ip dhcp relay
switch(config-if-Vl100)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: Vlan100
  Option 82 Circuit ID: 333
  DHCP Smart Relay is enabled
  DHCP servers: 10.4.4.4
switch(config-if-Vl100)#

ip dhcp relay all-subnets default

The ip dhcp relay all-subnets default command configures the global DHCP smart relay setting. DHCP smart relay supports forwarding DHCP requests with a client secondary IP addresses in the gateway address field. The default global DHCP smart relay setting is disabled.

The global DHCP smart relay setting applies to all interfaces for which an ip dhcp relay all-subnets statement does not exist. Enabling DHCP smart relay on an interface requires that you also enable DHCP relay on that interface.

The no ip dhcp relay all-subnets default and default ip dhcp relay all-subnets default commands restore the global DHCP smart relay default setting of disabled by removing the ip dhcp relay all-subnets default command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp relay all-subnets default

no ip dhcp relay all-subnets default

default ip dhcp relay all-subnets default

Example

This command configures the global DHCP smart relay setting to enabled.

switch(config)# ip dhcp relay all-subnets default
switch(config)#

ip dhcp relay always-on

The ip dhcp relay always-on command enables the DHCP relay agent on the switch regardless of the DHCP relay agent status on any interface. By default, EOS enables the DHCP relay agent only if you have one routable interface configured with an ip helper-address statement.

The no ip dhcp relay always-on and default ip dhcp relay always-on commands remove the ip dhcp relay always-on command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp relay always-on

no ip dhcp relay always-on

default ip dhcp relay always-on

Example

This command enables the DHCP relay agent.

switch(config)# ip dhcp relay always-on
switch(config)#

ip dhcp relay information option (Global)

The ip dhcp relay information option command configures the switch to attach tags to DHCP requests before forwarding them to the DHCP servers designated by the ip helper-address commands. The command specifies the tag contents for packets forwarded by the configured interface. The default value for each interface configured with an ip helper-address is the name and number of the interface.

The no ip dhcp relay information option and default ip dhcp relay information option commands restore the switch default setting of not attaching tags to DHCP requests by removing the ip dhcp relay information option command from running-config.

Command Mode

DHCP Relay Configuration

Command Syntax

ip dhcp relay information option [circuit-id | remote-id] encoding [%p | %x]] [vendor-option]

no ip dhcp relay information option

default ip dhcp relay information option

Example

This command enables the attachment of tags to DHCP requests forwarded to DHCP server addresses with the circuit ID as a string:

switch(config)# ip dhcp relay information option
switch(config-information-option)# circuit-id encoding %p

ip dhcp relay information option circuit-id

The ip dhcp relay information option circuit-id command specifies the content of tags that the switch attaches to DHCP requests before forwarding them from the configuration mode interface to DHCP server addresses specified by ip helper-address commands. Tags attach to outbound DHCP requests only if you enable the information option on the switch (ip dhcp relay information option circuit-id).

The no ip dhcp relay information option circuit-id and default ip dhcp relay information option circuit-id commands restore the default content setting for the configuration mode interface by removing the corresponding command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ip dhcp relay information option circuit-id id_label

no ip dhcp relay information option circuit-id

default ip dhcp relay information option circuit-id

Parameters

id_label- Specifies the tag content. Use a format in alphanumeric characters (maximum 15 characters).

Example

This command configures x-1234 as the tag content for packets send from VLAN 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ip dhcp relay information option circuit-id x-1234
switch(config-if-Vl200)#

ip dhcp snooping

The ip dhcp snooping command enables DHCP snooping globally on the switch. Configure DHCP snooping as a set of Layer 2 processes and use it with DHCP servers to control network access to clients with specific IP/MAC addresses. The switch supports Option-82 insertion,a DHCP snooping process that allows relay agents to provide remote-ID and circuit-ID information to DHCP reply and request packets. DHCP servers use this information to determine the originating port of DHCP requests and associate a corresponding IP address to that port. DHCP servers use port information to track host location and IP address usage by authorized physical ports.

DHCP snooping uses the information option (Option-82) to include the switch MAC address as the router-ID along with the physical interface name and VLAN number as the circuit-ID in DHCP packets. After adding the information to the packet, the DHCP relay agent forwards the packet to the DHCP server as specified by the DHCP protocol.

DHCP snooping on a specified VLAN requires all of these conditions to be met:

Enable DHCP snooping globally.
Enabled insertion of option-82 information in DHCP packets.
Enable DHCP snooping on the specified VLAN.
Enable DHCP relay on the corresponding VLAN interface.

The no ip dhcp snooping and default ip dhcp snooping commands disables global DHCP snooping by removing the ip dhcp snooping command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp snooping

no ip dhcp snooping

default ip dhcp snooping

Related Commands

ip dhcp snooping information option enables insertion of option-82 snooping data.
ip helper-address enables the DHCP relay agent on a configuration mode interface.

Example

This command globally enables snooping on the switch, displaying DHCP snooping status prior and after invoking the command.

switch(config)# show ip dhcp snooping
DHCP Snooping is disabled
switch(config)# ip dhcp snooping
switch(config)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is not operational
DHCP Snooping is configured on following VLANs:
  None
DHCP Snooping is operational on following VLANs:
  None
Insertion of Option-82 is disabled
switch(config)#

ip dhcp snooping bridging

The ip dhcp snooping bridging command enables the DHCP snooping bridging configuration.

The no ip dhcp snooping bridging command removes the DHCP snooping bridging configuration from the running-config.

Command Mode

Global Configuration Mode

Command Syntax

ip dhcp snooping bridging

no ip dhcp snooping bridging

Example

This command configures the DHCP snooping bridging.

switch# configure
switch(config)# ip dhcp snooping bridging

ip dhcp snooping information option

The ip dhcp snooping information option command enables the insertion of option-82 DHCP snooping information in DHCP packets on VLANs where you have DHCP snooping enabled. DHCP snooping provides a Layer 2 switch process that allows relay agents to provide remote-ID and circuit-ID information to DHCP reply and request packets. DHCP servers use this information to determine the originating port of DHCP requests and associate a corresponding IP address to that port.

DHCP snooping uses information option (Option-82) to include the switch MAC address (router-ID) along with the physical interface name and VLAN number (circuit-ID) in DHCP packets. After adding the information to the packet, the DHCP relay agent forwards the packet to the DHCP server through DHCP protocol processes.

DHCP snooping on a specified VLAN requires all of these conditions to be met:

Enable DHCP snooping globally.
Enabled insertion of option-82 information in DHCP packets.
Enable DHCP snooping on the specified VLAN.
Enable DHCP relay on the corresponding VLAN interface.

Ifnot enabling DHCP snooping globally, the ip dhcp snooping information option command persists in running-config without any operational effect.

The no ip dhcp snooping information option and default ip dhcp snooping information option commands disable the insertion of option-82 DHCP snooping information in DHCP packets by removing the ip dhcp snooping information option statement from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp snooping information option

no ip dhcp snooping information option

default ip dhcp snooping information option

Example

These commands enable DHCP snooping on DHCP packets from ports on snooping-enabled VLANs. DHCP snooping was previously enabled on the switch.

switch(config)# ip dhcp snooping information option
switch(config)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
  100
DHCP Snooping is operational on following VLANs:
  100
Insertion of Option-82 is enabled
  Circuit-id format: Interface name:Vlan ID
  Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch(config)#

ip dhcp snooping vlan

The ip dhcp snooping vlan command enables DHCP snooping on specified VLANs. DHCP snooping provides a Layer 2 process that allows relay agents to provide remote-ID and circuit-ID information in DHCP packets. DHCP servers use this data to determine the originating port of DHCP requests and associate a corresponding IP address to that port. Configure DHCP snooping on a global and VLAN basis.

VLAN snooping on a specified VLAN requires each of these conditions:

Enable DHCP snooping globally.
Enable insertion of option-82 information in DHCP packets.
Enable DHCP snooping on the specified VLAN.
Enable DHCP relay on the corresponding VLAN interface.

If not enabling global DHCP snooping, the ip dhcp snooping vlan command persists in running-config without any operational affect.

The no ip dhcp snooping information option and default ip dhcp snooping information option commands disable DHCP snooping operability by removing the ip dhcp snooping information option statement from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp snooping vlan v_range

no ip dhcp snooping vlan v_range

default ip dhcp snooping vlan v_range

Parameters

v_range - Specifies the range of VLANs to enable DHCP snooping. Formats include a number, a number range, or a comma-delimited list of numbers and ranges. Numbers range from 1 to 4094.

Example

These commands enable DHCP snooping globally, DHCP snooping on VLAN interface 100, and DHCP snooping on vlan100.

switch(config)# ip dhcp snooping
switch(config)# ip dhcp snooping information option
switch(config)# ip dhcp snooping vlan 100
switch(config)# interface vlan 100
switch(config-if-Vl100)# ip helper-address 10.4.4.4
switch(config-if-Vl100)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
  100
DHCP Snooping is operational on following VLANs:
  100
Insertion of Option-82 is enabled
  Circuit-id format: Interface name:Vlan ID
  Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch(config)#

ipv6 dhcp relay always-on

The no ipv6 dhcp relay always-on and default ipv6 dhcp relay always-on commands remove the ipv6 dhcp relay always-on command from running-config.

Command Mode

Global Configuration

Command Syntax

ipv6 dhcp relay always-on

no ipv6 dhcp relay always-on

default ipv6 dhcp relay always-on

Example

This command enables the DHCP relay agent.

switch(config)# ipv6 dhcp relay always-on
switch(config)#

ipv6 dhcp relay destination

The ipv6 dhcp relay destination command enables the DHCPv6 relay agent and sets the destination address on the configuration mode interface.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ipv6 dhcp relay destination [ipv6_addr][source-address ipv6_addr]

no ipv6 dhcp relay destination [ipv6_addr]

default ipv6 dhcp relay destination [ipv6_addr]

Parameters

ipv6_addr DCHP Server’s IPv6 address.
source-address ipv6_addr specify the source IPv6 address to communicate with DHCP server.

