7280R3/7500R3/7800R3 switches support Layer 3 Maximum Transmission Unit (MTU) with the
following features:
These switches enforce the MTU for Layer 3 packets. You can set the MTU on any
SVI. The switch enforces the MTU of that specific SVI when packets egress out of
a trunk port. 7280E/R/R2 and 7500E/R/R2 line cards do not support this
behavior.
The switch enforces the MTU after adding all encapsulation headers to the egress
packet. For example, if you configure an interface with an MTU value of
1500 and the packet size exceeds 1500 after
the switch adds all encapsulation headers, the switch considers the packet to
have violated the MTU. The 7280E/R/R2 and 7500E/R/R2 line cards enforce the MTU
before adding encapsulation headers.
The system configures the actual MTU in hardware as the MTU configured in the
CLI plus 18 bytes. It adds 18 bytes to accommodate the L2 header. If the
outgoing packet is untagged, the system configures the actual MTU in hardware as
the MTU configured in the CLI plus four (4) bytes.
Layer 3 MTU Configuration
You configure Layer 3 MTU on Layer 3 interfaces and SVIs using the mtu command within
interface configuration mode.
This command sets the MTU size of 1492 bytes on
interface ethernet
1/1.
(config)# interface ethernet 1/1
(config-if-Et1/1)# mtu 1492
MTU is independently configurable on all routable interfaces. The switch supports MTU
sizes ranging from 68 to 9214 bytes.
The default MTU size is 1500 bytes.
The no mtu and default mtu commands
restore the interface MTU to the default value by removing the corresponding
mtu command from running-config.
Note: On platforms without per interface Layer 3 MTU enforcement,
EOS disables the mtu command and it does not appear in the
Interface Configuration Mode.
Layer 3 MTU Show Commands
The show
interfaces command displays the MTU configured on the
L3 interface (ethernet 1/1), as shown in the following
example. The IP MTU represents the interface's Layer
3 MTU value.
Example
switch(config-if-Et9/1)# show interfaces ethernet 1/1
...
IP MTU 1600 bytes , BW 100000000 kbit
Full-duplex, 100Gb/s over 4 lanes, auto negotiation: off, uni-link: n/a
...
L3 MTU Considerations
The following considerations apply to support of Layer 3 MTU:
A switch supports only three (3) unique MTU values. If you configure more than
three (3) unique MTU values, the switch will not enforce additional unique MTU
definitions on an interface.
When the number of unique MTU values becomes less than three (3) (after
unconfiguring MTU on some interfaces), MTU on previously unprogrammed
interfaces is not reprogrammed automatically. CLI commands
no mtu followed by
mtu must be called to program MTU on
an interface.
When the startup configuration has more than three (3) unique MTU values defined
on different switch interfaces, it is not guaranteed which unique MTU values
will be active when the switch is rebooted.
Jericho2-based platforms do not enforce L3 MTU on Multicast packets.
EOS supports Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) for routing packets across network boundaries. This section describes Arista’s implementation of IPv6 and includes the following topics:
Routing transmits network layer data packets over connected independent subnets. Each subnet is assigned an IP address range and each device on the subnet is assigned an IP address from that range.
Connected subnets have IP address ranges that do not overlap. A router is a network device connecting multiple subnets. Routers forward inbound packets to the subnet whose address range includes the packets’ destination address.
IPv4 and IPv6 are Internet layer protocols that define packet-switched inter-networking, including source-to-destination datagram transmission across multiple networks. The switch supports IP version 4 (IPv4) and IP version 6 (IPv6).
IPv6 is described by RFC 2460: Internet Protocol, Version 6 (IPv6) Specification. RFC 2463 describes ICMPv6 for IPv6. ICMPv6 is a core protocol of the Internet Protocol suite.
IPv6 Description
Internet Protocol version 6 (IPv6) consists ofa communications protocol used for relaying network packets across a set of connected networks using the Internet Protocol suite. EOS assigns a 128 bit IP address that identifies its network location to each network device.
IPv6 specifies a packet format that minimizes router processing of packet headers. Since the IPv4 and IPv6 packet headers differ significantly, the protocols cannot interoperate. Many transport and application-layer protocols require little or no change to operate over IPv6.
IPv6 addresses typically denote a 64-bit network prefix and a 64-bit host address.
Unicast and Anycast Addressing
Unicast addressing defines a one-to-one association between the destination address and a network endpoint. Each destination address uniquely identifies a single receiver endpoint. Anycast addressing defines a one-to-one-of-many association, for example, packets to a single member of a group of potential receivers identified by the same destination address.
Compose unicast and anycast addresses as follows:
A 64-bit network prefix that identifies the network segment.
A 64-bit interface identifier based on interface MAC address.
The format of a network address identifies the scope of the address:
Global address - Valid in all networks and connect with other addresses with global scope anywhere or to addresses with link-local scope on the directly attached network.
Link-local address - Scope extends only to the link to which the interface is directly connected. Link-local addresses do not route from the link.
The switch creates the link-local addresses and you cannot configure it. The following figure depicts the switch’s link local address derivation method.
Figure 1. Link Local Address Derivation
Multicast Addressing
Multicast addressing defines a one-to-many association. Packets simultaneously route from a single sender to multiple endpoints in a single transmission. The network replicates packets as required by network links that contain a recipient endpoint. EOS assigns one multicast address to an interface for each multicast group of an interface.
A solicited-node multicast address consists of an IPv6 multicast address whose scope extends only to the link to the directly connected interface. All IPv6 hosts have at least one address per interface. Neighbor Discovery Protocol uses solicited-node multicast addresses to obtain Layer 2 link-layer addresses of other nodes.
IPv6 DHCP Snooping
Dynamic Host Configuration Protocol (DHCP) snooping is a Layer 2 feature that is configured on LAN switches. The Arista EOS switch supports Option-37 insertion that allows relay agents to provide remote-id information in DHCP request packets. DHCP servers use this information to determine the originating port of DHCP requests and associate a corresponding IP address to that port. DHCP servers use port information to track host location and IP address usage by authorized physical ports.
DHCP snooping uses the information option (Option-37) to include the switch MAC address (router-id) along with the physical interface name and VLAN number (remote-id) in DHCP packets. After adding the information to the packet, the DHCP relay agent forwards the packet to the DHCP server as specified by the DHCP protocol.
Neighbor Discovery Protocol
The Neighbor Discovery Protocol (RFC 4861) operates with IPv6 to facilitate the following tasks for nodes within a specified prefix space:
Auto-configuring a node IPv6 address.
Sensing other nodes on the link.
Discovering the link-local addresses of other nodes on the link.
Detecting duplicate IPv6 addresses.
Discovering available routers.
Discovering DNS servers
Discovering the link address prefix.
Maintaining path reachability data to other active neighbor nodes.
The Neighbor Discovery Protocol protocol defines five different ICMPv6 packet types:
Router Solicitation
Router Advertisement
Neighbor Solicitation
Neighbor Advertisement
Redirect
IPv6 Duplicate Address Detection Proxy
Overview
IPv6 Duplicate Address Detection Proxy ensures that all IPv6 addresses assigned on a network segment are unique. After a host verifies the uniqueness of the IPv6 address, it enables DAD on the network.
However, if two network segments cannot communicate with each other, IPv6 DAD cannot perform and duplicate addresses may be assigned to the same interface. To prevent this, a proxy for IPv6 hosts must be assigned on the network and it responds on behalf of the address owner when the address already exists.
Configure IPv6 to route unicast packets, perform static routing, and Equal Cost Multi-path routing on a switch. This section covers the following topics:
The ipv6 unicast-routing command enables the forwarding of IPv6 unicast packets. When routing is enabled, the switch attempts to deliver inbound packets to destination addresses by forwarding them to interfaces or next hop addresses specified by the IPv6 routing table.
The ipv6 route command creates an IPv6 static route to a destination with an IPv6 prefix, and the source uses an IPv6 address or a routable interface port. When multiple routes exist to a destination prefix, the route with the lowest administrative distance takes precedence.
y default, EOS assigns an administrative distance of1 to static routes.
Assigning a higher administrative distance to a static route allows dynamic routing data to override the static route. For example, an OSPF intra-area route, with a default distance of 110, overrides a static route with a distance value of 200.
Example
Use the following command to create an IPv6 static route.
The default route denotes the packet forwarding rule that takes effect if no other route exists for a specified IPv6 address. EOS sends all packets without destinations in the routing table to the destination specified by the default route.
The IPv6 default route source uses ::/0 as an IP address. EOS refers to the default route destination as the default gateway.
Example
Use the following command to create a default route and establish fd7a:629f:52a4:fe61::2 as the default gateway address.
Configuring Link-Local Next Hop Autodiscovery for IPv6 Static Routes
IPv6 static routes support link-local next hop addresses on point-to-point interfaces, but in deployments that rely on Zero Touch Provisioning (ZTP) to activate switches with static routes, specifying link-local addresses in configuration templates becomes challenging. Link-Local addresses vary per switch and interface and does not allow the use of a single template across multiple deployments.
EOS supports automatic discovery of link-local next-hop using the IPv6 Router Advertisements to discover the neighbor link-local address and use it as the next-hop for the static routes. Configuring this feature enables simpler and more scalable ZTP deployment and eliminates the need to specify link-local addresses in configuration templates.
Use the following command to enable automatic link-local next-hop discovery on a specified point-to-point interface, Ethernet 1:
switch(config)# ipv6 route 2001:db8:100::/6 next-hop auto p2p Ethernet1
switch(config)#
IPv6 ECMP
Multiple routes configured to the same destination with the same administrative distance comprise an Equal Cost Multi-Path (ECMP) route. The switch spreads outbound traffic across all ECMP route paths equally and assigns the same tag value to each path. Commands that change the tag value of any ECMP path change the tag value of all paths in the ECMP.
This command implements IPv6 resilient ECMP by configuring a hardware ECMP table space of 15 entries for IPv6 address 2001:db8:0::/64. A maximum of five next-hop addresses can be specified for the address. When the table contains five addresses, each appears in the table three times. When the table contains fewer than five addresses, ECMP duplicates each address until 15 table entries exist.
The ipv6 enable command enables IPv6 in the Configuration Mode if it does not have a configured IPv6 address. It also configures the interface with an IPv6 address.
The noipv6 enable command disables IPv6 on an interface not configured with an IPv6 address. This command does not disable interfaces configured with an IPv6 address.
The ipv6 address command enables IPv6 in the Interface Configuration Mode, assigns a global IPv6 address to the interface, and defines the prefix length. Routable interfaces support this command. Multiple global IPv6 addresses can be assigned to an interface. EOS supports Stateless Address Auto Configuration (SLAAC).
Examples
Use the following commands to configure an IPv6 address with subnet mask for vlan 200:
The IPv6 Neighbor Discovery protocol defines a method for nodes to perform the following network maintenance tasks:
Determine Layer 2 addresses for neighbors known to reside on attached links.
Detect changed Layer 2 addresses.
Purge invalid values from the neighbor cache table.
Find neighboring routers to forward packets.
Track neighbor reachability status.
The RFC 2461 defines IPv6 Neighbor Discovery. IPv6 Stateless Address Autoconfiguration is described by RFC 2462.
The following sections describe Neighbor Discovery configuration tasks.
Reachable Time
The ipv6 nd reachable-time command specifies the time period that EOS includes in the reachable time field of Router Advertisements (RAs) sent from the configuration mode interface. The reachable time defines the period that a remote IPv6 node becomes reachable after a reachability confirmation event.
Example
Use these commands to configure the entry of 25000 (25 seconds) in the reachable time field of RAs sent from vlan 200.
The ipv6 nd ra interval command configures the interval between IPv6 RA transmissions from the configuration mode interface.
Example
These commands configure a RA transmission interval of 60 seconds on interface vlan 200, then displays the interface status.
switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra interval 60
switch(config-if-Vl200)# show active
interface Vlan200
ipv6 nd ra interval 60
switch(config-if-Vl200)#
Router Lifetime
The ipv6 nd ra lifetime command specifies the value EOS places in the router lifetime field of IPv6 RAs sent from the IPv6 interface.