Guidelines

Example

This command enables the DHCPv6 relay agent and sets the destination address to 2001:0db8:0:1::1 on interface ethernet 4.

switch(config)# interface ethernet 4
switch(config-if-Et4)# ipv6 dhcp relay destination 2001:0db8:0:1::1
switch(config-if-Et4)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCPv6 Relay Link-layer Address Option (79) is disabled
DHCP Smart Relay is disabled
Interface: Ethernet4
  DHCP Smart Relay is disabled
  DHCP servers: 1::1
                2001:db8:0:1::1
switch(config-if-Et4)#

ipv6 dhcp relay option link-layer address

The no ipv6 dhcp relay option link-layer address command disables the link layer address option (79) in the global configuration mode.

Command Mode

Global Configuration

Command Syntax

ipv6 dhcp relay option link-layer address

no ipv6 dhcp relay option link-layer address

default ipv6 dhcp relay option link-layer address

Example

This command enables the insertion of link layer address option (79) in the global configuration mode.

switch(config)# ipv6 dhcp relay option link-layer address

ipv6 dhcp relay option remote-id

Command Mode

Global Configuration

Command Syntax

ipv6 dhcp relay option remote-id format {%m:%h:%p | %m:%i | %m:%p}

no ipv6 dhcp relay option remote-id format {%m:%h:%p | %m:%i | %m:%p}

Parameters

remote-id - Add Option 37 to the DHCP Relay configuration.
format - Select one of the following as the format for the remote-id:
- %m:%h:%p - Specify the MAC address, hostname, and interface name as the remote-id.
- %m:%i - Specify the MAC address and interface ID as the remote-id.
- %m:%p - Specify the MAC address and interface name as the remote-id.

Example

Use the following command to specify using the MAC address, hostname, and interface name for the Remote-ID:

switch(config)# ipv6 dhcp relay option remote-id format %m:%h:%p

ipv6 dhcp snooping

The ipv6 dhcp snooping command enables DHCP snooping globally on the switch.

The no ipv6 dhcp snooping and default ipv6 dhcp snooping commands disable global DHCP snooping by removing the ipv6 dhcp snooping command from running-config.

Command Mode

Global Configuration

Command Syntax

ipv6 dhcp snooping [remote-id option | vlan [$ | vlan-range]]

no ipv6 dhcp snooping [remote-id option | vlan [$ | vlan-range]]

default ipv6 dhcp snooping [remote-id option | vlan [$ | vlan-range]]

Parameters

remote-id option configures the remote ID option.
vlan enables IPv6 DHCP snooping for a specific VLAN. Numbers range from 1 to 4094.
$ end of range.
vlan-range VLANs based on the snooping enabled. Formats include a number, a number range, or a comma-delimited list of numbers and ranges. Numbers range from 1 to 4094.

Examples

The following configuration enables IPv6 DHCP snooping feature at the global level.

switch(config)# ipv6 dhcp snooping
switch(config)# ipv6 dhcp snooping remote-id option
switch(config)# ipv6 dhcp snooping vlan <vlan|vlan-range>

The following command display IPv6 DHCP snooping state.

switch(config)# ipv6 dhcp snooping
switch(config)# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
  2789-2790
DHCPv6 Snooping is operational on following VLANs:
  2789
Insertion of Option-37 is enabled

name

The name command in DHCP Server Subnet Configuration Mode creates a name for the subnet and improves readability of the subnet list.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

DHCP Server IPv4 or IPv6 Subnet Configuration

Command Syntax

name

no name

default name

Parameters

name name - Specify a name for the subnet.

Example

Use the following commands to configure a name, remote_switch, to subnet 172.16.23.11/32:

switch(config)# dhcp server
switch(config-dhcp-server)# subnet 172.16.23.11/32
switchconfig-dhcp-subnet-ipv4)# name remote_switch
switchconfig-dhcp-subnet-ipv4)#

prefix-delegation

The prefix-delegation command in DHCP Server IPv6 Subnet Configuration Mode configures a block of IPv6 addresses for a downstream router on the network. The router then splits the block into subnets and assigns the IPv6 addresses to devices on its network.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

DHCP Server IPv6 Subnet Configuration

Command Syntax

prefix-delegation

no prefix-delegation

default prefix-delegation

Parameters

prefix-delegation ipv6_address_range - Specify a block of IPv6 addresses for the IPv6 subnet.

Example

Use the following commands to delegate a block of IPv6 addresses, 2001:db8:100:aa00::/56, to subnet 2001:db8:100::/48:

switch(config)# dhcp server
switch(config-dhcp-server)# subnet 2001:db8:100::/48
switchconfig-dhcp-subnet-ipv6)# prefix-delegation 2001:db8:100:aa00::/56
switchconfig-dhcp-subnet-ipv6)#

range

The range command in DHCP Server Subnet Configuration Mode explicitly defines the contiguous block of IP addresses that the DHCP server is allowed to dynamically lease to clients.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

DHCP Server IPv6 Subnet Configuration

Command Syntax

subnet [ipv4 | ipv6] range start_ipaddress end_ipaddress

no range

default range

Parameters

subnet [ipv4 \ ipv6] - Specify an IPv4 or IPv6 address for the subnet.
range start_ipaddress end_ipaddress - Specify a range for the subnet.

Example

Use the following commands to configure a name, remote_switch, to subnet 172.16.23.11/32:

switch(config)# dhcp server
switch(config-dhcp-server)# subnet 172.16.23.11/32
switchconfig-dhcp-subnet-ipv4)# range 172.16.23.100 172.16.23.200
switchconfig-dhcp-subnet-ipv4)#

reservations mac-address

The reservations mac-address command in DHCP Server IPv4 Subnet Reservations Configuration Mode builds static DHCP bindings from the client MAC address on the reservations list. Once in the DHCP Server IPv4 Subnet Reservations MAC Address Configuration Mode, add reservations for a hostname and an IPv4 address to map to the MAC address.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

DHCP Server IPv4 Subnet Reservations Configuration

Command Syntax

reservations mac-address

Parameters

reservations mac-address mac_address - Specify a MAC address reservation for the subnet.
hostname hostname - Specify a host name to map to the MAC address.
ipv4-address ip_address - Specify an IPv4 address to map to the MAC address.

Example

Use the following commands to configure a reservation for MAC address, 80:A9:97:27:1A:AC, and IPv4 address, 172.26.23.25 to the subnet reservation. 172.16.23.11/32:

switch(config)# dhcp server
switch(config-dhcp-server)# subnet 172.16.23.11/32
switchconfig-dhcp-subnet-ipv4)# reservations
switchconfig-dhcp-subnet-ipv4-reserve)# mac-address 80:A9:97:27:1A:AC
switchconfig-dhcp-subnet-ipv4-rsrv-mac-address)# ipv4-address 172.26.23.25
switchconfig-dhcp-subnet-ipv4-rsrv-mac-address)#

show dhcp server

Use the show dhcp server command to display DHCP server information.

Command Mode

EXEC

Command Syntax

show dhcp server [ipv4 | ipv6 | leases | vrf]

Parameters

ipv4 Displays details related to IPv4.
ipv6 Displays details related to IPv6.
leases Displays active leases.
- A.B.C.D/E IPv4 subnet.
- NAME Subnet name.

Examples

The following output displays DHCPv4.

switch# show dhcp server ipv4
IPv4 DHCP Server is active
Debug log is enabled
DNS server(s): 10.2.2.2
DNS domain name: mydomain
Lease duration: 1 days 0 hours 0 minutes
TFTP server:
myserver (Option 66)
10.0.0.3 (Option 150)
TFTP file: fileFoo
Active Leases: 1
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Inactive (Could not determine VRF)
   Ethernet2   Inactive (Not in default VRF)
   Ethernet3   Inactive (Kernel interface not created yet)
   Ethernet4   Inactive (Not up)
   Ethernet5   Inactive (No IP address)
   Ethernet6   Active

Vendor information:
Vendor ID: default
  Sub-options         Data       
---------------- ----------------
      1          192.0.2.0, 192.0.2.1

Vendor ID: vendorFoo
  Sub-options       Data       
---------------- -----------
      2            192.0.2.2
      3            “data”

Subnet: 10.0.0.0/8
Subnet name: subnetFoo
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.1.1.1 10.2.2.2
Lease duration: 3 days 3 hours 3 minutes
Default gateway address: 10.0.0.3
TFTP server:
subnetServerFoo (Option 66)
10.0.0.4 (Option 150)
TFTP boot file: subnetFiletftp
Active leases: 1
Reservations:
MAC address: 1a1b.1c1d.1e1f
IPv4 address: 10.0.0.1

MAC address: 2a2b.2c2d.2e2f    
IPv4 address: 10.0.0.2

In this example, DHCPv6 is configured with subnet fe80::/10 while being enabled on Ethernet1 with address fe80::1/64 and on Ethernet3 with address fe80::2/64.

switch# show dhcp server ipv6
IPv6 DHCP server is active
Debug log is enabled                                                                                                                                                                                                                     
DNS server(s): fe80::6                                                                                                                                                                                                                     
DNS domain name: testaristanetworks.com                                                                                                                                                                                                        
Lease duration: 1 days 3 hours 30 minutes                                                                                                                                                                                                      
Active leases: 0                                                                                                                                                                                                                               
IPv6 DHCP interface status:                                                                                                                                                                                                                    
   Interface    Status                                                                                                                                                                                                                         
--------------- ------                                                                                                                                                                                                                         
   Ethernet1    Active
   Ethernet3    Active                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
                                                                                                                                                                                                                                               
Subnet: fe80::/10                                                                                                                                                                                                                      
Subnet name: foo                                                                                                                                                                                                                                                                                                                                                                                                                                     
Range: fe80::1 to fe80::3
DNS server(s): fe80::4 fe80::5                                                                                                                                                                                                                                                                                                                                                                                                                                          
Direct: Inactive (Multiple interfaces match this subnet: Ethernet1 Ethernet3)
Relay: Active                                                                                                                                                                                                                            
Active leases: 0

switch# show dhcp server ipv6
IPv6 DHCP server is active                                                                                                                                                                                                                     
DNS server(s):  fc00::2                                                                                                                                                                                                                     
DNS domain name: testaristanetworks.com                                                                                                                                                                                                        
Lease duration: 1 days 3 hours 30 minutes                                                                                                                                                                                                      
Active leases: 0                                                                                                                                                                                                                               
IPv6 DHCP interface status:                                                                                                                                                                                                                    
   Interface    Status                                                                                                                                                                                                                         
--------------- ------                                                                                                                                                                                                                         
   Ethernet1    Active                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
                                                                                                                                                                                                                                               
Subnet: fc00::/7                                                                                                                                                                                                                      
Subnet name: data                                                                                                                                                                                                                               
Range: fc00::1 to fc00::5                                                                                                                                                                                                       
DNS server(s): fc00::6 fc00::8                                                                                                                                                                                                                                                                                                                                                                                                                                          
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
                                                                                                                                                                                                                                  
Active leases: 0

Subnet: fe80::/10                                                                                                                                                                                                                      
Subnet name: bar                                                                                                                                                                                                                                                                                                                                                                                                                                         
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
                                                                                                                                                                                                                                  
Active leases: 0

After disabling a subnet, the show dhcp server command displays the disable message with a reason. The number of active leases of the disabled subnets displays as 0. In this example, there are overlapping subnets.

switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Active

Subnet: 10.0.0.0/24 (Subnet is disabled - overlapping subnet 10.0.0.0/8)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0

Subnet: 10.0.0.0/8 (Subnet is disabled - overlapping subnet 10.0.0.0/24)
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0

In this example, the display output shows overlapping ranges.

switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Active

Subnet: 10.0.0.0/8 (Subnet is disabled - range 10.0.0.9-10.0.0.12 overlaps with an existing pool)
Range: 10.0.0.1 to 10.0.0.10
Range: 10.0.0.9 to 10.0.0.12
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0

This example displays duplicate static IP address reservation.

Subnet: 10.0.0.0/8 (Subnet is disabled - ipv4-address 10.0.0.11 is reserved more than once)
Subnet name:
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0
Reservations:
MAC address: 1a1b.1c1d.1e1f    
IPv4 address: 10.0.0.11

MAC address: 2a2b.2c2d.2e2f    
IPv4 address: 10.0.0.11

switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a

2000:0:0:40::b                                                                                                                                                                                                                                 
End: 2019/06/20 18:06:33 UTC                                                                                                                                                                                                                   
Last transaction: 2019/06/20 14:36:33 UTC                                                                                                                                                                                                      
MAC address: 165a.a86d.ffac

show dhcp server leases

Use the show dhcp server leases command to display DHCP server lease information.

Command Mode

EXEC

Command Syntax

show dhcp server leases [ipv4 | ipv6]

Parameters

ipv4 - Displays details related to IPv4.
ipv6 - Displays details related to IPv6.

Example

Use the show dhcp server leases command to display detailed information about the IP addresses allocated by the DHCP Server including the IP address, the expected end time for that address, the time when assigning the address, and the equivalent MAC address.

switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a

2000:0:0:40::b                                                                                                                                                                                                                                 
End: 2019/06/20 18:06:33 UTC                                                                                                                                                                                                                   
Last transaction: 2019/06/20 14:36:33 UTC                                                                                                                                                                                                      
MAC address: 165a.a86d.ffac

show ip dhcp relay

The show ip dhcp relay command displays the DHCP relay agent configuration status on the switch.

Command Mode

EXEC

Command Syntax

show ip dhcp relay

Example

This command displays the DHCP relay agent configuration status.

switch> show ip dhcp relay
DHCP Relay is active
DHCP Relay Option (82)is enabled
DHCP Relay vendor-specific suboption (9) under information option (82)
DHCP Smart Relay is enabled
Interface: Vlan100
  DHCP Smart Relay is disabled
  DHCP servers: 10.4.4.4
switch>

show ip dhcp relay counters

The show ip dhcp relay counters command displays the number of DHCP packets received, forwarded, or dropped on the switch and on all interfaces enabled as DHCP relay agents.

Command Mode

EXEC

Command Syntax

show ip dhcp relay counters

Example

This command displays the IP DHCP relay counter table.

switch> show ip dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  376  376    0 | 4 days, 19:55:12 ago
 All Resp |  277  277    0 |
          |                |
 Vlan1000 |    0    0    0 | 4 days, 19:54:24 ago
 Vlan1036 |  376  277    0 | 4 days, 19:54:24 ago

switch>

show ip dhcp snooping

The show ip dhcp snooping command displays the DHCP snooping configuration.

Command Mode

EXEC

Command Syntax

show ip dhcp snooping

Example

This command displays the switch’s DHCP snooping configuration.

switch> show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
  100
DHCP Snooping is operational on following VLANs:
  100
Insertion of Option-82 is enabled
  Circuit-id format: Interface name:Vlan ID
  Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch>

show ip dhcp snooping counters

The show ip dhcp snooping counters command displays counters that track the quantity of DHCP request and reply packets received by the switch. The output displays data for each VLAN or aggregated for all VLANs with counters for packets dropped.

Command Mode

EXEC

Command Syntax

show ip dhcp snooping counters [counter_typedebug]

Parameters

counter_type - Displays the type of counter.

no parameter - Command displays counters for each VLAN.
debug - Command displays aggregate counters and drop cause counters.

Examples

This command displays the number of DHCP packets sent and received on each VLAN.

switch> show ip dhcp snooping counters

     | Dhcp Request Pkts | Dhcp Reply Pkts |
Vlan |  Rcvd  Fwdd  Drop | Rcvd Fwdd  Drop | Last Cleared
-----|------ ----- ------|----- ---- ------|-------------
 100 |     0     0     0 |    0    0     0 |  0:35:39 ago

switch>

This command displays the number of DHCP packets sent on the switch.

switch> show ip dhcp snooping counters debug
Counter                       Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received                                      0                 0
Forwarded                                     0                 0
Dropped - Invalid VlanId                      0                 0
Dropped - Parse error                         0                 0
Dropped - Invalid Dhcp Optype                 0                 0
Dropped - Invalid Info Option                 0                 0
Dropped - Snooping disabled                   0                 0

Last Cleared:  3:37:18 ago
switch>

show ip dhcp snooping hardware

The show ip dhcp snooping hardware command displays internal hardware DHCP snooping status on the switch.

Command Mode

EXEC

Command Syntax

show ip dhcp snooping hardware

Example

This command DHCP snooping hardware status.

switch> show ip dhcp snooping hardware
DHCP Snooping is enabled
DHCP Snooping is enabled on following VLANs:
    None
    Vlans enabled per Slice
        Slice:  FixedSystem
        None
switch>

show ipv6 dhcp relay counters

The show ipv6 dhcp relay counters command displays the number of DHCP packets received, forwarded, or dropped on the switch and on all interfaces enabled as DHCP relay agents.

Command Mode

EXEC

Command Syntax

show ipv6 dhcp relay counters

Example

This command displays the IP DHCP relay counter table.

switch> show ipv6 dhcp relay counters
          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  376  376    0 | 4 days, 19:55:12 ago
 All Resp |  277  277    0 |
          |                |
Ethernet4 |  207  148    0 | 4 days, 19:54:24 ago

switch>

show ipv6 dhcp snooping

The show ipv6 dhcp snooping command displays information about the DHCP snooping configuration.

Command Mode

EXEC

Command Syntax

show ipv6 dhcp snooping

Related Commands

ipv6 dhcp snooping
show ipv6 dhcp snooping counters
show ipv6 dhcp snooping hardware
clear ipv6 dhcp snooping counters

Example

This command displays the switch’s DHCP snooping configuration.

switch# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
  2789-2790
DHCPv6 Snooping is operational on following VLANs:
  2789
Insertion of Option-37 is enabled

show ipv6 dhcp snooping counters

Command Mode

EXEC

Command Syntax

show ipv6 dhcp snooping counters [COUNTER_TYPE]

Parameters

COUNTER_TYPE The type of counter that the command displays.
no parameter command displays counters for each VLAN.
debug command displays aggregate counters and drop cause counters.

Examples

This command displays the number of DHCP packets sent and received on each VLAN.

switch# show ipv6 dhcp snooping counters

     | Dhcpv6 Request Pkts | Dhcpv6 Reply Pkts | 
Vlan |  Rcvd   Fwdd   Drop |  Rcvd  Fwdd  Drop | Last Cleared
-----|------ ------ -------|------ ----- ------|------------- 
2789 |     1      1      0 |     1     1     0 |  0:03:09 ago

This command displays the number of DHCP packets sent on the switch.

switch# show ipv6 dhcp snooping counters debug

Counter                       Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received                                      1                 1
Forwarded                                     1                 1
Dropped - Invalid VlanId                      0                 0
Dropped - Parse error                         0                 0
Dropped - Invalid Dhcp Optype                 0                 0
Dropped - Invalid Remote-ID Option            0                 0
Dropped - Snooping disabled                   0                 0

Last Cleared:  0:04:29 ago

show ipv6 dhcp snooping hardware

The show ipv6 dhcp snooping hardware command displays internal hardware DHCP snooping status on the switch.

Command Mode

EXEC

Command Syntax

show ipv6 dhcp snooping hardware

Example

This command displays DHCP snooping hardware status.

switch# show ipv6 dhcp snooping hardware
DHCPv6 Snooping is enabled
DHCPv6 Snooping is enabled on following VLANs:
    2789
    Vlans enabled per Slice
        Slice:  Linecard0-0
        2789
        Slice:  Linecard0-1
        2789
        Slice:  Linecard0-2
        2789
        Slice:  Linecard0-3
        2789

IP Address Locking

EOS provides IP Address Locking capabilities when configured on an Ethernet Layer 2 port.

After enabling IP Address Locking on a Layer 2 (L2) port, the port only permits IP and ARP packets with authorized IP source addresses. Configure IP Address Locking in one of two modes:

IPv4
IPv6

IP Address Locking prevents a host on a different interface from claiming ownership of an IP address through ARP spoofing. IPv6 Locking extends this behavior to IPv6 packets, including ICMPv6 Neighbor Discovery Router Advertisement and Redirect and DHCP server-to-client packets.

On an IPv4 Locked Port, the ARP protocol performs the following actions on the network:

Probing with the IPv4 address 0.0.0.0 as the Sender Protocol Address (SPA).
Permit Duplicate Address Detection (DAD).
Drop incoming DHCP server response packets to avoid any rogue devices acting as DHCP servers.
Permit incoming DHCP client request packets on devices to complete the DHCP handshake and obtain a DHCP lease.

On an IPv6 Locked Port, the ARP protocol performs the following actions on the network:

Drop incoming DHCPv6 server response packets.
Permit incoming DHCPv6 client request packets.
On an incoming ICMPv6 network device, perform the following actions:
- Drop Router Advertisement packets since only routers should send these packets.
- Permit Router Solicitation packets.
- Drop redirect packets as only routers should send these packets.
Figure 1. IP Address Locking

IP Address Locking determines port authorization for IP addresses by utilizing MAC address learning and DHCP LeaseQuery. When using this mechanism, it is important to verify that the network's DHCP servers are configured to support LeaseQuery messages.