If you configure the value as 0, IPv6 peers connected to the specified interface remove the switch from the lists of default routers. Values greater than 0 indicate the time in seconds that peers should keep the router on their default router lists without receiving further RAs from the switch. Unless set to 0, the router lifetime value should be equal to or exceed the interval between unsolicited RAs sent on the interface.
Example
Use the following command to configure the switch to set 2700 as the router lifetime field of RAs transmitted from interface vlan 200.
switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra lifetime 2700
switch(config-if-Vl200)# show active
interface Vlan200
ipv6 nd ra lifetime 2700
switch(config-if-Vl200)#
Router Advertisement Prefix
The ipv6 nd prefix command configures neighbor discovery router advertisement prefix inclusion for RAs sent from the configuration mode interface.
By default, all prefixes configured as IPv6 addresses are advertised in the interface’s RAs. The ipv6 nd prefix command with the no-advertise option prevents advertising of the specified prefix without affecting the advertising of other prefixes specified as IPv6 addresses. When an interface configuration includes at least one ipv6 nd prefix command that enables prefix advertising, RAs advertise only prefixes specified through ipv6 nd prefix commands.
Commands enabling prefix advertising also specify the advertised valid and preferred lifetime periods. Default periods are 2,592,000 (valid) and 604,800 (preferred) seconds.
Example
These commands enable neighbor discovery advertising for IPv6 address 3012:D678::/64, specifying a valid lifetime of 1,296,000 seconds and the default preferred lifetime.
The ipv6 nd ra disabled command suppress IPv6 RA transmissions on the configuration mode interface. By default, only unsolicited RAs that are transmitted periodically are suppressed. The all option configures the switch to suppress all RAs, including those responding to a router solicitation.
Example
This command suppresses all RAs on interface vlan 200.
switch(config)# interface vlan 200
switch(config-vl200)# ipv6 nd ra disabled all
switch(config-vl200)#
Router Advertisement MTU Suppression
The ipv6 nd ra mtu suppress command suppresses the router advertisement MTU option on the IPv6 interface. The MTU option causes an identical MTU value to advertise from all nodes on a link. By default, EOS does not suppress the router advertisement MTU option.
Example
Use the following command to suppress the MTU option on interface vlan 200.
switch(config)# interface vlan 200
switch(config-vl200)# ipv6 nd ra mtu suppress
switch(config-vl200)#
Router Advertisement Flag Configuration
The following commands set the specified configuration flag in IPv6 RAs transmitted from the configuration mode interface:
The ipv6 nd managed-config-flag command sets the managed address configuration flag. This bit instructs hosts to use stateful address autoconfiguration.
The ipv6 nd other-config-flag command sets the other stateful configuration flag. This bit indicates availability of autoconfiguration information, other than addresses. Hosts should use stateful autoconfiguration when available. The setting of this flag has no effect if the managed address configuration flag is set.
These commands configure the switch to set the managed address configuration flag in advertisements sent from interface vlan 200.
The IPv6 Router Preference protocol supports an extension to RA messages for communicating default router preferences and more specific routes from routers to hosts. This provides assistance to hosts when selecting a router. RFC 4191 describes the IPv6 Router Preference Protocol.
The ipv6 nd router-preference command specifies the value that the switch enters in the Default Router Preference (DRP) field of RAs sent from the IPv6 interface. The default field entry value is medium.
Example
Use the following command to configure the switch as a medium preference router on RAs sent from interface vlan 200.
switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd router-preference medium
switch(config-if-Vl200)#
Configuring uRPF
Unicast Reverse Path Forwarding (uRPF) verifies the accessibility of source IP addresses in forwarded packets from the switch. Unicast Reverse Path Forwarding (uRPF) describes uRPF. Enable uRPF for IPv6 packets entering the IPv6 interface using the ipv6 verify command.
uRPF defines two operational modes:
Strict Mode -uRPF verifies that a packet received on the interface has a routing table entry specified for a return packet.
Loose Mode - uRPF validation does not consider the inbound packet ingress interface only that a valid return path exists.
Example
This command enables uRPF Strict Mode on theinterface vlan 100. If the interface has a default route configured, all inbound packets pass the uRPF check as valid.
Configuring IPv6 Duplicate Address Detection Proxy on an Interface
Configure IPv6 DAD on an interface, and add an IPv6 address on the interface. Then enable IPv6 on the interface. You can configure this in conjunction with IPv6 ND Proxy.
Example Configuration
Use the following commands on interface Ethernet 1:
The ipv6 dhcp snooping command enables DHCP snooping globally on the switch. DHCP snooping provides a Layer 2 feature that can be configured on LAN switches. Arista switches support Option-37 insertion that allows relay agents to provide remote-ID information in DHCP request packets.
Note: DHCPv6 VLAN classification and DHCPv4 VLAN classification share same hardware resource.
Examples
The following configuration enables the IPv6 DHCP snooping feature at the global level.
The following commands display the IPv6 DHCP snooping state.
switch(config)# ipv6 dhcp snooping
switch(config)# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
2789-2790
DHCPv6 Snooping is operational on following VLANs:
2789
Insertion of Option-37 is enabled
Displaying IPv6 Network Components
Displaying RIB Route Information
Use the show rib route ipv6 command to view the IPv6 Routing Information Base (RIB) information.
Example
This command displays IPv6 RIB BGP routes.
switch# show rib route ipv6 bgp
VRF name: default, VRF ID: 0xfe, Protocol: bgp
Codes: C - Connected, S - Static, P - Route Input
B - BGP, O - Ospf, O3 - Ospf3, I - Isis
> - Best Route, * - Unresolved Nexthop
L - Part of a recursive route resolution loop
B 2001:10:1::/64 [200/42]
via 2001:10:1::100 [0/1]
via Ethernet1, directly connected
>B 2001:10:100::/64 [200/200]
via 2001:10:1::100 [0/1]
via Ethernet1, directly connected
>B 2001:10:100:1::/64 [200/0]
via 2001:10:1::100 [0/1]
via Ethernet1, directly connected
>B 2001:10:100:2::/64 [200/42]
via 2001:10:1::100 [0/1]
via Ethernet1, directly connected
switch#
Displaying the FIB and Routing Table
The show ipv6 route command displays routing table entries in the Forwarding Information Base (FIB), including static routes, routes to directly connected networks, and dynamically learned routes. Multiple equal cost paths to the same prefix display contiguously as a block, with the destination prefix displayed only on the first line.
Example
This command displays a route table entry for a specific IPv6 route.
switch> show ipv6 route fd7a:3418:52a4:fe18::/64
IPv6 Routing Table - 77 entries
Codes: C - connected, S - static, K - kernel, O - OSPF, B - BGP, R - RIP, A -
Aggregate
O fd7a:3418:52a4:fe18::/64 [10/20]
via f180::21c:73ff:fe00:1319, Vlan3601
via f180::21c:73ff:fe00:1319, Vlan3602
via f180::21c:73ff:fe00:1319, Vlan3608
via f180::21c:73ff:fe0f:6a80, Vlan3610
via f180::21c:73ff:fe00:1319, Vlan3611
switch>
Displaying the Route Age
The show ipv6 route age command displays the IPv6 route age to the specified IPv6 address or prefix.
Example
This command displays the route age for the specified prefix.
switch> show ipv6 route 2001::3:0/11 age
IPv6 Routing Table - 74 entries
Codes: C - connected, S - static, K - kernel, O - OSPF, B - BGP, R - RIP, A -
Aggregate
C 2001::3:0/11 age 00:02:34
switch>
Displaying Host Routes
The show ipv6 route host command displays all host routes in the IPv6 host forwarding table. Host routes are those whose destination prefix is the entire address (prefix = /128). Each displayed host route displays the purpose of the route:
F - Displays static routes from the FIB.
R - Displays routes defined because the IP address is an interface address.
A - Displays routes to any neighboring host with the switch that has an ARP entry.
Example
This command displays all IPv6 host routes in the host forwarding table.
switch# show ipv6 route host
R - receive F - FIB, A - attached
F ::1 to cpu
A fee7:48a2:0c11:1900:400::1 on Vlan102
R fee7:48a2:0c11:1900:400::2 to cpu
F fee7:48a2:0c11:1a00::b via fe80::21c:73ff:fe0b:a80e on Vlan3902
R fee7:48a2:0c11:1a00::17 to cpu
F fee7:48a2:0c11:1a00::20 via fe80::21c:73ff:fe0b:33e on Vlan3913
F fee7:48a2:0c11:1a00::22 via fe80::21c:73ff:fe01:5fe1 on Vlan3908
via fe80::21c:73ff:fe01:5fe1 on Vlan3902
switch#
Displaying Route Summaries
The show ipv6 route summary command displays the current number of routes of the IPv6 routing table in summary format.
Example
This command displays the route source and the corresponding number of routes in the IPv6 routing table.
switch> show ipv6 route summary
Route Source Number Of Routes
------------------ ----------------
connected 2
static 0
ospf 5
bgp 7
isis 0
internal 1
attached 0
aggregate 2
Total Routes 17
switch>
Configuring the Client Link Layer Address for the IPv6 DHCP Relay Agent
Configuring DHCPv6 Relay for Option 37
Clearing IPv6 DHCP Relay Counters
Configuring the IPv6 DHCP Relay Agent (Global)
The ipv6 dhcp relay always-on command enables the switch DHCP IPv6 Relay Agent globally regardless of the DHCP IPv6 Relay Agent status on any interface. EOS enables DHCP IPv6 Relay Agent by default if at least one routable interface has an ipv6 dhcp relay destination statement.
The ipv6 dhcp relay destination command enables the DHCP IPv6 Relay Agent function and specifies the client message destination address on an interface.
Example
This command enables the DHCP IPv6 Relay Agent function and sets the client message destination address to 2001:0db8:0:1::1 on interface ethernet 4.
Configuring the Client Link Layer Address for the IPv6 DHCP Relay Agent
The ipv6 dhcp relay option link-layer address command enables the DHCPv6 relay agent to configure the Client Link Layer Address option to solicit and request messages. In other words, the command enables the Client Link Layer Address option (79) in the Global Configuration Mode. The noipv6 dhcp relay option link-layer address command disables the link layer address option (79) in the Global Configuration Mode.
Example
This command enables the insertion of Client Link Layer Address option (79) in the Global Configuration Mode.
The DHCPv6 Relay Option 37 allows a DHCPv6 relay agent to insert a Remote-ID option (Option 37) into DHCPv6 messages. This option provides the DHCPv6 server with information about the client's location, such as the MAC address of the relay agent, the ingress interface, and the VLAN ID. This is useful for network administrators to track the origin of DHCP requests and to enforce policies based on the client's location.
Use the following command to specify using the MAC address, hostname, and interface name for the Remote-ID:
switch(config)# ipv6 dhcp relay option remote-id format %m:%h:%p
Displaying the Remote-ID Configuration Information
Use the show ip dhcp relay command to display the Option 37 configuration:
switch# show ip dhcp relay
DHCP relay is active
DHCPv6 relay remote ID option (37) encoding format: MAC address:hostname:interface name
Clearing IPv6 DHCP Relay Counters
The clear ipv6 dhcp relay counters command resets the DHCP relay counters. The configuration mode determines which counters to reset:
Global configuratio: - Clears the counters for the switch and for all interfaces.
Interface configuration - Clears the counter for the configuration mode interface.
Examples
These commands clear all DHCP relay counters on the switch.
The show ip dhcp relay command displays the status of DHCP relay agent parameters on the switch and each interface where at least one feature parameter is listed. The command displays the status for both global and interface configurations.
Example
This command displays the DHCP Agent Relay parameter status.
switch(config)# interface ethernet 1/2
switch(config-if-Et1/2)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCPv6 Relay Link-layer Address Option (79) is disabled
DHCP Smart Relay is disabled
Interface: Ethernet1/2
DHCP Smart Relay is disabled
DHCP servers: 1::1
2001:db8:0:1::1
switch(config-if-Et1/2)#
IPv6 DHCP Relay Counters
The show ipv6 dhcp relay counters command displays the number of DHCP packets received, forwarded, or dropped on the switch and on all interfaces enabled as DHCP relay agents.
Example
This command displays the IP DHCP relay counter table.
switch> show ipv6 dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 376 376 0 | 4 days, 19:55:12 ago
All Resp | 277 277 0 |
| |
Ethernet4 | 207 148 0 | 4 days, 19:54:24 ago
switch>
TCP MSS Clamping for IPv6
TCP MSS Clamping limits the value of the Maximum Segment Size (MSS) in the TCP header of TCP SYN packets transiting a specified Ethernet or tunnel interface. Setting the MSS ceiling can avoid IP fragmentation in tunnel scenarios by ensuring that the MSS is low enough to account for the extra overhead of GRE and tunnel outer IP headers. Use TCP MSS Clamping when connecting through a GRE tunnel to cloud providers that require asymmetric routing.
When configuring MSS clamping on an interface, if the TCP MSS value in a SYN packet transiting that interface exceeds the configured ceiling limit, the configured limit overwrites the TCP MSS value, and the TCP checksum recomputes and updates.
By default, the software datapath handles TCP MSS Clamping. However, the hardware configuration can support the process to minimize possible packet loss and reduce the number of TCP sessions that the switch can establish per second.
Configuring the TCP MSS Ceiling on an IPv6 Interface
Set the TCP MSS Ceiling limit on an interface using command tcp mss ceiling ipv6. This also enables TCP MSS Clamping on the switch.
Note: TCP MSS Clamping routes all TCP SYN packets through software, even on interfaces with no TCP MSS Ceiling configured no hardware support. This significantly limits the number of TCP sessions the switch can establish per second, and can potentially cause packet loss if the CPU traffic exceeds control plane policy limits.
On platform switches DCS-7280R3, DCS-7500R3 Line Cards and DCS-7800R3 Line Cards, the following limitations apply:
This command works only on egress packets.
Unicast packets entering the switch support TCP MSS Ceiling and the configuration has no effect on GRE transit packets
or GRE decap, even if the egress interface has TCP MSS Ceiling configured.
EOS does not support TCP MSS Ceiling on L2 (switchport) interfaces.
VXLAN, Loopback or management interfaces do not support TCP MSS Ceiling.
Only hardware TCP MSS clamping is supported on release EOS-4.26.1F and later.
Example
These commands configure interface ethernet 26 as a routed port, then specify a maximum TCP MSS Ceiling value of 1436 bytes for TCP SYN packets exiting that port.
The clear ipv6 dhcp relay counters command resets the DHCP relay counters. If you do not specify a port, the command clears the counters for the switch and for all interfaces. Otherwise, the command clears the counter for the specified interface.
Command Mode
Privileged EXEC
Command Syntax
clear ipv6 dhcp relay counters [port]
Parameters
port - Specify the interface to access the neighbor. Options include the following:
no parameter - Removes all dynamic entries.
interface ethernete_num - Specify the Ethernet interface by e_num.
interface loopbackl_num - Specify the Loopback interface by l_num.
interface port-channel p_num - Specify the Port-channel interface by p_nump_num.
interface vlanv_num - Specify the VLAN interface by v_num.
Example
These commands clear the DHCP relay counters for interface ethernet 4 and shows the counters before and after the clear command.
switch(config)# show ipv6 dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 376 376 0 | 4 days, 19:55:12 ago
All Resp | 277 277 0 |
| |
Ethernet4 | 207 148 0 | 4 days, 19:54:24 ago
switch(config)# interface ethernet 4
switch(config-if-Et4)# clear ipv6 dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 380 380 0 | 4 days, 21:19:17 ago
All Resp | 281 281 0 |
| |
Ethernet4 | 0 0 0 |4 days, 21:18:30 ago
These commands clear all DHCP relay counters on the switch.
switch(config-if-Et4)# exit
switch(config)# clear ipv6 dhcp relay counters
switch(config)# show ipv6 dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|-------------
All Req | 0 0 0 | 0:00:03 ago
All Resp | 0 0 0 |
| |
Ethernet4 | 0 0 0 | 0:00:03 ago
switch(config)#
clear ipv6 dhcp snooping counters
The clear ipv6 dhcp snooping counters command resets the DHCP snooping packet counters.
Command Mode
Privileged EXEC
Command Syntax
clear ipv6 dhcp snooping counters [counter_type]
Parameters
counter_type - Specifies the type of counter to reset.
no parameter - Clears the counters for each VLAN.
debug - Clears aggregate counters and drop cause counters.
Examples
This command clears the number of DHCP packets sent and received on each VLAN.
switch# clear ipv6 dhcp snooping counters
switch# show ipv6 dhcp snooping counters
| Dhcpv6 Request Pkts | Dhcpv6 Reply Pkts |
Vlan | Rcvd Fwdd Drop | Rcvd Fwdd Drop | Last Cleared
-----|------ ------ -------|------ ----- ------|-------------
2789 | 1 1 0 | 1 1 0 | 0:03:09 ago
This command clears the number of DHCP packets sent on the switch.
The clear ipv6 neighbors command removes the specified dynamic IPv6 neighbor discovery cache entries. Commands that do not specify an IPv6 address remove all dynamic entries for the listed interface. Commands that do not specify an interface remove all dynamic entries.
Command Mode
Privileged EXEC
Command Syntax
clear ipv6 neighbors [port][dynamic_ipv6]
Parameters
port Interface through which neighbor is accessed. Options include the following:
no parameter - Removes all dynamic entries.
interface ethernete_num - Specify the Ethernet interface by e_num.
interface loopbackl_num - Specify the Loopback interface by l_num.
interface port-channel p_num - Specify the Port-channel interface by p_nump_num.
interface vlanv_num - Specify the VLAN interface by v_num.
dynamic_ipv6 - Specifies the address of entry to remove. Options include the following:
no parameter - Removes all dynamic entries for specified interface.
ipv6_addr - Removes the IPv6 address of the entry.
Example
This command removes all dynamic neighbor entries for vlan 200.
switch# clear ipv6 neighbors vlan 200
switch#
ipv6 address
The ipv6 addresscommand assigns a global IPv6 address to the IPv6 interface, and defines the prefix length. Routable interfaces support this command. Multiple global IPv6 addresses can be assigned to an interface. The IPv6 address or prefix can be supplied manually, or configured using Stateless Address Auto Configuration.
The no ipv6 address and default ipv6 address commands remove the IPv6 address assignment from the configuration mode interface by deleting the corresponding ipv6 address command from running-config. If the command does not include an address, all address assignments are removed from the interface. IPv6 remains enabled on the interface after the removal of all IPv6 addresses only ifipv6 enable command is configured on the interface.
The iv6p dhcp relay always-on command enables the switch DHCP relay agent on the switch regardless of the DHCP relay agent status on any interface. By default, the DHCP relay agent is enabled only if at least one routable interface is configured with an ipv6 dhcp relay destination statement.
The no ipv6 dhcp relay always-onand default ipv6 dhcp relay always-on commands remove the ipv6 dhcp relay always-on command from running-config.
The ipv6 dhcp relay destination command enables the DHCPv6 relay agent and sets the destination address on the configuration mode interface.
The no ipv6 dhcp relay destination and default ipv6 dhcp relay destination commands remove the corresponding ipv6 dhcp relay destination command from running-config. When the commands do not list an IPv6 address, all ipv6 dhcp relay destination commands are removed from running-config.
source-addressipv6_addr specify the source IPv6 address to communicate with DHCP server.
Guidelines
If the source-address parameter is specified, then the DHCP client receives an IPv6 address from the subnet of source IP address. The source-address must be one of the configured addresses on the interface.
Example
This command enables the DHCPv6 relay agent and sets the destination address to 2001:0db8:0:1::1 on interface ethernet 4.
switch(config)# interface ethernet 4
switch(config-if-Et4)# ipv6 dhcp relay destination 2001:0db8:0:1::1
switch(config-if-Et4)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCPv6 Relay Link-layer Address Option (79) is disabled
DHCP Smart Relay is disabled
Interface: Ethernet4
DHCP Smart Relay is disabled
DHCP servers: 1::1
2001:db8:0:1::1
switch(config-if-Et4)#
ipv6 dhcp relay option link-layer address
The ipv6 dhcp relay option link-layer address command enables the DHCPv6 relay agent to configure the client link layer address option to solicit and request messages. In other words, the command enables the link layer address option (79) in the global configuration mode.
The no ipv6 dhcp relay option link-layer address command disables the link layer address option (79) in the global configuration mode.
Command Mode
Global Configuration
Command Syntax
ipv6 dhcp relay option link-layer address
no ipv6 dhcp relay option link-layer address
default ipv6 dhcp relay option link-layer address
Example
This command enables the insertion of link layer address option (79) in the global configuration mode.
The ipv6 dhcp relay option command configures DHCPv6 Relay Option 37, Remote-ID, to add the MAC address, interface ID or name, and hostname as the remote-id format. The no version of the command removes the configuration from the running-config.
no ipv6 dhcp relay option remote-id format {%m:%h:%p | %m:%i | %m:%p}
Parameters
remote-id - Add Option 37 to the DHCP Relay configuration.
format - Select one of the following as the format for the remote-id:
%m:%h:%p - Specify the MAC address, hostname, and interface name as the remote-id.
%m:%i - Specify the MAC address and interface ID as the remote-id.
%m:%p - Specify the MAC address and interface name as the remote-id.
Example
Use the following command to specify using the MAC address, hostname, and interface name for the Remote-ID:
switch(config)# ipv6 dhcp relay option remote-id format %m:%h:%p
ipv6 enable
The ipv6 enable command enables IPv6 on the configuration mode interface. Assigning an IPv6 address to an interface also enables IPv6 on the interface.
The no ipv6 enable and default ipv6 enable command remove the corresponding ipv6 enable command from running-config. This action disables IPv6 on interfaces that are not configured with an IPv6 address.
The ipv6 hardware fib aggregate-address command specifies the routing table repository of specified IPv6 route.
By default, routes that are created statically through the CLI or dynamically through routing protocols are initially stored in software routing tables, then entered in the hardware routing table by the routing agent. This command prevents the entry of the specified route into the hardware routing table. Specified routes that are in the hardware routing table are removed by this command. Specific routes that are encompassed within the specified route prefix are affected by this command.
The no ipv6 hardware fib aggregate-address and default ipv6 hardware fib aggregate-address commands remove the restriction from the hardware routing table for the specified routes by removing the corresponding ipv6 hardware fib aggregate-address command from running-config.
ipv6_prefix IPv6 prefix that is restricted from the hardware routing table (CIDR notation).
Example
These commands configure a hardware routing restriction for an IPv6 prefix, then displays that restriction.
switch(config)# ipv6 hardware fib aggregate-address fd77:4890:5313:ffed::/64
summary-only software-forward
switch(config)# show ipv6 hardware fib aggregate-address
Codes: S - Software Forwarded
S fd77:4890:5313:ffed::/64
switch(config)#
ipv6 hardware fib ecmp resilience
The ip hardware fib ecmp resilience command configures a fixed number of next hop entries in the hardware ECMP table for the specified IPv6 address prefix. In addition to specifying the maximum number of next hop addresses that the table can contain for the prefix, the command introduces a redundancy factor that allows duplication of each next hop address. The fixed table space for the address is the maximum number of next hops multiplied by the redundancy factor.
The default method of adding or removing next hop entries when required by the active hashing algorithm leads to inefficient management of the ECMP table, which can result in the rerouting of packets to different next hops that breaks TCP packet flows. Implementing fixed table entries for a specified IP address allows data flows that are hashed to a valid next hop number to remain intact. Additionally, traffic is evenly distributed over a new set of next hops.
The no ip hardware fib ecmp resilience and default ip hardware fib ecmp resilience commands restore the default hardware ECMP table management by removing the ip hardware fib ecmp resilience command from running-config.
nhop_max Specifies maximum number of nexthop entries for specified IP address prefix. Value range varies by platform:
Helix: <2 to 64>
Trident: <2 to 32>
Trident II: <2 to 64>
duplicates Specifies the redundancy factor. Value ranges from 1 to 128.