Alternatively, IP Locking can be set up to monitor incoming DHCPACK packets on designated ports to verify IP authorization. This specific configuration method operates independently, eliminating the need for DHCP LeaseQuery.

This chapter describes IP Address Locking configuration tasks and associated commands.

IP Address Locking Configuration
IP Address Locking Commands

IP Address Locking Configuration

This section describes IP Locking configuration tasks. Topics in this section include:

Preparing a Switch for IP Address Locking
Enabling IP Address Locking
Disabling IP Address Locking
Enabling IP Address Locking on Ports
Enabling IP Address Locking on All Ports of a VLAN
Blocking IPv4 and ARP Packets
Configuring IP Locking Static Leases
Configuring IP Address Locking Lease Query Timeout
Configuring IP Locking DHCP Server Interface
Configuring Locked Address Expiration
Enforcing Locked IP Addresses
Displaying IP Address Locking Counters
Displaying IP Address Locking

Preparing a Switch for IP Address Locking

Before enabling IPv4 Address Locking, you must configure a DHCP Server and a Local Layer 3 interface.

Enabling a DHCP Server for IPv4 Address Locking

Add the DHCP servers used by hosts to acquire leases. IPv4 Address Locking communicates with the DHCP servers to learn the authorized IP addresses on the switch.

Example

The following commands enable DHCP servers with an IPv4 address of 10.1.1.1, and another DHCP server with the IP address, 10.30.1.3:

switch(config-address-locking)# dhcp server ipv4 10.1.1.1
switch(config-address-locking)# dhcp server ipv4 10.30.1.3

Adding a Local Layer 3 Interface

Add a local L3 interface to communicate with the DHCP server. This could be the management interface, a routed interface, or a Switch Virtual Interface (SVI). This interface requires an assigned valid IP address, routable to the configured DHCP server, and can reside in a non-default VRF. The switch packets sent to the DHCP Server use the interface IP address as the source IP address.

Examples

The following commands configure an interface with a valid IP address, 10.10.1.2/16, on VLAN2160:

switch# configure
switch(config)# interface Vlan2160
switch(config-if-Vl2160)# ip address 10.10.1.2/16

The following commands add the interface to the IP Address Locking configuration:

switch# configure 
switch(config)# address locking
switch(config-address-locking)# local-interface Vlan2160

Enabling IP Address Locking

Configure IP Address Locking for either IPv4 or IPv6 addresses, and both types of IP addresses can be enabled for IP Address Locking. IPv6 Address Locking requires a different approach outlined in this section.

Enabling IP Address Locking

Configure IPv4 Address Locking commands in the configuration mode.

Example

Use the following commands to enter IP Address Locking configuration mode and add IPv4 Address Locking:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv4

Enabling IPv6 Address Locking

To enable IPv6 locking, disable the enforcement of IPv6 Address Locking.

Example

Use the following commands to disable IPv6 Address Locking enforcement, and then enable IPv6 for IP Address Locking:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv6 enforcement disabled
switch(config-address-locking)# locked-address ipv6

Disabling IP Address Locking

Disable IP Address Locking using the disabled command in address-locking mode. This turns off the feature and allows a host to use any IP address, authorized or unauthorized, on any port.

Example

switch# configure
switch(config)# address locking
switch(config-address-locking)# disabled

Enabling IP Address Locking on Ports

To enable IPv4 Address Locking on ports connected to clients, IP Address Locking must be enabled in the Interface Configuration Mode. Running this command only enables IPv4 Locking and overrides the previous configuration for the interface.

Example

Use the following commands to enable IP Address Locking for the interface, Ethernet27/1:

switch(config)# interface Ethernet27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-address-locking)# address-family ipv4

Use the following commands to enable IPv6 Address Locking on ports connected to clients, use the address-family ipv6 parameter.

Example

To activate IPv6 Address Locking on interface Ethernet53 and port 4, use the following syntax:

switch(config)# interface Ethernet53/4
switch(config-if-Et53/4)# address locking
switch(config-if-Et53/4-address-locking)# address-family ipv6

Enabling IP Address Locking on All Ports of a VLAN

To activate IP Address Locking on all VLAN port members, use the VLAN address locking configuration submode.

Examples

The following commands activate IPv4 Address Locking on VLAN 20:

switch(config)# vlan 20
switch(config-vlan-20)# address locking
switch(config-vlan-20-addr-lock)# address-family ipv4

To exclude a VLAN port member, disable IP Address Locking on that port using the interface configuration submode.

The following commands exclude port 25 on Ethernet2:

switch(config)# interface Ethernet2/25
switch(config-if-Et2/25)# address locking
switch(config-if-Et2/25)# address-family ipv4 disabled

To configure IPv6 Address Locking on all ports, use the same commands, but designate the address-family as ipv6.

The following commands enable IPv6 Address Locking and override the previous configuration for the interface.

switch(config)# interface Ethernet 27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-address-locking)# address-family ipv6

To enable IPv6 Address Locking on all members of a port for VLAN 20, use the IPv6 Locking commands in the VLAN address locking configuration sub-mode.

switch(config)# vlan 20
switch(config-vlan-20)# address locking
switch(config-vlan-20-addr-lock)# address-family ipv6

Use the following command to enable both IPv4 and IPv6 Address Locking on a port:

switch(config)# interface Ethernet 27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-address-locking)# address-family ipv4 
switch(config-if-Et27/1-address-locking)# address-family ipv6

Blocking IPv4 and ARP Packets

Use the deny ip_address on IPv4 Address Locking ports to block all IPv4 and ARP packets with a specific source IPv4 address. The port denies the packet and affects only IPv4 enforcement modes. This action deauthorizes the addresses on the port and can be configured with multiple IPv4 addresses. You must configure this on an interface already configured with IPv4 Address Locking.

Note: Use only IPv4 addresses with this configuration.

Example

switch(config)# interface Ethernet27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-addr-lock)# deny 172.21.16.25

Configuring IP Locking Static Leases

The lease mac command within address locking configuration mode installs a lease into hardware for the configured IP address on the interface with the configured associated MAC address. If the MAC address does not appear in the MAC table or the MAC address on an interface without a configured IP Locking feature, the lease does not install until the interface adds the MAC address to an interface configured with IP Locking.

Note: IP Locking removes from the switch any lease from the DHCP server that matches either the same IP or MAC as a statically configured lease.

Example

Use the following commands to configure an IP address, 172.21.13.11, and MAC Address, a0:ce:c8:b1:78:d3, with a static lease:

switch# configure
switch(config)# address locking
switch(config-address-locking)# lease 172.21.13.11 mac a0:ce:c8:b1:78:d3

Clearing Leases

The clear address locking lease command removes the lease from hardware. The command removes lease bindings at different granularities.

The clear address locking lease ipv4 V4ADDR command removes a single lease associated with an IPv4 address.
The clear address locking lease ipv6 V6ADDR command removes a single lease associated with an IPv6 address.
The clear address locking lease intf ethernet slot command removes all leases associated with the specified interface.
The clear address locking lease all removes all leases on the switch.

Configuring IP Address Locking Lease Query Timeout

The command, lease query retry interval interval timeout minutes configures sending lease queries at specific retry intervals. The no lease query retry command removes the retry interval and timeout configuration.

Example

Use the following commands to configure an interval, 5, and timeout of 100 minutes:

switch(config)# address locking
switch(config-address-locking)# lease query retry interval 5 timeout 100

IP Address Locking sends out DHCP LeaseQuery requests to all configured DHCP servers in the following cases:

When an IP Address Locking enabled port learns a MAC address, IP Address Locking sends out a LeaseQuery request for the learned MAC address. After learning the MAC address, IP Address Locking waits one (1) second for the DHCP.
When an IP Address Locking enabled port removes a MAC address after enabling the locked-address expiration mac disabled feature, IP Address Locking sends a LeaseQuery request for the removed MAC address.
When the IP Address Locking agent restarts, EOS sends LeaseQuery requests for all MAC addresses on all IP Address Locking interfaces and for all MAC addresses in the IP Address Locking table.
When you add a new DHCP configuration, EOS sends new LeaseQuery requests to the new DHCP for all MAC addresses learned on all IP Address Locking interfaces and for all MAC addresses in the IP Address Locking leases table.
When you configure an interface with IP Address Locking, IP Address Locking sends LeaseQuery requests for all MAC addresses learned on that interface.
When an IP or ARP packet with a source IP address that does not exist in the IP Address Locking table arrives at an interface, EOS sends LeaseQuery requests for all MAC addresses on that interface. If the host already has a valid DHCP lease and the DHCP server sends a LeaseActive reply, IP Address Locking sends at least one (1) request every 50 seconds for that host as a result of dropped ARP or IP packets.
When the DHCP Lease reaches the last known expiration time, IP Address Locking sends out a LeaseQuery request for the MAC address associated with the lease. Note that this may be different from the actual expiration time. For example, if the host renewed the lease before the actual lease expires and received no LeaseQuery requests sent for the MAC address, IP Address Locking sends out a query at the original expiration time.
After a LeaseActive reply receives a matching MAC address of a previously received lease, IP Address Locking sends out a LeaseQuery request for the previous IP address associated with the updated MAC address.
After a LeaseActive reply receives a matching MAC address of a previously received lease, IP Address Locking sends out a LeaseQuery request for the previous MAC address associated with the updated IP address.

When IP Address Locking sends out a LeaseQuery request, and does not receive a LeaseActive reply, IP Address Locking sends six (6) additional retries over 64 seconds using an exponential backoff algorithm. A 0-25% delay sending requests which may take up to 80 seconds to send out all seven (7) requests.

Every LeaseQuery request includes a transaction ID. After sending the last request, and for an additional 10 seconds, IP Address Locking accepts any LeaseActive reply matching the transaction ID and then queries for the MAC address of a sent LeaseQuery request.

If a LeaseActive reply contains multiple IP addresses, IP Address Locking begins a query process for the additional IP addresses using the same retry mechanisms. However, if you configure the LeaseQuery retry interval and timeout but do not receive LeaseActive replies, IP Address Locking sends continuous lease query requests at the configured retry interval until reaching the specified timeout period.