Example
This command configures a hardware ECMP table space of 15 entries for the IPv6 address 2001:db8:0::/64. A maximum of five nexthop addresses can be specified for the address. When the table contains five nexthop addresses, each appears in the table three times. When the table contains fewer than five nexthop addresses, each is duplicated until the 15 table entries are filled.
The ipv6 hardware fib nexthop-index command deterministically selects the next hop used for ECMP routes. By default, routes that are created statically through the CLI or dynamically through routing protocols are initially stored in software routing tables, then entered in the hardware routing table by the routing agent. This command specifies the method of creating an index-offset number that points to the next hop from the list of the route’s ECMP next hops.
The index-offset is calculated by adding the next hop index to a prefix offset.
Next hop index: specified in the command.
Prefix offset: the least significant bits of the route’s prefix.
The command specifies the number of bits that comprise the prefix offset. The prefix offset is set to the prefix when the command specifies a prefix size larger than the prefix. If the command specifies an prefix size of zero, the prefix-offset is also zero and the index-offset is set to the next hop index.
When the index-offset is greater than the number of next hops in the table, the position of the next hop is the remainder of the division of the index-offset by the number of next hop entries.
The no ipv6 hardware fib nexthop-index and default ipv6 hardware fib nexthop-index commands remove the specified nexthop used for ECMP routes by removing the ipv6 hardware fib nexthop-index command from running-config.
Command Mode
Global Configuration
Command Syntax
ipv6 hardware fib nexthopnxthop_index [PREFIX]
no ipv6 hardware fib nexthop
default ipv6 hardware fib nexthop
Parameters
nxthop_index specifies the next hop index. Value ranges from 0 to 32.
PREFIX Number of bits of the route’s prefix to use as the prefix-offset. Value ranges from 0 to 64.
no parameter The prefix offset is set to zero.
prefix-bits0 to 64 Specifies the number bits to use as the prefix-offset.
Example
This command specifies the next hop from the list of ECMP next hops for the route.
switch(config)# ipv6 hardware fib nexthop-index 5 prefix-bits 10
switch> show ip
IP Routing : Enabled
IP Multicast Routing : Disabled
VRRP: Configured on 0 interfaces
IPv6 Unicast Routing : Enabled
IPv6 ECMP Route support : False
IPv6 ECMP Route nexthop index: 5
IPv6 ECMP Route num prefix bits for nexthop index: 10
switch>
ipv6 hardware fib optimize prefixes
The ipv6 hardware fib optimize prefixes command in the Global Configuration Mode reserves IPv6 optimized prefixes on the default and non-default VRFs.
The no version of the command explicitly removes the configuration from the running-config on the switch.
Command Mode
Global Configuration
Command Syntax
ip hardware fib optimize vrfvrf_nameprefixes minimum countnum_prefixes
no ip hardware fib optimize vrfvrf_nameprefixes minimum countnum_prefixes
Parameters
vrfvrf_name - Specify the VRF to minimize prefixes.
prefixes minimum countnum_prefixes - Specify the minimum number of prefixes to optimize on the VRF.
Example
Use the following command to create reservations for 35 IPv6 optimized prefixes on VRF green:
switch(config)# ipv6 hardware fib optimize vrf green prefixes minimum count 35
! Please restart the SandL3Unicast agent to reserve space for optimized FIB prefixes
ipv6 nd dad proxy
IPv6 DAD Proxy can be configured on an interface, and you must configure an IPv6 address on the interface and then enable IPv6 on the interface. You can configure this in conjunction with IPv6 ND Proxy.
Command Mode
Interface-Ethernet Configuration
Command Syntax
ipv6 nd dad proxy
Example
The following example enables IPV6 DAD Proxy on Ethernet1:
switch(config-if-Et1/1#ipv6 nd dad proxy
switch(config-if-Et1/1#ipv6 address 2001:db8:1::/64
switch(config-if-Et1/1#ipv6 enable
ipv6 nd managed-config-flag
The ipv6 nd managed-config-flag command causes the managed address configuration flag to be set in IPv6 RA packets transmitted from the configuration mode interface.
The no ipv6 nd managed-config-flag and default ipv6 nd managed-config-flag commands restore the default setting where the managed address configuration flag is not set in IPv6 RA packets transmitted by the interface by removing the corresponding ipv6 nd managed-config-flag command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd managed-config-flag
no ipv6 nd managed-config-flag
default ipv6 nd managed-config-flag
Example
These commands cause the managed address configuration flag to be set in IPv6 RA packets sent from interface vlan 200.
The ipv6 nd ns-interval command configures the interval between IPv6 Neighbor Solicitation (NS) transmissions from the configuration mode interface.
The no ipv6 nd ns-interval and default ipv6 nd ns-interval commands return the IPv6 NS transmission interval for the configuration mode interface to the default value of 1000 milliseconds by removing the corresponding ipv6 nd ns-interval command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd ns-intervalperiod
no ipv6 nd ns-interval
default ipv6 nd ns-interval
Parameter
period interval in milliseconds between successive IPv6 neighbor solicitation transmissions. Values range from 1000 to 4294967295. The default period is 1000 milliseconds.
Example
This command configures a neighbor solicitation transmission interval of 30 seconds on interface vlan 200.
The ipv6 nd other-config-flag command configures the configuration mode interface to send IPv6 RAs with the other stateful configuration flag set.
The no ipv6 nd other-config-flag and default ipv6 nd other-config-flag commands restore the default setting by removing the corresponding ipv6 nd other-config-flag command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd other-config-flag
no ipv6 nd other-config-flag
default ipv6 nd other-config-flag
Example
These commands configure the switch to set the other stateful configuration flag in advertisements sent from interface vlan 200.
The ipv6 nd prefix command configures neighbor discovery Router Advertisements (RAs) prefix inclusion for RAs sent from the configuration mode interface.
By default, all prefixes configured as IPv6 addresses are advertised in the interface’s RAs. The ipv6 nd prefix command with the no-advertise option prevents advertising of the specified prefix without affecting the advertising of other prefixes specified as IPv6 addresses. When an interface configuration includes at least one ipv6 nd prefix command that enables prefix advertising, RAs advertise only prefixes specified through ipv6 nd prefix commands.
Commands enabling prefix advertising also specify the advertised valid and preferred lifetime periods. Default periods are 2,592,000 (valid) and 604,800 (preferred) seconds.
The no ipv6 nd prefix and default ipv6 nd prefix commands remove the corresponding ipv6 nd prefix command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd prefixipv6_prefixLIFETIME [FLAGS]
ipv6 nd prefixipv6_prefixno-advertise
no ipv6 nd prefixipv6_prefix
default ipv6 nd prefixipv6_prefix
Parameters
ipv6_prefix IPv6 prefix (CIDR notation).
no-advertise Prevents advertising of the specified prefix.
LIFETIME Period that the specified IPv6 prefix is advertised (seconds). Options include:
validpreferred Two values that set the valid and preferred lifetime periods.
valid One value that sets the valid lifetime. The preferred lifetime is set to the default value.
no parameter The valid and preferred lifetime periods are set to their default values.
Options for valid: 0 to 4294967295 and infinite. Default value is 2592000 Options for preferred: 0 to 4294967295 and infinite. The default value is 604800. The maximum value (4294967295) and infinite are equivalent settings.
FLAGSon-link and autonomous address-configuration flag values in RAs.
no parameter both flags are set.
no-autoconfigautonomous address-configuration flag is reset.
no-onlinkon-link flag is reset.
no-autoconfig no-onlink both flags are reset.
no-onlink no-autoconfig both flags are reset.
Example
These commands enable neighbor discovery advertising for IPv6 address 3012:D678::/64, on interface vlan 200, specifying a valid lifetime of 1,296,000 seconds and the default preferred lifetime.
The ipv6 nd ra disabled command suppress IPv6 Router Advertisement (RA) transmissions on the configuration mode interface. By default, only unsolicited RAs that are transmitted periodically are suppressed. The all option configures the switch to suppress all RAs, including those responding to a router solicitation.
The no ipv6 nd ra disabled and default ipv6 nd ra disabled commands restore the transmission of RAs on the configuration mode interface by deleting the corresponding ipv6 nd ra disabled command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd ra disabled [SCOPE]
no ipv6 nd ra disabled
default ipv6 nd ra disabled
Parameters
SCOPE specifies the RAs that are suppressed.
no parameter Periodic unsolicited RAs are suppressed.
all All RAs are suppressed.
Example
This command suppresses all RAs on interface vlan 200.
switch(config)# interface vlan 200
switch(config-vl200)# ipv6 nd ra disabled all
switch(config-vl200)#
ipv6 nd ra dns-server
The ipv6 nd ra dns-server command configures the IPv6 address of a preferred Recursive DNS Server (RDNSS) for the command mode interface to include in its neighbor-discovery Router Advertisements (RAs). Including RDNSS information in RAs provides DNS server configuration for connected IPv6 hosts without requiring DHCPv6.
Multiple servers can be configured on the interface by using the command repeatedly. A lifetime value for the RDNSS can optionally be specified with this command, and overrides any default value configured for the interface using the ipv6 nd ra dns-servers lifetime command.
The no ipv6 nd ra dns-server and default ipv6 nd ra dns-server commands remove the corresponding ipv6 nd ra dns-server command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuratio
Command Syntax
ipv6 nd ra dns-serveripv6_addrSERVER_LIFE
no ipv6 nd ra dns-serveripv6_addr
default ipv6 nd ra dns-serveripv6_addr
Parameters
ipv6_addr RDNSS address to be included in RAs from the command mode interface.
SERVER_LIFE maximum lifetime value for the specified RDNSS entry. This value overrides any default lifetime value. Value should be between the RA interval configured on the interface and two times that interval. Options include:
no parameter lifetime period is the default lifetime period configured on the interface. If no lifetime period is configured on the interface, the default value is 1.5 times the maximum RA interval set by the ipv6 nd ra interval command.
lifetime 0 the configured RDNSS is not to be used.
lifetime1 to 4294967295 specifies the lifetime period for this RDNSS in seconds.
Example
This command configures the RDNSS at 2001:0db8:0:1::1 as a preferred RDNSS for interface vlan 200 to include in its neighbor-discovery route advertisements, and sets its lifetime value to 300 seconds.
The ipv6 nd ra dns-servers lifetime command sets the default value that the configuration mode interface uses for the lifetime of any Recursive DNS Server (RDNSS) configured on the interface. A lifetime value set for an individual RDNSS overrides this value. The lifetime value is the maximum amount of time after a route advertisement packet is sent that the RDNSS referenced in the packet may be used for name resolution.
The no ipv6 nd ra dns-servers lifetime and default ipv6 nd ra dns-servers lifetime commands remove the default lifetime value from the interface by removing the corresponding ipv6 nd ra dns-servers lifetime command from running-config. When there is no default RDNSS lifetime value configured on the interface, an RDNSS without a custom lifetime value will default to 1.5 times the RA interval configured on the interface. A lifetime of zero seconds means that the RDNSS must not be used for name resolution.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd ra dns-servers lifetimeperiod
no ipv6 nd ra dns-servers lifetime
default ipv6 nd ra dns-servers lifetime
Parameters
period the RDNSS lifetime value for the configuration mode interface. Options include:
0 any RDNSS configured on the command mode interface without a custom lifetime value must not be used.
1 to 4294967295 maximum RDNSS lifetime value for the configuration mode interface. This value is overridden by any lifetime value set with the ipv6 nd ra dns-server command. Should be between the router advertisement interval configured on the interface and two times that interval.
Example
This command sets the default RDNSS maximum lifetime value for interface vlan 200 to 350 seconds.
The ipv6 nd ra dns-suffix command creates a DNS Search List (DNSSL) for the command mode interface to include in its neighbor-discovery Router Advertisements as defined in RFC 6106 . The DNSSL contains the domain names of DNS suffixes for IPv6 hosts to append to short, unqualified domain names for DNS queries.
Multiple DNS domain names can be added to the DNSSL by using the command repeatedly. A lifetime value for the DNSSL can optionally be specified with this command, and overrides any default value configured for the interface using the ipv6 nd ra dns-suffixes lifetime command.