Note: Alternatively, IP Locking can be configured to verify IP authorization by monitoring incoming DHCPACK packets on specified ports. This method eliminates the need for DHCP LeaseQuery by operating independently. However, it is only applicable when IP Address Locking uses DHCP LeaseQuery and MAC address learning to determine port authorization for IP addresses.

Configuring IP Locking DHCP Server Interface

Address-locking mode can be enabled using the command dhcp server interface <INTF>. In this mode, the IP Locking agent monitors the server interface for DHCP ACK packets and tracks release packets on protected interfaces.

Configuration Priorities and DHCP Lease Management

When both a local interface and a DHCP server interface are specified, the system prioritizes the local-interface <INTF> setting. In this scenario, IP Locking disregards the DHCP server interface and utilizes the local interface for outgoing DHCP LeaseQuery messages.

Furthermore, specifying DHCP server IP addresses within the dhcp server interface <INTF> configuration is optional. If specific IP addresses are provided, IP Locking strictly learns leases from those identified servers. However, if no addresses are defined, the agent will learn leases from all DHCP server traffic detected on the configured interfaces.

Example

Use the following command to configure the dhcp server interface Ethernet 28/1:

switch#config
switch(config)#address locking
switch(config-address-locking)#dhcp server interface Ethernet28/1

Configuring Locked Address Expiration

The IP addresses remain authorized and installed after the corresponding MAC addresses age out. IP Address Locking, by default, removes authorized leases after the corresponding MAC addresses age out. The locked-address expiration mac disabled command configures IP Address Locking to keep leases installed, after the corresponding MAC addresses age out.

Example

The following commands keep leases installed on the IP address:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address expiration mac disabled

Enforcing Locked IP Addresses

The locked-address ipv4 enforcement disabled command disables address filtering for all ports with IPv4 Address Locking enabled. This permits IPv4 packets while still keeping all other drop rules. When configured, IP Address Locking does not drop IP or ARP packets, and does not send out lease queries to configured DHCP servers.

Examples

The following commands disable IPv4 Address Locking globally:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv4 enforcement disabled

The following commands configure locked address enforcement for an interface:

switch(config)# interface Ethernet27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-address-locking)# locked-address ipv4 enforcement disabled

The following commands configure locked address enforcement for a VLAN:

switch(config)# vlan 20
switch(config-vlan-20)# address locking
switch(config-vlan-20-addr-lock)# locked-address ipv4 enforcement disabled

The locked-address ipv6 enforcement disabled command disables address filtering for all ports with IPv6 Locking enabled. This permits IPv6 packets while still keeping all other drop rules.

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv6 enforcement disabled

To configure locked address enforcement for an interface, use the following commands:

switch(config)# interface Ethernet27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-address-locking)# locked-address ipv6 enforcement disabled

To configure locked address enforcement for VLAN 20, use the following commands:

switch(config)# vlan 20
switch(config-vlan-20)# address locking
switch(config-vlan-20-addr-lock)# locked-address ipv6 enforcement disabled

Displaying IP Address Locking Counters

The show address locking counters command displays DHCP lease query messages sent, received, and dropped. The output provides two sets of counters:

The number of packets sent and received from each DHCP server.
The number of packets sent and received for each locked interface.

The output displays separate counters for the different types of messages communicated between the switch and the DHCP server.

Example

switch# show address locking counters
Lease Active Lease Unknown Lease Unassigned    	 
DHCP Server Query  Rcvd   Drop   Rcvd   Drop Rcvd     Drop    Unknown
----------- ----- ----- ------ ------ ------ -------- ------- -------
80.80.80.80 32860  8002 34     8001   32     13423     134    3234
            
            
Interface Query Lease Active Lease Unknown Lease Unassigned
--------- ----- ------------ ------------- ----------------
Ethernet2  1747 1234         189           324

The clear address locking counters command resets all the counters associated with IP Locking to zero.

Displaying IP Address Locking

Use the show address locking command to display the status of IPv4 and IPv6 locking.

Example

switch# show address locking
IP Locking is active
Interface        IPv4	                 IPv6
--------------- -------------------   ---------------------------
Ethernet27/1     yes 	                 no (not configured) 
Ethernet31/1     no (not configured)   no (not a layer 2 interface)

The show address locking command also displays interfaces with the reason IP Address Locking may not be enabled. For an interface without IP Address Locking enabled, the following priority (highest at top) imposes on the output:

Unconfigured.
Not a Layer 2 interface.
No local interface configured.
No DHCP server configured.

The show address locking table ipv4 command displays all the DHCP leases that IP Address Locking knows about, current status of installed leases, and the authorized interfaces for these IP addresses.

Example

switch# show address locking table ipv4
IP Address     MAC Address      Interface  Installed    Expiration Time
-------------- ---------------- ---------- ------------ --------------- 
10.30.4.4      ba76.a467.7ff8   Et27/1     installed     in 0:01:57

IP Address Locking Commands

IP Address Locking Configuration Commands

address locking deny
address locking dhcp
address-locking disable
address locking lease query
address locking local-interface

IP Address Locking Clear Commands

clear address locking lease

IPv4 Static Lease Commands

address locking lease

IP Address Locking Address Expiration Commands

locked-address expiration mac disabled

IP Address Locking Address Enforcement Commands

locked-address ipv4 enforcement disabled
locked-address ipv6 enforcement disabled

IP Address Locking Show Commands

show address locking
show address locking counters
show address locking table ipv4

DHCP Server Interface Command

dhcp server interface

address locking deny

Use the address locking command to block IPv4 and ARP packets with specific IPv4 addresses on the switch. You must perform this command from an interface configured for IP Address Locking on the switch.

Command Mode

Interface Configuration

Address Locking Configuration

Command Syntax

address locking deny ip_address

Parameter

ip_address - Specify the IPv4 address to block packets.

Example

Use the following command to deny IPv4 and ARP packets from IPv4 address, 172.16.21.131, from Ethernet interface, Ethernet53/4:

switch(config)# interface Ethernet53/4
switch(config-if-Et53/4)# address locking 
switch(config-address-locking)# deny 172.16.21.131

address locking dhcp

Use the address locking command to enter address locking mode and then dhcp to configure the DHCP server.

Command Mode

Address Locking Configuration

Command Syntax

address locking dhcp server ipv4 ip_address

Parameters

dhcp server - configure a DHCP server to assign IP addresses and assign static addresses using a MAC address.
- ipv4 ip_address - Specify the IP address for the DHCP server.
- mac mac_address - Specify the MAC address of the DHCP server.

Example

To configure a DHCP server with an IPv4 address. 172.13.21.3, use the following command:

switch(config)# address locking 
switch(config-address-locking)# dhcp server ipv4 172.13.21.3

address-locking disable

The address-locking disable command disables IP Address Locking on a switch.

Command Mode

Address Locking Configuration

Command Syntax

address-locking disable

Example

Use the address-locking command to enter address locking mode and then disable to disable the configuration.

switch(config)# address-locking
switch(config-address-locking)# disable

address locking lease

Use the address locking command to enter the IPv4 and IPv6 locking mode and then on the switch, use the lease to configure DHCP leases.

The lease mac command within the address locking configuration mode installs a lease onto hardware for the configured IP address on the interface with the associated configured MAC address. If the MAC address does not exist in the MAC table or the MAC address appears on an interface with an IP Locking configuration feature, the lease does not install until you add the MAC address to an interface configured with IP Locking.

Command Mode

Address Locking Configuration

Command Syntax

lease ip_address mac ip_address

Parameters

lease
- V4ADDR - Specify the IPv4 address to assign the lease.
- mac MACADDR - Configure the MAC address for a static lease.
no lease V4ADDR mac MACADDR - Removes the retry and timeout configuration.
default lease V4ADDR mac MACADDR - Configures the lease with the default IPv4 address and MAC address.

Example

To configure a lease with the IPv4 address, 1.1.1.1, and the MAC address, a.b.c, use the following command:

switch(config)# address locking 
switch(config-address-locking)# lease 1.1.1.1 mac a.b.c

address locking lease query

Use the address locking command to enter the IPv4 and IPv6 locking mode and then use the lease query retry interval to configure DHCP leases.

The no lease query retry command removes the retry interval and timeout configuration.

Command Mode

Address Locking Configuration

Command Syntax

lease query retry interval interval-time

Parameters

interval interval-time - Configure the query retry interval and timeout. The interval can be from 1 - 4294967295 seconds.

Example

To configure a lease with the retry interval, 5 seconds, and a timeout, 100, use the following command:

switch(config)# address locking
switch(config-address-locking)# lease query retry interval 5 timeout 100

address locking local-interface

Use the address locking local-interface command to configure a local interface for IPv4 and IPv6 locking IP addresses on the switch.

Command Mode

Address Locking Configuration

Command Syntax

Parameters

local-interface
- Ethernet slot_number - Configure an Ethernet subinterface for IPv4 and IPv6 locking IP addresses on the switch.
- Loopback loopback_interface_number - Configure a Loopback interface for IPv4 and IPv6 locking IP addresses on the switch.
- Management management_interface slot_number - for IPv4 and IPv6 locking IP addresses on the switch.
- Port-Channel lag_group port_channel_subinterface - Configure a Port-Channel interface for IPv4 and IPv6 locking IP addresses on the switch.
- Tunnel tunnel_interface - Configure a Tunnel interface for IPv4 and IPv6 locking IP addresses on the switch.
- Vlan vlan_interface_number - Configure a VLAN interface for IPv4 and IPv6 locking IP addresses on the switch.

Example

To configure an Ethernet interface, Ethernet53/4, use the following command:

switch(config)# address locking
switch(config-address-locking)# local-interface Ethernet53/4

clear address locking lease

Use the clear address locking lease command to remove lease bindings at different granularities.

The clear address locking lease ipv4 V4ADDR command removes a single lease associated with an IPv4 address.
The clear address locking lease ipv6 V6ADDR command removes a single lease associated with an IPv6 address.
The clear address locking lease intf ethernet slot command removes all leases associated with the specified interface.
The clear address locking lease all command remove all leases on the switch.

Command Mode

Address Locking mode

Command Syntax

clear address locking lease [ all | interface [ ethernet slot ] | ipv4 V4ADDR | ipv6 V6ADDR ]

Parameters

all- View the entire lease table.
interface- interface to clear the lease.
- ethernet slot - Ethernet interface slot number.
ipv4 V4ADDR- IPv4 address of the lease
ipv6 V6ADDR - IPv6 address of the lease

Example

Use the following command to clear all IP Address Locking leases from the switch:

switch(config-address-locking)# clear address locking lease all

dhcp server interface

Use the dhcp server interface command to monitor the server interface for DHCP ACK packets and handle release packets on the designated locked interfaces by the IP Locking agent. You must perform this command from an interface configured for IP Address Locking on the switch.