The no ipv6 nd ra dns-suffix and default ipv6 nd ra dns-suffix commands remove the corresponding ipv6 nd ra dns-suffix command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd ra dns-suffixdomainSUFFIX_LIFE
no ipv6 nd ra dns-suffixipv6_addr
default ipv6 nd ra dns-suffixipv6_addr
Parameters
domain domain suffix for IPv6 hosts to append to short, unqualified domain names for DNS queries. Suffix must contain only alphanumeric characters, “.” and “-” and must begin and end with an alphanumeric character.
SUFFIX_LIFE maximum lifetime value for the specified domain suffix. This value overrides any default lifetime value. Value should be between the RA interval configured on the interface and two times that interval. Options include:
no parameter lifetime period is the default lifetime period configured on the interface. If no lifetime period is configured on the interface, the default value is 1.5 times the maximum RA interval set by the ipv6 nd ra interval command.
lifetime 0 the configured domain suffix is not to be used.
lifetime1 to 4294967295 specifies the lifetime period for this domain suffix in seconds.
Example
These commands create a DNSSL for interface vlan 200 to include in its neighbor-discovery route advertisements, and set its lifetime value to 300 seconds.
The ipv6 nd ra dns-suffixes lifetimecommand sets the default value that the configuration mode interface uses for the lifetime of any DNS Search List (DNSSL) configured on the interface. A lifetime value set for an individual DNSSL overrides this value. The lifetime value is the maximum amount of time after a route advertisement packet is sent that the DNSSL included in the packet may be used for name resolution.
The no ipv6 nd ra dns-suffixes lifetime and default ipv6 nd ra dns-suffixes lifetime commands remove the default lifetime value from the interface by removing the corresponding ipv6 nd ra dns-suffixes lifetime command from running-config. When there is no default DNSSL lifetime value configured on the interface, a DNSSL without a custom lifetime value will default to 1.5 times the RA interval configured on the interface. A lifetime of zero seconds means that the DNSSL must not be used for name resolution.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd ra dns-suffixes lifetimeperiod
no ipv6 nd ra dns-suffixes lifetime
default ipv6 nd ra dns-suffixes lifetime
Parameters
period the DNSSL lifetime value for the configuration mode interface. Options include:
0 any DNSSL configured on the command mode interface without a custom lifetime value must not be used.
1 to 4294967295 maximum DNSSL lifetime value for the configuration mode interface. This value is overridden by any lifetime value set with the ipv6 nd ra dns-suffix command. Should be between the RA interval configured on the interface and two times that interval.
Example
This command sets the default DNSSL maximum lifetime value for interface vlan 200 to 350 seconds.
The ipv6 nd ra hop-limit command sets a suggested hop-limit value to be included in Router Advertisement (RA) packets. The hop-limit value is to be used by attached hosts in outgoing packets.
The no ipv6 nd ra hop-limit and default ipv6 nd ra hop-limit commands remove the corresponding ipv6 nd ra hop-limit command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd ra hop-limitquantity
no ipv6 nd ra hop-limit lifetime
default ipv6 nd ra hop-limit lifetime
Parameters
quantity the hop-limit value to be included in RA packets sent by the configuration mode interface. Options include:
0 indicates that outgoing packets from attached hosts are to be immediately discarded.
1 to 255 number of hops. The default value is 64.
Example
These commands include a hop-limit value of 100 in RA packets sent by interface vlan 200.
switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra hop-limit
switch(config-if-Vl200)#
ipv6 nd ra interval
The ipv6 nd ra interval command configures the interval between IPv6 Router Advertisement transmissions from the configuration mode interface.
The no ipv6 nd ra interval and default ipv6 nd ra interval commands return the IPv6 RA transmission interval for the configuration mode interface to the default value of 200 seconds by removing the corresponding ipv6 nd ra interval command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd ra interval [SCALE] ra_period [minimum_period]
no ipv6 nd ra interval
default ipv6 nd ra interval
Parameters
SCALE timescale in which command parameter values are expressed.
no parameter seconds.
msec milliseconds.
ra_period maximum interval between successive IPv6 RA transmissions. The default period is 200 seconds.
4 - 1800 valid range when SCALE is set to default value (seconds).
500 - 1800000 valid range when SCALE is set to msec.
minimum_period minimum interval between successive IPv6 RA transmissions. Must be smaller than ra_period. By default, a minimum period is not defined.
no parameter Command does not specify a minimum period.
3 - 1799 valid range when scale is set to default value (seconds).
375 - 1799999 valid range when scale is set to msec.
Example
These commands configure a RA transmission interval of 60 seconds on VLAN interface interface vlan 200, then displays the interface status.
switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra interval 60
switch(config-if-Vl200)# show active
interface Vlan200
ipv6 nd ra interval 60
switch(config-if-Vl200)#
ipv6 nd ra lifetime
The ipv6 nd ra lifetime command specifies the value that the switch places in the router lifetime field of IPv6 Router Advertisements sent from the configuration mode interface.
If the value is set to 0, IPv6 peers connected to the specified interface will remove the switch from their lists of default routers. Values greater than 0 indicate the time in seconds that peers should keep the router on their default router lists without receiving further RAs from the switch. Unless the value is 0, the router lifetime value should be equal to or greater than the interval between unsolicited RAs sent on the interface.
The no ipv6 nd ra lifetime and default ipv6 nd ra lifetime commands return the IPv6 RA lifetime data entry filed for the configuration mode interface to the default value of 1800 seconds by removing the corresponding ipv6 nd ra lifetime command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd ra lifetimera_lifetime
no ipv6 nd ra lifetime
default ipv6 nd ra lifetime
Parameters
ra_lifetime router lifetime period (seconds). Default value is 1800. Options include:
0 Router should not be considered as a default router.
1 - 65535 Lifetime period advertised in RAs. Should be greater than or equal to the interval between IPv6 RA transmissions from the configuration mode interface as set by the ipv6 nd ra interval command.
Example
This command configures the switch to enter 2700 in the router lifetime field of RAs transmitted from interface vlan 200.
switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd ra lifetime 2700
switch(config-if-Vl200)# show active
interface Vlan20
ipv6 nd ra lifetime 2700
switch(config-if-Vl200)#
ipv6 nd ra mtu suppress
The ipv6 nd ra mtu suppress command suppresses the Router Advertisement (RA) MTU option on the configuration mode interface. The MTU option causes an identical MTU value to be advertised by all nodes on a link. By default, the RA MTU option is not suppressed.
The no ipv6 nd ra mtu suppress and default ipv6 nd ra mtu suppress commands restores the MTU option setting to enabled by for the configuration mode interface by removing the corresponding ipv6 nd ra mtu suppress command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd ra mtu suppress
no ipv6 nd ra mtu suppress
default ipv6 nd ra mtu suppress
Example
This command suppresses the MTU option on interface vlan 200.
switch(config)# interface vlan 200
switch(config-vl200)# ipv6 nd ra mtu suppress
switch(config-vl200)#
ipv6 nd ra rx accept default-route
The ipv6 nd ra rx accept default-route command configures the interface to accept the default gateway information from the Router Advertisement (RA) in the interface configuration. EOS disables this parameter by default. The no and default versions of the command disables the feature.
Command Mode
Interface Configuration Mode
Command Syntax
ipv6 nd ra rx accept default
Parameters
ipv6 - Specifies using the IPv6 address family.
nd - Specifies Neighbor Discovery and Router Advertisement.
ra - Specifies using Router Advertisement commands.
rx - Specifies the action on the receiving RA.
accept - Specifies accepting the information on the RA.
default-route- Specifies accepting the default gateway information from the RA.
Example
Use the following commands to add the parameter to interface Ethernet3/1:
switch(config)# interface Ethernet3/1
switch(config-if-Et3/1) ipv6 nd ra rx accept default-route
ipv6 nd reachable-time
The ipv6 nd reachable-time command specifies the time period that the switch includes in the reachable time field of RAs sent from the configuration mode interface. The reachable time defines the period that a remote IPv6 node is considered reachable after a reachability confirmation event.
RAs that advertise zero seconds indicate that the router does not specify a reachable time. The default advertisement value is 0 seconds. The switch reachability default period is 30 seconds.
The no ipv6 nd reachable-time and default ipv6 nd reachable-time commands restore the entry of the default value (0) in RAs sent from the configuration mode interface by deleting the corresponding ipv6 nd reachable-time command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 nd reachable-timeperiod
no ipv6 nd reachable-time
default ipv6 nd reachable-time
Parameter
period Reachable time value (milliseconds). Value ranges from 0 to 4294967295. Default is 0.
Example
These commands configure the entry of 25000 (25 seconds) in the reachable time field of RAs sent from interface vlan 200.
The ipv6 nd router-preference command specifies the value that the switch enters in the Default Router Preference (DRP) field of Router Advertisements (RAs) that it sends from the configuration mode interface. The default field entry value is medium.
The no ipv6 nd router-preference and default ipv6 nd router-preference commands restore the switch to enter the default DRP field value of medium in RAs sent from the configuration mode interface by deleting the corresponding ipv6 nd router-preference command from running-config.
This command configures the switch as a medium preference router on RAs sent from interface vlan 200.
switch(config)# interface vlan 200
switch(config-if-Vl200)# ipv6 nd router-preference medium
switch(config-if-Vl200)#
ipv6 neighbor cache persistent
The ipv6 neighbor cache persistent command restores the IPv6 neighbor cache after reboot.
The no ipv6 neighbor cache persistent and default ipv6 neighbor cache persistent commands remove the ARP cache persistant configuration from the running-config.
Command Mode
Global Configuration
Command Syntax
ipv6 neighbor cache persistent
no ipv6 neighbor cache persistent
default ipv6 neighbor cache persistent
Example
This command restores the ipv6 neighbor cache after reboot.
The ipv6 neighbor command creates an IPv6 neighbor discovery cache static entry. The command converts pre-existing dynamic cache entries for the specified address to static entries.
The no ipv6 neighbor and default ipv6 neighborcommands remove the specified static entry from the IPV6 neighbor discovery cache and delete the corresponding ipv6 neighbor command from running-config. These commands do not affect any dynamic entries in the cache.
Command Mode
Global Configuration
Command Syntax
ipv6 neighboripv6_addrPORTmac_addr
no ipv6 neighboripv6_addressPORT
default ipv6 neighboripv6_addrPORT
Parameters
ipv6_addr Neighbor’s IPv6 address.
PORT Interface through which the neighbor is accessed. Options include:
ethernete_num Ethernet interface specified by e_num.
loopbackl_num Loopback interface specified by l_num.
managementm_num Management interface specified by m_num.
port-channelp_num Port-channel interface specified by p_num.
This command will add a static entry to the neighbor discovery cache for the neighbor located at 3100:4219::3EF2 with hardware address 0100.4EA1.B100 and accessible through vlan 200.
The ipv6 route command creates an IPv6 static route. The destination is a IPv6 prefix; the source is an IPv6 address or a routable interface port. When multiple routes exist to a destination prefix, the route with the lowest administrative distance takes precedence.
By default, the administrative distance assigned to static routes is 1. Assigning a higher administrative distance to a static route configures it to be overridden by dynamic routing data. For example, a static route with a distance value of 200 is overridden by OSPF intra-area routes, which have a default distance of 110.
The command provides these methods of designating the nexthop location:
null0: Traffic to the specified destination is dropped.
IPv6 gateway: Switch identifies egress interface by recursively resolving the next-hop.
Egress interface: Switch assumes destination subnet is directly connected to interface; when routing to any subnet address, the switch sends an ARP request to find the MAC address for the first packet.
Combination Egress interface and IPv6 gateway: Switch does not assume subnet is directly connected to interface; the only ARP traffic is for the nexthop address for the first packet on the subnet. Combination routes are not recursively resolved.
Multiple routes that are configured to the same destination with the same administrative distance comprise an Equal Cost Multi-Path (ECMP) route. The switch attempts to spread outbound traffic across all ECMP route paths equally. All ECMP paths are assigned the same tag value; commands that change the tag value of any ECMP path change the tag value of all paths in the ECMP.