Note: That when both "dhcp server interface <INTF>" and "local-interface <INTF>" are active, IP Locking prioritizes the local interface for transmitting DHCP LeaseQuery packets and disregards the "dhcp server interface <INTF>" setting.

Command Mode

Address Locking Configuration

Command Syntax

dhcp server interface <INTF>

Parameter

<INTF> - Specify the DHCP server interface.

Example

Use the following command to configure the dhcp server interface Ethernet 28/1:

switch#config
switch(config)#address locking
switch(config-address-locking)#dhcp server interface Ethernet28/1

locked-address expiration mac disabled

IP Address Locking, by default, removes authorization from leases after the corresponding MAC addresses age out. Use the locked-address expiration mac disabled command to configure IP Address Locking to keep the leases installed, even after the corresponding MAC addresses age out.

Command Mode

Address Locking Configuration

Command Syntax

locked-address expiration mac disabled

no locked-address expiration mac disabled

default locked-address expiration mac disabled

Parameters

expiration - Configures expiration mode for locked addresses.
mac - Configures deauthorizing locked addresses when MAC addresses age out.
disabled - Disables deauthorizing locked address when MAC addresses age out.

Example

Use this command to disable locked address expiration:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address expiration mac disabled

locked-address ipv4 enforcement disabled

The locked-address ipv4 enforcement disabled command disables address filtering for all ports with IPv4 Locking enabled. This permits IPv4 packets while still keeping all other drop rules.

Command Mode

Address Locking Configuration

Command Syntax

locked-address ipv4 enforcement disabled

no locked-address ipv4 enforcement disabled

default locked-address ipv4 enforcement disabled

Parameters

ipv4 - Configure the IP address family.
enforcement - Configure enforcement for locked addresses.
disabled - Disable enforcement for locked addresses.

Example

Use the following command to disable locking address enforcement for IPv4 addresses:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv4 enforcement disabled

locked-address ipv6 enforcement disabled

The locked-address ipv6 enforcement disabled command disables address filtering for all ports with IPv6 Locking enabled. This permits IPv6 packets while retaining all other drop rules.

Command Mode

Address Locking Configuration

Command Syntax

locked-address IPv6 enforcement disabled

no locked-address IPv6 enforcement disabled

default locked-address IPv6 enforcement disabled

Parameters

ipv6 - IPv6 address configuration.
enforcement - Configure enforcement for locked addresses.
disabled - Disable enforcement for locked addresses.

Example

Use the following command to disable locking address enforcement for IPv6 addresses:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv6 enforcement disabled

show address locking

Use the show address locking command to display the status of IP and IPv6 locking.

The show address locking command also displays the reason as to why IP Locking is not enabled for an interface. For an interface without IP Locking enabled, the following priority (highest at top) apply to the output:

Interface not configured.
Interface is not a Layer 2 interface.
No local interface configured.
No DHCP server configured.

Command Mode

EXEC

Command Syntax

show address locking

Example

To display information about IP locking, use the show address locking command:

switch# show address locking
         
IP Locking is active
Interface        IPv4	                 IPv6
--------------- -------------------   ---------------------------
Ethernet27/1     yes 	                 no (not configured) 
Ethernet31/1     no (not configured)    no (not a layer 2 interface)

show address locking counters

The show address locking counters command displays DHCP lease query messages sent, received, and dropped. Two sets of counters display in the output:

Number of packets sent and received from each DHCP server.
Number of packets sent and received for each locked interface.

IP Locking uses separate counters for different kinds of messages communicated between the switch and the DHCP server.

Command Mode

EXEC

Command Syntax

show address locking counters

Related Commands

The clear address locking counters command resets all the counters associated with IP Locking to zero.

Example

The following command displays IP Address Locking Counters:

switch# show address locking counters
Lease Active Lease Unknown Lease Unassigned    	 
DHCP Server Query  Rcvd   Drop   Rcvd   Drop Rcvd     Drop    Unknown
----------- ----- ----- ------ ------ ------ -------- ------- -------
80.80.80.80 32860  8002 34     8001   32     13423     134    3234
            
            
Interface Query Lease Active Lease Unknown Lease Unassigned
--------- ----- ------------ ------------- ----------------
Ethernet2  1747 1234         189           324

Add the detail parameter to display additional details about counters:

switch# show address locking counters detail
Action				                    Count
--------------------------------            --------
DHCP from client to server PERMIT                  0
DHCP from server DROP                              0
ARP (0.0.0.0) PERMIT                               3
DHCP6 to client DROP                               2                 
DHCP6 to server PERMIT                             2  
NDP Router Solicitation PERMIT                     1
NDP Router Advertisement DROP                      1
NDP Router Redirect DROP                           0
DHCP from server on VLAN DROP                      2                 
DHCP from client to server on VLAN PERMIT          2
ARP (0.0.0.0) on VLAN PERMIT                       1     
DHCP6 to client on VLAN DROP                       2                 
DHCP6 to server on VLAN PERMIT                     2     
NDP Router Solicitation on VLAN PERMIT             2    
NDP Router Advertisement on VLAN DROP              1    
NDP Router Redirect on VLAN DROP                   2

Interface    Action                   IP       MAC               Count
-----------  -----------------------  -------  ----------------  -----
Ethernet46   unknown ARP on VLAN DROP any      any                   5
Ethernet46   unknown IP on VLAN DROP  any      any                   5
Ethernet46   unknown ARP DROP         any      any                   0
Ethernet46   unknown IP DROP          any      any                   0
Ethernet49/1 ARP DROP                 10.0.0.1 any                   0
Ethernet49/1 IP DROP                  10.0.0.1 any                   5
Ethernet49/1 ARP PERMIT               10.0.0.2 c4:01:32:58:00:00     0
Ethernet49/1 IP PERMIT                10.0.0.2 c4:01:32:58:00:00     0

Add the ipv4 or ipv6 parameter to display only information for IPv4 or IPv6 counters:

switch# show address locking counters detail ipv4
Action				                    Count
--------------------------------            --------
DHCP from client to server PERMIT                  0
DHCP from server DROP                              0
ARP (0.0.0.0) PERMIT                               3
DHCP from server on VLAN DROP                      2                 
DHCP from client to server on VLAN PERMIT          2
ARP (0.0.0.0) on VLAN PERMIT                       1

Interface    Action                   IP       MAC               Count
------------ ------------------------ -------- ----------------- -----
Ethernet46   unknown ARP on VLAN DROP any      any                   5
Ethernet46   unknown IP on VLAN DROP  any      any                   5
Ethernet46   unknown ARP DROP         any      any                   0
Ethernet46   unknown IP DROP          any      any                   0
Ethernet49/1 ARP DROP                 10.0.0.1 any                   0
Ethernet49/1 IP DROP                  10.0.0.1 any                   5
Ethernet49/1 ARP PERMIT               10.0.0.2 c4:01:32:58:00:00     0
Ethernet49/1 IP PERMIT                10.0.0.2 c4:01:32:58:00:00     0

switch# show address locking counters detail ipv6
Action				                    Count
--------------------------------            --------
DHCP6 to client DROP                               2                 
DHCP6 to server PERMIT                             2  
NDP Router Solicitation PERMIT                     1
NDP Router Advertisement DROP                      1
NDP Router Redirect DROP                           0
DHCP6 to client on VLAN DROP                       2                 
DHCP6 to server on VLAN PERMIT                     2     
NDP Router Solicitation on VLAN PERMIT             2    
NDP Router Advertisement on VLAN DROP              1    
NDP Router Redirect on VLAN DROP                   2

Add the interface parameter to display counters for a specific interface, Et49/1:

switch# show address locking counters detail ipv4 interface Et49/1
Interface    Action                   IP       MAC               Count
------------ ------------------------ -------- ----------------- -----
Ethernet49/1 ARP DROP                 10.0.0.1 any                   0
Ethernet49/1 IP DROP                  10.0.0.1 any                   5
Ethernet49/1 ARP PERMIT               10.0.0.2 c4:01:32:58:00:00     0
Ethernet49/1 IP PERMIT                10.0.0.2 c4:01:32:58:00:00     0

show address locking table ipv4

Use the show address locking table ipv4 command to display all DHCP leases with IP Locking, and the interfaces with authorized the IP addresses.

Command Mode

EXEC

Command Syntax

Parameters

dynamic - Display the dynamic leases.
- installed-Display the leases installed on the hardware.
- interface - Display the leases on a specified interface.
installed - Display installed leases.
interface - Display the leases on a specified interface.
- Ethernet slot Specified Ethernet sub-interface.
static - Display static leases.
- installed - Display the leases on the hardware.
- interface - Display the leases on a specified interface.
  - Ethernetslot Specified Ethernet sub-interface.

Example

switch# show address locking table ipv4
IP Address     MAC Address      Interface  Installed    Expiration Time
-------------- ---------------- ---------- ------------ --------------- 
AC 10.30.4.4   ba76.a467.7ff8   Et27/1     installed     in 0:01:57 

  IP Address       Action
---------------   --------
10.30.4.4         permit

Layer 2 Protocol Forwarding

EOS supports Layer2 (L2) Protocol Forwarding on Ethernet interfaces in addition to Type-5 PW. Also, EOS allows selective forwarding of certain L2 Protocol packets, such as tagged, untagged, and all, instead of forwarding all LACP frames, both tagged and untagged. The protocol list for L2 Protocol Forwarding also supports PAUSE, LACP, LLDP, MACsec, and STP. Additionally, L2PF supports the Per-VLAN Spanning Tree (PVST) protocol to forward, drop, or trap PVST packets on Type-2 platforms. EOS enables drop support for all supported protocols.