The no ipv6 route and default ipv6 route commands delete static routes by removing the corresponding ipv6 route statements from running-config. Commands not including a source delete all statements to the destination. Only statements with parameters that match specified command arguments are deleted. Parameters that are not in the command line are not evaluated.
The ipv6 unicast-routing command enables the forwarding of IPv6 unicast packets. When routing is enabled, the switch attempts to deliver inbound packets to destination addresses by forwarding them to interfaces or next hop addresses specified by the IPv6 routing table.
The no ipv6 unicast-routing and default ip ipv6 unicast-routing commands disable IPv6 unicast routing by removing the ipv6 unicast-routing command from running-config. Dynamic routes added by routing protocols are removed from the routing table. Static routes are preserved by default; the delete-static-routes option removes static entries from the routing table.
IPv6 unicast routing is disabled by default.
Command Mode
Global Configuration
Command Syntax
ipv6 unicast-routing
no ipv6 unicast-routing [DELETE_ROUTES]
default ipv6 unicast-routing [DELETE_ROUTES]
Parameters
DELETE_ROUTES Resolves routing table static entries when routing is disabled.
no parameter Routing table retains static entries.
delete-static-routes Static entries are removed from the routing table.
The ipv6 verify command configures Unicast Reverse Path Forwarding (uRPF) for inbound IPv6 packets on the configuration mode interface. uRPF verifies the accessibility of source IP addresses in packets that the switch forwards.
uRPF defines two operational modes: strict mode and loose mode.
Strict mode: uRPF also verifies that a packet is received on the interface that its routing table entry specifies for its return packet.
Loose mode: uRPF validation does not consider the inbound packet’s ingress interface.
The no ipv6 verify and default ipv6 verify commands disable uRPF on the configuration mode interface by deleting the corresponding ipv6 verify command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 verifyunicastsourcereachable-viaRPF_MODE
no ipv6 verifyunicast
default ipv6 verifyunicast
Parameters
RPF_MODE Specifes the uRPF mode. Options include:
any Loose mode.
rx Strict mode.
rx allow-default Strict mode. All inbound packets are forwarded if a default route is defined.
Guidelines
The first IPv6 uRPF implementation briefly disables IPv6 unicast routing. Subsequent ip verify commands on any interface do not disable IPv6 routing.
Example
This command enables uRPF strict mode on interface vlan 100. When a default route is configured on the interface, all inbound packets are checked as valid.
The ipv6 dhcp snooping command enables DHCP snooping globally on the switch.
The no ipv6 dhcp snooping and default ipv6 dhcp snooping commands disable global DHCP snooping by removing the ipv6 dhcp snooping command from running-config.
vlan enables IPv6 DHCP snooping for a specific VLAN. Numbers range from 1 to 4094.
$ end of range.
vlan-range VLANs based on the snooping enabled. Formats include a number, a number range, or a comma-delimited list of numbers and ranges. Numbers range from 1 to 4094.
Examples
The following configuration enables IPv6 DHCP snooping feature at the global level.
The following command display IPv6 DHCP snooping state.
switch(config)# ipv6 dhcp snooping
switch(config)# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
2789-2790
DHCPv6 Snooping is operational on following VLANs:
2789
Insertion of Option-37 is enabled
pim ipv6 sparse-mode
The pim ipv6 sparse-mode command enables PIM Sparse Mode (PIM-SM) and IGMP (router mode) on the configuration mode interface.
Note: PIM and multicast border router (MBR) must be mutually exclusive on an interface. If the interface is configured as an MBR, do not enable PIM on the interface.
The no pim ipv6 sparse-mode and default pim ipv6 sparse-mode commands restore the default PIM and IGMP (router mode) settings of disabled on the configuration mode interface by removing the pim ipv6 sparse-mode command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel
Configuration Interface-VLAN Configuration
Command Syntax
pim ipv6 sparse-mode
no pim ipv6
no pim ipv6 sparse-mode
default pim ipv6
default pim ipv6 sparse-mode
Example
This command enables pim ipv6 sparse-mode on interface vlan 4 interface.
The show ipv6 dhcp relay counters command displays the number of DHCP packets received, forwarded, or dropped on the switch and on all interfaces enabled as DHCP relay agents.
Command Mode
EXEC
Command Syntax
show ipv6 dhcp relay counters
Example
This command displays the IP DHCP relay counter table.
switch> show ipv6 dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 376 376 0 | 4 days, 19:55:12 ago
All Resp | 277 277 0 |
| |
Ethernet4 | 207 148 0 | 4 days, 19:54:24 ago
switch>
show ipv6 dhcp snooping
The show ipv6 dhcp snooping command displays information about the DHCP snooping configuration.
This command displays the switch’s DHCP snooping configuration.
switch# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
2789-2790
DHCPv6 Snooping is operational on following VLANs:
2789
Insertion of Option-37 is enabled
show ipv6 dhcp snooping counters
The show ipv6 dhcp snooping counters command displays counters that track the quantity of DHCP request and reply packets that the switch receives. Data is either presented for each VLAN or aggregated for all VLANs with counters for packets dropped.
Command Mode
EXEC
Command Syntax
show ipv6 dhcp snooping counters [COUNTER_TYPE]
Parameters
COUNTER_TYPE The type of counter that the command displays.
no parameter command displays counters for each VLAN.
debug command displays aggregate counters and drop cause counters.
Examples
This command displays the number of DHCP packets sent and received on each VLAN.
switch# show ipv6 dhcp snooping counters
| Dhcpv6 Request Pkts | Dhcpv6 Reply Pkts |
Vlan | Rcvd Fwdd Drop | Rcvd Fwdd Drop | Last Cleared
-----|------ ------ -------|------ ----- ------|-------------
2789 | 1 1 0 | 1 1 0 | 0:03:09 ago
This command displays the number of DHCP packets sent on the switch.
switch# show ipv6 dhcp snooping counters debug
Counter Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received 1 1
Forwarded 1 1
Dropped - Invalid VlanId 0 0
Dropped - Parse error 0 0
Dropped - Invalid Dhcp Optype 0 0
Dropped - Invalid Remote-ID Option 0 0
Dropped - Snooping disabled 0 0
Last Cleared: 0:04:29 ago
show ipv6 dhcp snooping hardware
The show ipv6 dhcp snooping hardware command displays internal hardware DHCP snooping status on the switch.
Command Mode
EXEC
Command Syntax
show ipv6 dhcp snooping hardware
Example
This command displays DHCP snooping hardware status.
switch# show ipv6 dhcp snooping hardware
DHCPv6 Snooping is enabled
DHCPv6 Snooping is enabled on following VLANs:
2789
Vlans enabled per Slice
Slice: Linecard0-0
2789
Slice: Linecard0-1
2789
Slice: Linecard0-2
2789
Slice: Linecard0-3
2789
show ipv6 hardware fib aggregate-address
The show ipv6 hardware fib aggregate-address command displays the IPv6 prefixes that are restricted from entry into the hardware routing table. The ipv6 hardware fib aggregate-address command configures IPv6 prefix restictions.
Command Mode
EXEC
Command Syntax
show ipv6 address fib aggregate-address [ADDRESS][RESTRICTION]
Parameters
ROUTE_FILTER filters by IPv6 address. Options include:
no parameter Displays all routes.
ipv6_addr Command displays only specified address.
ipv6_prefix Command displays addresses filtered by specified prefix (CIDR notation).
RESTRICTION filters by route restriction.
no parameter displays routes restricted from the hardware routing table.
software-forward displays routes restricted from the hardware routing table.
Example
This command displays the routes that are restricted from the hardware routing table.
switch> show ipv6 hardware fib aggregate-address
Codes: S - Software Forwarded
S fd77:4890:5313:aaed::/64
S fd77:4890:5313:ffed::/64
switch>
show ipv6 interface
The ipv6 interface command displays the status of specified routed interfaces that are configured for IPv6.
Command Mode
EXEC
Command Syntax
show ipv6 interface [INTERFACE_NAME][INFO_LEVEL]
Parameters
INTERFACE_NAME interfaces for which command displays status.
no parameter all routed interfaces.
ethernete_num Ethernet interface specified by e_num.
loopbackl_num Loopback interface specified by l_num.
managementm_num Management interface specified by m_num.
port-channelp_num Port-Channel Interface specified by p_num.
vlanv_num VLAN interface specified by v_num.
VXLANvx_num VXLAN interface specified by vx_num.
INFO_LEVEL amount of information that is displayed. Options include:
no parameter command displays data block for each specified interface.
brief command displays table that summarizes IPv6 interface data.
Example
This command displays the status of interface vlan 903.
switch> show ipv6 interface vlan 903
Vlan903 is up, line protocol is up (connected)
IPv6 is enabled, link-local is fe80::21c:73ff:fe01:21e/64
Global unicast address(es):
fd7a:629f:52a4:fe10::3, subnet is fd7a:629f:52a4:fe10::/64
Joined group address(es):
ff02::1
ff02::1:ff01:21e
ff02::1:ff00:3
ff01::2
switch>
show ipv6 nd dad proxy
Displays information about the IPv6 Duplicate Address Detection (DAD) feature configured on an interface.
Command Mode
Interface-Ethernet Configuration
Command Syntax
show ipv6 nd dad proxy
Example
The following example displays information about IPV6 DAD Proxy on Ethernet1:
switch# show ipv6 nd dad interface ethernet1/1
Ethernet1/1
ipv6 nd proxy prefix connected
ipv6 nd dad proxy
ipv6 address 2001:db8:3::/64
show ipv6 nd ra internal state
The ipv6 nd ra internal state command displays the state of the IPv6 Router Advertisement (RA) daemon for the specified routable interface.
Command Mode
EXEC
Command Syntax
show ipv6 nd ra internal state [INTERFACE_NAME]
Parameters
INTERFACE_NAME interfaces for which command displays status.
no parameter all routed interfaces.
ethernete_num Ethernet interface specified by e_num.
loopbackl_num Loopback interface specified by l_num.
managementm_num Management interface specified by m_num.
port-channelp_num Port-Channel Interface specified by p_num.
vlanv_num VLAN interface specified by v_num.
VXLANvx_num VXLAN interface specified by vx_num.
Example
This command displays the IPv6 RA daemon for vlan 1243.
The show ipv6 neighbors command displays the IPv6 neighbor discovery cache. The command provides filters to restrict the list to a specified IPv6 address or routable interface.
Command Mode
EXEC
Command Syntax
show ipv6 neighbors [PORT][SOURCE][INFO_LEVEL]
Parameters
PORT Filters by interface through which neighbor is accessed. Options include:
no parameter all routed interfaces.
ethernete_num Ethernet interface specified by e_num.
loopbackl_num Loopback interface specified by l_num.
managementm_num Management interface specified by m_num.
port-channelp_num Port-channel interface specified by p_num.
vlanv_num VLAN interface specified by v_num.
VXLANvx_num VXLAN interface specified by vx_num.
SOURCE Filters by neighbor IPv6 address. Options include:
no parameter all IPv6 neighbors.
ipv6_addr IPv6 address of individual neighbor.
INFO_LEVEL amount of information that is displayed. Options include:
no parameter command displays the discovery cache for the specified interfaces.
summary command displays summary information only.
Example
This command displays the IPv6 neighbor discovery cache for IPv6 address fe80::21c:73ff:fe01:5fe1.
The show ipv6 route command displays IPv6 routing table entries that are in the Forwarding Information Base (FIB), including static routes, routes to directly connected networks, and dynamically learned routes. Multiple equal cost paths to the same prefix are displayed contiguously as a block, with the destination prefix displayed only on the first line.
The show running-config command displays all configured routes.
Command Mode
EXEC
Command Syntax
show ipv6 route [ADDRESS][ROUTE_TYPE][INFO_LEVEL]
Parameters
ADDRESS, when present, is always listed first. All other parameters can be placed in any order.
ROUTE_TYPE filters routes by specified protocol or origin.
no parameter all routing table entries.
aggregate entries for BGP aggregate routes.
bgp entries added through BGP protocol.
connected entries for routes to networks directly connected to the switch.
kernel entries appearing in Linux kernel but not added by EOS software.
isis entries added through IS-IS protocol.
ospf entries added through OSPF protocol.
static entries added through CLI commands.
INFO_LEVEL Filters entries by next hop connection.
no parameter filters routes whose next hops are directly connected.
detail displays all routes.
Examples
This command displays a route table entry for a specific IPv6 route.
switch> show ipv6 route fd7a:3418:52a4:fe18::/64
IPv6 Routing Table - 77 entries
Codes: C - connected, S - static, K - kernel, O - OSPF, B - BGP, R - RIP, A -
Aggregate
O fd7a:3418:52a4:fe18::/64 [10/20]
via fe80::21c:73ff:fe00:1319, Vlan3601
via fe80::21c:73ff:fe00:1319, Vlan3602
via fe80::21c:73ff:fe00:1319, Vlan3608
via fe80::21c:73ff:fe0f:6a80, Vlan3610
via fe80::21c:73ff:fe00:1319, Vlan3611
This example displays an IPv6 route with Forwarding Equivalency Class (FEC) with an IPv6 next hop and an IPv4 next hop route.
# show ipv6 route 2001:1::/64
VRF: default
Routing entry for 2001:1::/64
Source Codes:
C - connected, S - static, K - kernel, O3 - OSPFv3,
B - Other BGP Routes, A B - BGP Aggregate, R - RIP,
I L1 - IS-IS level 1, I L2 - IS-IS level 2, DH - DHCP,
NG - Nexthop Group Static Route, M - Martian,
DP - Dynamic Policy Route, L - VRF Leaked,
G - gRIBI, RC - Route Cache Route,
CL - CBF Leaked Route
B I 2001:1::/64 [200/0]
via 2001:2:0:40::2, Ethernet1
via 10.0.0.2, Ethernet3, backup
show ipv6 route age
The show ipv6 route age command displays the IPv6 route age to the specified IPv6 address or prefix.
This command displays the route age for the specified prefix.
switch> show ipv6 route 2001::3:0/11 age
IPv6 Routing Table - 74 entries
Codes: C - connected, S - static, K - kernel, O - OSPF, B - BGP, R - RIP, A -
Aggregate
C 2001::3:0/11 age 00:02:34
show ipv6 route host
The show ipv6 route host command displays all host routes in the IPv6 host forwarding table. Host routes are those whose destination prefix is the entire address (prefix =/128). Each displayed host route is labeled with its purpose:
F static routes from the FIB.
A routes to any neighboring host for which the switch has an ARP entry.
R routes defined because the IP address is an interface address.
Command Mode
EXEC
Command Syntax
show ipv6 route host
Example
This command displays all IPv6 host routes in the host forwarding table.
switch> show ipv6 route host
R - receive F - FIB, A - attached
F ::1 to cpu
A fee7:48a2:0c11:1900:400::1 on Vlan102
R fee7:48a2:0c11:1900:400::2 to cpu
F fee7:48a2:0c11:1a00::b via fe80::21c:73ff:fe0b:a80e on Vlan3902
R fee7:48a2:0c11:1a00::17 to cpu
F fee7:48a2:0c11:1a00::20 via fe80::21c:73ff:fe0b:33e on Vlan3913
F fee7:48a2:0c11:1a00::22 via fe80::21c:73ff:fe01:5fe1 on Vlan3908
via fe80::21c:73ff:fe01:5fe1 on Vlan3902
show ipv6 route interface
The show ipv6 route interface command displays routing table entries on a specified routed port.
Command Mode
EXEC
Command Syntax
show ipv6 route [ADDRESS] interfacePORT_NAME [INFO_LEVEL]
Parameters
ADDRESS, when present, is always listed first. All other parameters can be placed in any order.
PORT_NAME interfaces for which command displays status.
ethernet e_num Ethernet interface specified by e_num.
loopback l_num Loopback interface specified by l_num.
management m_num Management interface specified by m_num.
port-channel p_num Port-Channel Interface specified by p_num.
vlan v_num VLAN interface specified by v_num.
VXLAN vx_num VXLAN interface specified by vx_num.
INFO_LEVEL Filters entries by next hop connection.
no parameter filters routes whose next hops are directly connected.
detail displays all routes.
Example
This command displays the IPv6 routes in interface ethernet 8.
switch> show ipv6 route interface ethernet 8
IPv6 Routing Table - 77 entries
Codes: C - connected, S - static, K - kernel, O - OSPF, B - BGP, R - RIP, A -
Aggregate
O fd7a:629f:63af:1232::/64 [150/11]
via fe80::823c:73ff:fe00:3640, Ethernet8
O fd7a:629f:63af:4118::/64 [150/11]
via fe80::823c:73ff:fe00:3640, Ethernet8
O fd7a:629f:63af:4119::/64 [150/11]
via fe80::823c:73ff:fe00:3640, Ethernet8
O fd7a:629f:63af:411a::/64 [150/11]
via fe80::823c:73ff:fe00:3640, Ethernet8
O fd7a:629f:63af:fe78::/64 [150/11]
via fe80::823c:73ff:fe00:3640, Ethernet8
C fd7a:629f:63af:fe88::/64 [0/1]
via ::, Ethernet12
O fd7a:629f:63af:fe8c::/64 [10/20]
via fe80::21c:73ff:fe00:3640, Ethernet8
C fe80:0:40::/64 [0/1]
via ::, Ethernet8
show ipv6 route match tag
The show ipv6 route match tag command displays the route tag assigned to the specified IPv6 address or prefix. Route tags are added to static routes for use by route maps.
This command displays the route tag for the specified prefix.
switch> show ipv6 route 2001:0DB8::/64 match tag
IPv6 Routing Table - 74 entries
Codes: C - connected, S - static, K - kernel, O3 - OSPFv3, B - BGP, R - RIP, A B
- BGP Aggregate, I L1 - IS-IS level 1, I L2 - IS-IS level 2, DH - DHCP, NG -
Nexthop Group Static Route, M - Martian, DP - Dynamic Policy Route, L - VRF Leaked
C 2001:0DB8::/64 tag 0
show ipv6 route summary
The show ipv6 route summary command displays the information about the IPv6 routing table.
Command Mode
EXEC
Command Syntax
show ipv6 route summary
Example
This command displays the route source and the corresponding number of routes in the IPv6 routing table.
switch> show ipv6 route summary
Route Source Number Of Routes
------------------ ----------------
connected 2
static 0
ospf 5
bgp 7
isis 0
internal 1
attached 0
aggregate 2
Total Routes 17
show platform fap mroute ipv6
The show platform fap mroute ipv6 command enables PIM Sparse Mode (PIM-SM) and IGMP (router mode) on the configuration mode interface.
Command Mode
EXEC
Command Syntax
show platform fap mroute ipv6
Example
This command enables PIM sparse mode on VLAN 4 interface.
The show rib route ipv6 command displays a list of IPv6 Routing Information Base (RIB) routes.
Command Mode
EXEC
Command Syntax
show rib route ipv6 [vrfvrf_name] [PREFIX][ROUTE TYPE]
Parameters
vrfvrf_name displays RIB routes from the specified VRF.
PREFIX displays routes filtered by the specified IPv6 information. Options include:
ipv6_address displays RIB routes filtered by the specified IPv6 address.
ipv6_subnet_mask displays RIB routes filtered by the specified IPv6 address and subnet mask.
ipv6_prefix displays RIB routes filtered by the specified IPv6 prefix.
ROUTE TYPE displays routes filtered by the specified route type. Options include:
bgp displays RIB routes filtered by BGP.
connected displays RIB routes filtered by connected routes.
dynamicPolicy displays RIB routes filtered by dynamic policy routes.
host displays RIB routes filtered by host routes.
isis displays RIB routes filtered by ISIS routes.
ospf displays RIB routes filtered by OSPF routes.
ospf3 displays RIB routes filtered by OSPF3 routes.
reserved displays RIB routes filtered by reserved routes.
route-input displays RIB routes filtered by route-input routes.
static displays RIB routes filtered by static routes.
Examples
This command displays IPv6 RIB BGP routes.
switch# show rib route ipv6 bgp
VRF name: default, VRF ID: 0xfe, Protocol: bgp
Codes: C - Connected, S - Static, P - Route Input
B - BGP, O - Ospf, O3 - Ospf3, I - Isis
> - Best Route, * - Unresolved Nexthop
L - Part of a recursive route resolution loop
B 2001:10:1::/64 [200/42]
via 2001:10:1::100 [0/1]
via Ethernet1, directly connected
>B 2001:10:100::/64 [200/200]
via 2001:10:1::100 [0/1]
via Ethernet1, directly connected
>B 2001:10:100:1::/64 [200/0]
via 2001:10:1::100 [0/1]
via Ethernet1, directly connected
>B 2001:10:100:2::/64 [200/42]
via 2001:10:1::100 [0/1]
via Ethernet1, directly connected
This command displays IPv6 RIB connected routes.
switch# show rib route ipv6 connected
VRF name: default, VRF ID: 0xfe, Protocol: connected
Codes: C - Connected, S - Static, P - Route Input
B - BGP, O - Ospf, O3 - Ospf3, I - Isis
> - Best Route, * - Unresolved Nexthop
L - Part of a recursive route resolution loop
>C 2001:10:1::/64 [0/1]
via 2001:10:1::102, Ethernet1
>C 2001:10:2::/64 [0/1]
via 2001:10:2::102, Ethernet2
>C 2001:10:3::/64 [0/1]
via 2001:10:3::102, Ethernet3
Dynamic Host Configuration Protocol (DHCP) for IPv4 and IPv6 dynamically assign network
configurations to end hosts without statically configure an IP address for each device
on the network. However, the underlying architecture and feature sets require different
configurations on the switch.
DHCP IPv4
DHCPv4 acts as an extension of the older BOOTP protocol and relies heavily on Layer 2 broadcasts to
assign IPv4 addresses to a new IPv4 client on the network. The core mechanism of DHCPv4, also known as
DORA, has the following four step transaction:
Discover (Broadcast) - The client sends out messages to 255.255.255.255
looking for DHCP servers on the network.
Offer (Unicast/Broadcast) - A listening DHCP server returns an IPv4
address to the client.
Request (Broadcast) - The client broadcasts an acceptance message to the
DHCP server and rejects unselected DHCP servers.
Acknowledge (Unicast/Broadcast) - The DHCP server finalizes the lease and
sends the client a subnet mask, gateway, and DNS servers.
DHCPv4 has the following key features:
Option 82 (Relay Agent Information) - Allows intermediates switches
to inject their physical port data (Circuit ID) into the client broadcast
messages before forwarding the message to a central DHCP server.
Granular Options - Relies on highly specific integer options
including Option 43 for Vendor-specific data such as Wireless Controller
IPs, Option 150 for TFTP servers, and Option 67 for bootfiles.
Default Gateway Assignment - The DHCP server provides the client with
a default gateway (Option 3).
DHCP IPv6
DHCPv6 eliminates broadcast traffic and operates over IPv6 Multicast and works with ICMPv6 Neighbor
Discovery. Instead of DORA, DHCPv6 uses a four step transaction targeting specific multicast groups, such
as ff02::1:2, the All-DHCP-Relay-Agents-and-Servers address:
Solicit (Multicast) - The client sends messages on the network looking
for a server.
Advertise (Unicast) - The server indicates availability and
preference.
Request (Unicast) - The client requests specific parameters from the
selected server.
Reply (Unicast) - The server confirms the lease and configuration.
DHCPv6 has the following key features:
Router Advertisements (RA) Dependency - A DHCPv6 client does not send
a Solicit message unless a local router first sends an ICMPv6 RA with the
M-Flag, Managed Configuration, or O-Flag, Other Configuration, set to 1. The
router dictates how the client receives an IP address.
Stateless vs. Stateful
Stateful (M-Flag) - The DHCPv6 server tracks leases and hands
out the actual IPv6 addresses.