Configuring L2 Protocol Forwarding

Use the following commands to create a profile that allows forwarding tagged/untagged/all types of PAUSE/LACP/LLDP/MACSEC/STP/E-LMI/ ISIS/micro-BFD frames.

switch(config-l2-protocol)# forwarding profile abc
switch(config-l2-protocol-abc)# isis forward
switch(config-l2-protocol-abc)# macsec tagged forward
switch(config-l2-protocol-abc)# pause untagged forward
switch(config-l2-protocol-abc)# exit

The following commands apply the profile to an interface or subinterface:

switch(config)# int ethernet1/1
switch(config-if-Et1/1)# l2-protocol forwarding profile abc
switch(config-if-Et1/1)# exit
switch(config)# int ethernet2/1.1
switch(config-if-Et2/1.1)# l2-protocol forwarding profile def
switch(config-if-Et2/1.1)# exit

TCAM Profile

A specific TCAM profile is required to configure L2 Protocol Forwarding profiles except if the L2 Protocol Forwarding profile has only ‘lacp forward’ and is configured on Type-5 PW ports on Type-1 platforms. One such TCAM profile is as follows:

switch(config)# hardware tcam
switch(config-tcam)# profile l2protocolfwd
switch(config-tcam-profile-12protocolfwd)# feature acl port ip
switch(config-tcam-feature-acl-port-ip)# sequence 45
switch(config-tcam-feature-acl-port-ip)# key size limit 160
switch(config-tcam-feature-acl-port-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control ttl
switch(config-tcam-feature-acl-port-ip)# action count drop
switch(config-tcam-feature-acl-port-ip)# packet ipv4 forwarding bridged
switch(config-tcam-feature-acl-port-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-port-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-acl-port-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-port-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-port-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-port-ip)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-acl-port-ip)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-acl-port-ip)# feature acl port ipv6
switch(config-tcam-feature-acl-port-ipv6)# sequence 25
switch(config-tcam-feature-acl-port-ipv6)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-ops-3b l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-port-ipv6)# action count drop
switch(config-tcam-feature-acl-port-ipv6)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-port-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-port-ipv6)# packet ipv6 forwarding routed multicast
switch(config-tcam-feature-acl-port-ipv6)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-ipv6)# feature acl port mac
switch(config-tcam-feature-acl-port-mac)# sequence 55
switch(config-tcam-feature-acl-port-mac)# key size limit 160
switch(config-tcam-feature-acl-port-mac)# key field dst-mac ether-type src-mac
switch(config-tcam-feature-acl-port-mac)# action count drop
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-acl-port-mac)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed multicast
switch(config-tcam-feature-acl-port-mac)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet mpls forwarding bridged decap
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet non-ip forwarding bridged
switch(config-tcam-feature-acl-port-mac)# feature acl subintf ip
switch(config-tcam-feature-acl-subintf-ip)# sequence 40
switch(config-tcam-feature-acl-subintf-ip)# key size limit 160
switch(config-tcam-feature-acl-subintf-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control ttl
switch(config-tcam-feature-acl-subintf-ip)# action count drop
switch(config-tcam-feature-acl-subintf-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-subintf-ip)# feature acl subintf ipv6
switch(config-tcam-feature-acl-subintf-ipv6)# sequence 15
switch(config-tcam-feature-acl-subintf-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-subintf-ipv6)# action count drop
switch(config-tcam-feature-acl-subintf-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-subintf-ipv6)# feature acl vlan ip
switch(config-tcam-feature-acl-vlan-ip)# sequence 35
switch(config-tcam-feature-acl-vlan-ip)# key size limit 160
switch(config-tcam-feature-acl-vlan-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control ttl
switch(config-tcam-feature-acl-vlan-ip)# action count drop
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-acl-vlan-ip)# feature acl vlan ipv6
switch(config-tcam-feature-acl-vlan-ipv6)# sequence 10
switch(config-tcam-feature-acl-vlan-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-vlan-ipv6)# action count drop
switch(config-tcam-feature-acl-vlan-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-vlan-ipv6)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-vlan-ipv6)# feature acl vlan ipv6 egress
switch(config-tcam-feature-acl-vlan-ipv6-egress)# sequence 20
switch(config-tcam-feature-acl-vlan-ipv6-egress)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-vlan-ipv6-egress)# action count drop
switch(config-tcam-feature-acl-vlan-ipv6-egress)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-vlan-ipv6-egress)# feature counter lfib
switch(config-tcam-feature-counter-lfib)# sequence 85
switch(config-tcam-feature-counter-lfib)# feature l2-protocol forwarding
switch(config-tcam-feature-l2-protocol-fowarding)# sequence 95
switch(config-tcam-feature-l2-protocol-fowarding)# key size limit 160
switch(config-tcam-feature-l2-protocol-fowarding)# key field dst-mac vlan-tag-format
switch(config-tcam-feature-l2-protocol-fowarding)# action mirror redirect-to-cpu set-tc
switch(config-tcam-feature-l2-protocol-fowarding)# packet non-ip forwarding bridge
switch(config-tcam-feature-l2-protocol-fowarding)# packet non-ip forwarding bridged sub-interface
switch(config-tcam-feature-l2-protocol-fowarding)# feature mirror ip
switch(config-tcam-feature-mirror-ip)# sequence 80
switch(config-tcam-feature-mirror-ip)# key size limit 160
switch(config-tcam-feature-mirror-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control
switch(config-tcam-feature-mirror-ip)# action count mirror set-policer
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding bridged
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-mirror-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-mirror-ip)# feature mpls
switch(config-tcam-feature-mpls)# sequence 5
switch(config-tcam-feature-mpls)# key size limit 160
switch(config-tcam-feature-mpls)# action drop redirect set-ecn
switch(config-tcam-feature-mpls)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-mpls)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-mpls)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-mpls)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-mpls)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-mpls)# feature mpls pop ingress
switch(config-tcam-feature-mpls-pop-ingress)# sequence 90
switch(config-tcam-feature-mpls-pop-ingress)# feature pbr ip
switch(config-tcam-feature-pbr-ip)# sequence 60
switch(config-tcam-feature-pbr-ip)# key size limit 160
switch(config-tcam-feature-pbr-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control
switch(config-tcam-feature-pbr-ip)# action count redirect
switch(config-tcam-feature-pbr-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-pbr-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-pbr-ip)# feature pbr ipv6
switch(config-tcam-feature-pbr-ipv6)# sequence 30
switch(config-tcam-feature-pbr-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-pbr-ipv6)# action count redirect
switch(config-tcam-feature-pbr-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-pbr-ipv6)# feature pbr mpls
switch(config-tcam-feature-pbr-mpls)# sequence 65
switch(config-tcam-feature-pbr-mpls)# key size limit 160
switch(config-tcam-feature-pbr-mpls)# key field mpls-inner-ip-tos
switch(config-tcam-feature-pbr-mpls)# action count drop redirect
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-pbr-mpls)# feature qos ip
switch(config-tcam-feature-qos-ip)# sequence 75
switch(config-tcam-feature-qos-ip)# key size limit 160
switch(config-tcam-feature-qos-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control
switch(config-tcam-feature-qos-ip)# action set-dscp set-policer set-tc
switch(config-tcam-feature-qos-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-qos-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-qos-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-qos-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-qos-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-qos-ip)# feature qos ipv6
switch(config-tcam-feature-qos-ipv6)# sequence 70
switch(config-tcam-feature-qos-ipv6)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low
switch(config-tcam-feature-qos-ipv6)# action set-dscp set-policer set-tc
switch(config-tcam-feature-qos-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-qos-ipv6)# feature tunnel VXLAN
switch(config-tcam-feature-tunnel-VXLAN)# sequence 50
switch(config-tcam-feature-tunnel-VXLAN)# key size limit 160
switch(config-tcam-feature-tunnel-VXLAN)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-tunnel-VXLAN)# packet ipv4 VXLAN forwarding bridged decap

For ISIS protocol forwarding, “snoop” action has to be present in the TCAM profile for l2-protocol forwarding feature as follows:

switch(config-tcam)# feature l2-protocol forwarding
switch(config-tcam-l2-protocol forwarding)# sequence 95
switch(config-tcam-l2-protocol forwarding)# key size limit 160
switch(config-tcam-l2-protocol forwarding)# key field dst-mac vlan-tag-format
switch(config-tcam-l2-protocol forwarding)# action mirror redirect-to-cpu set-tc snoop
switch(config-tcam-l2-protocol forwarding)# packet non-ip forwarding bridged
switch(config-tcam-l2-protocol forwarding)# packet non-ip forwarding bridged sub-interface

For the special case of micro-BFD protocol forwarding, the following TCAM profile needs to be applied:

switch(config)# hardware tcam
switch(config-tcam)# profile l2protocolfwd-bfd-rfc-7130
switch(config-tcam-profile l2protocolfwd-bfd-rfc-7130)# feature acl port ip egress mpls-tunnelled-match
switch(config-tcam-feature-acl-port-ip-egress-mpls-tunnelled-match)# sequence 95
switch(config-tcam-feature-acl-port-ip-egress-mpls-tunnelled-match)# feature acl port ipv6 egress
switch(config-tcam-feature-acl-port-ipv6-egress)# sequence 105
switch(config-tcam-feature-acl-port-ipv6-egress)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-port-ipv6-egress)# action count drop mirror
switch(config-tcam-feature-acl-port-ipv6-egress)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-port-ipv6-egress)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-port-ipv6-egress)# feature acl port mac
switch(config-tcam-feature-acl-port-mac)# sequence 55
switch(config-tcam-feature-acl-port-mac)# key size limit 160
switch(config-tcam-feature-acl-port-mac)# key field dst-mac ether-type src-mac
switch(config-tcam-feature-acl-port-mac)# action count drop mirror
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-acl-port-mac)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed multicast
switch(config-tcam-feature-acl-port-mac)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet mpls forwarding bridged decap
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet non-ip forwarding bridged
switch(config-tcam-feature-acl-port-mac)# feature acl subintf ip
switch(config-tcam-feature-acl-subintf-ip)# sequence 40
switch(config-tcam-feature-acl-subintf-ip)# key size limit 160
switch(config-tcam-feature-acl-subintf-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control ttl
switch(config-tcam-feature-acl-subintf-ip)# action count drop
switch(config-tcam-feature-acl-subintf-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-subintf-ip)# feature acl subintf ipv6
switch(config-tcam-feature-acl-subintf-ipv6)# sequence 15
switch(config-tcam-feature-acl-subintf-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-subintf-ipv6)# action count drop
switch(config-tcam-feature-acl-subintf-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-subintf-ipv6)# feature acl vlan ip
switch(config-tcam-feature-acl-vlan-ip)# sequence 35
switch(config-tcam-feature-acl-vlan-ip)# key size limit 160
switch(config-tcam-feature-acl-vlan-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control ttl
switch(config-tcam-feature-acl-vlan-ip)# action count drop
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-acl-vlan-ip)# feature acl vlan ipv6
switch(config-tcam-feature-acl-vlan-ipv6)# sequence 10
switch(config-tcam-feature-acl-vlan-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-vlan-ipv6)# action count drop
switch(config-tcam-feature-acl-vlan-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-vlan-ipv6)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-vlan-ipv6)# feature acl vlan ipv6 egress
switch(config-tcam-feature-acl-vlan-ipv6-egress)# sequence 20
switch(config-tcam-feature-acl-vlan-ipv6-egress)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-vlan-ipv6-egress)# action count drop mirror
switch(config-tcam-feature-acl-vlan-ipv6-egress)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-vlan-ipv6-egress)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-vlan-ipv6-egress)# feature counter lfib
switch(config-tcam-feature-counter-lfib)# sequence 85
switch(config-tcam-feature-counter-lfib)# feature forwarding-destination mpls
switch(config-tcam-feature-forwarding-destination-mpls)# sequence 100
switch(config-tcam-feature-forwarding-destination-mpls)# feature l2-protocol forwarding
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# sequence 95
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# key size limit 160
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# key field dst-mac vlan-tag-format
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# action mirror redirect-to-cpu set-tc
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# packet ipv4 forwarding bridged
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# packet ipv6 forwarding bridged
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# packet non-ip forwarding bridged
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# feature mirror ip
switch(config-tcam-feature-mirror-ip)# sequence 80
switch(config-tcam-feature-mirror-ip)# key size limit 160
switch(config-tcam-feature-mirror-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control
switch(config-tcam-feature-mirror-ip)# action count mirror set-policer
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding bridged
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-mirror-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-mirror-ip)# feature mpls
switch(config-tcam-feature-mpls)# sequence 5
switch(config-tcam-feature-mpls)# key size limit 160
switch(config-tcam-feature-mpls)# action drop redirect set-ecn
switch(config-tcam-feature-mpls)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-mpls)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-mpls)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-mpls)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-mpls)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-mpls)# feature mpls pop ingress
switch(config-tcam-feature-mpls-pop-ingress)# sequence 90
switch(config-tcam-feature-mpls-pop-ingress)# feature pbr ip
switch(config-tcam-feature-pbr-ip)# sequence 60
switch(config-tcam-feature-pbr-ip)# key size limit 160
switch(config-tcam-feature-pbr-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control
switch(config-tcam-feature-pbr-ip)# action count redirect
switch(config-tcam-feature-pbr-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-pbr-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-pbr-ip)# feature pbr ipv6
switch(config-tcam-feature-pbr-ipv6)# sequence 30
switch(config-tcam-feature-pbr-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-pbr-ipv6)# action count redirect
switch(config-tcam-feature-pbr-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-pbr-ipv6)# feature pbr mpls
switch(config-tcam-feature-pbr-mpls)# sequence 65
switch(config-tcam-feature-pbr-mpls)# key size limit 160
switch(config-tcam-feature-pbr-mpls)# key field mpls-inner-ip-tos
switch(config-tcam-feature-pbr-mpls)# action count drop redirect
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-pbr-mpls)# feature qos ip
switch(config-tcam-feature-qos-ip)# sequence 75
switch(config-tcam-feature-qos-ip)# key size limit 160
switch(config-tcam-feature-qos-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control
switch(config-tcam-feature-qos-ip)# action set-dscp set-policer set-tc
switch(config-tcam-feature-qos-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-qos-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-qos-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-qos-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-qos-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-qos-ip)# feature qos ipv6
switch(config-tcam-feature-qos-ipv6)# sequence 70
switch(config-tcam-feature-qos-ipv6)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low
switch(config-tcam-feature-qos-ipv6)# action set-dscp set-policer set-tc
switch(config-tcam-feature-qos-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-qos-ipv6)# feature tunnel VXLAN
switch(config-tcam-feature-tunnel-VXLAN)# sequence 50
switch(config-tcam-feature-tunnel-VXLAN)# key size limit 160
switch(config-tcam-feature-tunnel-VXLAN)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-tunnel-VXLAN)# packet ipv4 VXLAN forwarding bridged decap

Once l2protocolfwd or l2protocolfwd-bfd-rfc-7130 tcam profile is created, the profile needs to be applied to the switch using the following command under config mode:

switch(config)# hardware tcam
switch(config-tcam)# system profile l2protocolfwd

Consumption of TCAM

The following table describes how TCAM is consumed when the same L2 Protocol Forwarding profile is applied:


Level of application	Type-1 platforms	Type-2 platforms
Front panel ports	Separate TCAM entries for each port	Same set of TCAM entries for ports on the same fap and core
Subinterfaces	Same set of TCAM entries for subinterfaces on the same fap	Same set of TCAM entries for subinterfaces on the same fap and core

L2 Protocol Forwarding Considerations

A maximum of 31 distinct L2 Protocol Forwarding profiles apply across multiple subinterfaces on the same FAP.
A maximum of 31 distinct L2 Protocol Forwarding profiles apply across multiple subinterfaces, and front panel ports on the same FAP on Type-2 platforms.
EOS does not support subinterfaces on Type-1 platforms if the TCAM profile has any of the following features:
- feature pbr subintf ip
- feature pbr subintf ipv6
- feature pbr subintf mpls

Displaying L2 Protocol Forwarding

The show l2-protocol forwarding interface command displays the L2 protocol forwarding profile configuration corresponding to the interface or subinterface.

switch(config)# show l2-protocol forwarding interface

Interface     Profile
------------- -------
Ethernet1/1   abc
Ethernet2/1.1 def
 

switch> show l2-protocol forwarding interface Ethernet1/1


Interface   Profile   
----------- --------
Ethernet1/1 abc

The following show commands display all packet forwarding behavior on an interface or a subinterface:

switch(config)# show l2-protocol forwarding interface detail                                                                                                                                                                                      
Tagging Types: T: tagged U: untagged
Actions: F: forward
                      BFD RFC-7130 E-LMI ISIS LACP LLDP MACSEC PAUSE STP
Interface     Profile   T     U    T  U  T U  T U  T U  T   U  T  U  T U
------------- ------- ----- ------ -- -- - -- - -- - -- -- --- -- -- - -                                                                                                                                             
Ethernet1/1   abc       -     -    -  -  F  F - -  - -  F   -  -  F  - -
Ethernet2/2.1 def       -     -    -  -  - -  - -  - -  -   -  -  -  - -

switch> show l2-protocol forwarding interface Ethernet1/1 detail
Tagging Types: T: tagged U: untagged                                                                                                                                                                        
Actions: F: forward                                                                                                                                                                                         
                      BFD RFC-7130 E-LMI ISIS LACP LLDP MACSEC PAUSE STP
Interface     Profile   T     U    T  U  T U  T U  T U  T   U  T  U  T U
------------- ------- ----- ------ -- -- - -- - -- - -- -- --- -- -- - -                                                                                                                                                             
Ethernet1/1   abc       -     -    -  -  F F  - -  - -  F   -  -  F  - -

switch> show l2-protocol forwarding interface Ethernet2/2.1 detail
Tagging Types: T: tagged U: untagged                                                                                                                                                                        
Actions: F: forward                                                                                                                                                                                         
                      BFD RFC-7130 E-LMI ISIS LACP LLDP MACSEC PAUSE STP
Interface     Profile   T     U    T  U  T U  T U  T U  T   U  T  U  T U
------------- ------- ----- ------ -- -- - -- - -- - -- -- --- -- -- - -                                                                                                                                                             
Ethernet2/2.1 def       -     -    -  -  - -  - -  - -  -   -  -  -  - -

Page 8 of 17

End of Support

EOS 4.36.1F User Manual - Support for Layer 3 MTU on 7280R3/7500R3/7800R3

Support for Layer 3 MTU on 7280R3/7500R3/7800R3

Layer 3 MTU Configuration

Layer 3 MTU Show Commands

L3 MTU Considerations

EOS 4.36.1F User Manual - VRRP and VARP

VRRP and VARP

VRRP and VARP Conceptual Overview

VRRPv2

VRRPv3

VARP

VRRP and VARP Implementation Procedures

VRRP Configuration for IPv4

Virtual Router Configuration

VRRP Version

Master and Backup Router

Advertisement Interval

Description

Peer Authentication

Secondary Addresses

Virtual Router Enabling and the Primary IP address

Disabling VRRP

VRRP Configuration for IPv6

Configuring VRRP for IPv6

Specify the VRRP Version

Create a VRRP Group and Configure a Virtual IPv6 Address

Configure Tracking

Configure the Priority Level

Configure the Preemption Mode

Configure the VRRP Advertisement Interval

Verify VRRP IPv6 Configurations

Show VRRP Group

VARP Configuration

Virtual IP Addresses

Virtual MAC Address

Show Virtual MAC Address

Show IPv6 Virtual-Router

VRRP and VARP Implementation Examples

VRRP Examples

VRRP Example 1: One Virtual Router on One LAN

Switch Code that Implements Router A on the First Switch

Switch Code that Implements Router B on the Second Switch

VRRP Example 2: Two Virtual Routers on One LAN

Switch Code that Implements Router A on the First Switch

Switch Code that Implements Router B on the Second Switch

VRRP Example 3: Two Virtual Routers on Two LANs

Switch Code that Implements Router A on the First Switch

Switch Code that Implements Router B on the Second Switch

Switch Code that Implements Router C on the Third Switch

VARP Example

Switch Code that Implements VARP on the First Switch

Switch Code that Implements VARP on the Second Switch

VRRP and VARP Configuration Commands

Global Configuration Commands

Interface Configuration CommandsEthernet, Port Channel, and VLAN Interfaces

Privileged EXEC Commands

ip fhrp accept-mode

ip virtual-router address

ip virtual-router mac-address

ip virtual-router mac-address advertisement-interval

ipv6 virtual-router address

no vrrp

show ip virtual-router

show ipv6 virtual-router

show vrrp

vrrp advertisement interval

vrrp disabled

vrrp ipv4

vrrp ipv4 checksum pseudo-header exclude

vrrp ipv4 secondary

vrrp ipv4 version

vrrp ipv6

vrrp mac-address advertisement-interval

vrrp peer authentication

vrrp preempt

vrrp preempt delay

vrrp priority-level

vrrp session description

vrrp timers delay reload