Stateless (O-Flag)- The client uses Stateless Address
Autoconfiguration (SLAAC) to generate an IPv6 address and only uses
the DHCPv6 server to obtain extra details such as DNS servers or
domain names.
Prefix Delegation (DHCPv6-PD) - A downstream router requests an
entire routed subnet prefix from an upstream ISP server to assign to local
VLANs.
Unified URIs (Option 59) - DHCPv6 does not use legacy options such as
separating TFTP IPs and filenames in favor of consolidated URL strings.
Key Architectural Differences
Feature
DHCPv4
DHCPv6
Transport Protocol
UDP Ports 67 (Server) and 68 (Client)
UDP Ports 547 (Server) and 546 (Client)
Initial Discovery
Layer 2 Broadcast (255.255.255.255)
Layer 3 Multicast (ff02::1:2)
Default Gateway
Provided by the DHCP Server
Provided by ICMPv6 Router Advertisements
Lease Tracking
Always Stateful
Can be Stateful and Stateless
Hardware ID
Relies on the physical MAC Address
Relies on a generated DUID (DHCP Unique Identifier)
DHCP Server
The router with DHCP Server enabled acts as a server that allocates and delivers
network addresses with desired configuration parameters to its hosts.
The DHCP server is based on ISC Kea.
The router with an DHCP Server enabled acts as a server that allocates and delivers
network addresses with desired configuration parameters to its hosts.
DHCP Server support includes:
DHCPv4 support includes:
Configurable on different interfaces: Routed, VLAN, LAG, Sub-interface, and LAG
Sub-interface.
Configurable lease time for allocated network addresses.
Configurable DNS domain.
Configurable DNS servers.
Configurable subnets with parameters:
Default gateway
DNS servers
Ranges
Lease time
Additional features for DHCPv4 include:
Configurable TFTP server
Configurable TFTP bootfile
Additional features for DHCPv4 includes:
Configurable Vendor options with sub options
Configurable sub option types include: IPv4 address, array of IPv4 addresses,
and string
TFTP bootfile now supports an URI
Additional features for DHCPv4 include a configurable static IP address for exclusive use
by a given client, based on the client’s MAC address.
Example deployment:
DHCP Server on an aggregation switch, via VXLAN tunnels.
Figure 1. DHCP Server Example Deployment
Configuring DHCP Servers
Global DHCP server options are configured per address family and apply to all
subnets. Access the commands in the DHCP Server Configuration Mode.
To enter the DHCP server global configuration mode, use the following
commands:
switch# configure
switch(config)# dhcp server
switch(config-dhcp-server)#
To disable the DHCP
server:
switch(config-dhcp-server)# disabled
Use the following commands to configure the DNS servers. Only two servers can be
configured globally per address
family.
switch(config-dhcp-server)# dns server ipv4 192.0.2.4 192.0.2.5
switch(config-dhcp-server)# dns server ipv6 2001:db8:0:10::53 2001:db8:0:10::5353
The following commands configure the domain names for allocated IP addresses. For
example, add a domain with the name podV4.example.com for DHCPv4 and a domain
with the name podV6.example.com for
DHCPv6.
switch(config-dhcp-server)# dns domain name ipv4 podV4.example.com
switch(config-dhcp-server)# dns domain name ipv6 podV6.example.com
The following commands configure lease time for the allocated IP addresses. For
example, configure the lease time as one (1)
day.
switch(config-dhcp-server)# lease time ipv4 1 days 0 hours 0 minutes
switch(config-dhcp-server)# lease time ipv6 1 days 0 hours 0 minutes
The following command configures the TFTP Server-Name. The server can be in the form
of either an IPv4 or IPv6 address or a fully qualified domain name. For example,
configure the TFTP server with the IPv4 address, 192.0.2.6 and an TFTP
server with the IPv6 address,
2601:600:cb02:d070:14b7:6ad0:bedb:ef3:
switch(config-dhcp-server)# tftp server option 66 ipv4 192.0.2.6
The following command configures the TFTP Servers.
switch(config-dhcp-server)# tftp server option 150 ipv4 192.0.2.6 192.0.2.7
The following command configures the TFTP Server Bootfile-Name for IPv4 and IPv6:
switch(config-dhcp-server)# tftp server file ipv4 bootfile.conf
switch(config-dhcp-server)# tftp server file ipv6 bootfile.conf
The following command configures Vendor specific option. To enter the Vendor Option
Configuration Mode from the DHCP Server Configuration mode, specify a vendor class
identifier, only available in DHCPv4. For example, Vendor option for clients with vendor
class identifier
vendorClassIDA.
The following command configures default. If you do not configure the
default, the DHCP Server sends the configured Vendor option to
clients requesting a Vendor option with a vendor class identifier that does not match
any configured Vendor
option.
The following command configures suboptions for the Vendor. The configuration sends
the resulting Vendor option in a hexadecimal format to the desired client. The output
displays aVendor option with a suboption with IPv4 address 192.0.2.8, for clients with
the vendor class identifier vendorClassIDA, resulting in Vendor
option
1:4:c0:0:2:8.
Sub option number is 1
Length of the Data is 4
Data is c0:0:2:8
dhcp server
vendor-option ipv4 vendorClassIDA
sub-option 1 type ipv4-address data 192.0.2.8
The following command configures the Vendor option with IPv4 addresses 192.0.2.8 and
192.0.2.9, for clients with the vendor class identifier
vendorClassIDA, resulting in the Vendor option
fe:8:c0:0:2:8:c0:0:2:9.
switch(config-dhcp-server)# vendor-option ipv4 vendorClassIDA sub-option 254 type array ipv4-address data 192.0.2.8 192.0.2.9
The following command configures Vendor option with a string “vendor”, for all
clients whose vendor class identifier does not match any configured Vendor option,
resulting in Vendor option
1e:3:46:4f:4f..
switch(config-dhcp-server)# vendor-option ipv4 default sub-option 30 type string data "vendor"
The following command sets up Vendor option holding two suboptions, suboption 1 holds
the IPv4 address 192.0.2.8, and suboption 2 holds a string “vendor”, for all clients
whose vendor class identifier does not match any configured Vendor option, resulting in
Vendor option
1:4:c0:0:2:8:2:3:46:4f:4f.
switch(config-dhcp-server)# vendor-option ipv4 default sub-option 1 type ipv4-address data 192.0.2.8 sub-option 2 type string data “vendor"
Configuring DHCP Server Subnets
DHCP Server settings can also be configured per subnet and
overrides the DHCP Server global mode configurations. There can be
multiple subnets configured, but they must not overlap. EOS disables
overlapping subnets.
The following command enters DHCP Server subnet mode under the IPv4 address
family.
switch# config
switch(config)# dhcp server
switch(config-dhcp-server)# subnet 192.0.2.0/32
The following command configures the name of the subnet. For example, name subnetv4
for
DHCPv4.
switch(config-dhcp-subnet-ipv4)# name subnetv4
The following command configures range of IP addresses of the subnet. The range must
be within the subnet mask, otherwise the subnet becomes
disabled.
switch(config-dhcp-subnet-ipv4)# range 192.0.2.100 192.0.2.199
The following command configures the DNS servers for a subnet. Configure up to 2
servers per
subnet.
switch(config-dhcp-subnet-ipv4-range)# dns server 192.0.2.1 192.0.2.10
The following command configures the lease time for allocated IP addresses of the
subnet.
switch(config-dhcp-subnet-ipv4)# lease time ipv4 3 days 0 hours 0 minutes
The following command configures the default-gateway for a subnet.
The following command configures the TFTP Server-Name for a subnet. The server can be
in the form of either an IPv4 address or a fully qualified domain name, but can only
be configured for
DHCPv4.
switch(config-dhcp-subnet-ipv4)# tftp server option 66 subnet-tftp.example.com
The following command configures a list of TFTP servers. The server can only be in
the form of an IP address, but can only be configured for
DHCPv4.
switch(config-dhcp-subnet-ipv4)# tftp server option 150 192.0.2.6 192.0.2.7
The following command configures the TFTP server Bootfile-Name for a subnet, but can
only be configured for
DHCPv4.
switch(config-dhcp-subnet-ipv4)# tftp server file subnet-bootfile.conf
Example DHCP Server Subnets
Configuration
switch# config
switch(config)# dhcp server
switch(config-dhcp-server)# subnet 192.0.2.0/32
switch(config-dhcp-subnet-ipv4)# name subnetv4
switch(config-dhcp-subnet-ipv4)# range 192.0.2.100 192.0.2.199
switch(config-dhcp-subnet-ipv4-range)# dns server 192.0.2.1 192.0.2.10
switch(config-dhcp-subnet-ipv4)# lease time ipv4 3 days 0 hours 0 minutes
switch(config-dhcp-server)# subnet 192.0.2.0/32
switch(config-dhcp-subnet-ipv4)# default-gateway 192.0.2.3
switch(config-dhcp-subnet-ipv4)# tftp server option 66 subnet-tftp.example.com
switch(config-dhcp-subnet-ipv4)# tftp server option 150 192.0.2.6 192.0.2.7
switch(config-dhcp-subnet-ipv4)# tftp server file subnet-bootfile.conf
The following command configures a static IP address for exclusive use by a client.
Enter the DHCP Server Subnet Configuration Mode,
(config-dhcp-mac-address-ipv4) from and specify the client MAC
Address. The IP address must not be used by another client. Only DHCPv4 addresses
allowed for this configuration.
High Availability (HA) provides a mechanism to add redundancy to DHCP servers using a
heartbeat to monitor the communication state with the peer server, and synchronize lease
information with other DHCP servers. EOS supports hot stand-by HA mode.
In the hot stand-by HA mode, the primary server acts as the sole responder to DHCP
requests while the secondary server receives updates from the primary DHCP server and
maintains a synchronized lease database. When the secondary DHCP server detects the
primary DHCP status as down, the secondary DHCP server responds to DHCP requests until
the primary DHCP server becomes available.
Each DHCP server in the HA setup must have an HA role, for example, hot stand-by mode
requires a primary and secondary DHCP server configuration. To allow communication
between the HA servers, each device must connect with another device through an HA peer
link. Each interface contains an IP address used by the peer server to identify the
local server through port 8000.
DHCPv4 and DHCPv6 apply the same configuration to HA.
Configuring DHCP Server High Availability
To configure DHCP Server HA, enter the DHCP HA Configuration Mode:
Optionally, configure the period for sending heartbeats in seconds. This has a default value of 10 seconds. Use the following command
to add a heartbeat of 60 seconds:
Configure the timeout value for the heartbeat as 600 seconds. The heartbeat timeout determines how long the primary server waits for a heartbeat
response before determining the status of the peer server as down.
For hot stand-by HA, both primary and secondary DHCP servers must be configured as active. Use the following command to configure
the local DHCP server as the primary DHCP server:
switch(config-dhcp-server-ha)# role primary
switch(config-dhcp-server-ha)#
To configure a peer server, add the IPv4 or IPv6 address. In this configuration, use the IPv4 address, 10.0.2.2:
To set the peer DHCP server role as secondary, use the following command:
switch(config-dhcp-server-ha-10.0.2.2)# role secondary
switch(config-dhcp-server-ha-10.0.2.2)#
Displaying DHCP Information
Show DHCP Server Information
The following command displays the DHCP Server
information.
switch# show dhcp server ipv4
IPv4 DHCP Server is active
Debug log is enabled
DNS server(s): 192.0.2.4 192.0.2.5
DNS domain name: podV4.example.com
Lease duration: 1 days 0 hours 0 minutes
TFTP server: 192.0.2.6 (Option 66)
192.0.2.6 192.0.2.7 (Option 150)
TFTP file: https://This email address is being protected from spambots. You need JavaScript enabled to view it.:123/example/one
Active Leases: 1
IPv4 DHCP interface status:
Interface Status
-------------------------------------------------
Ethernet1 Inactive (Could not determine VRF)
Ethernet2 Inactive (Not in default VRF)
Ethernet3 Inactive (Kernel interface not created yet)
Ethernet4 Inactive (Not up)
Ethernet5 Inactive (No IP address)
Ethernet6 Inactive (No Link Local address)
Ethernet7 Inactive (DHCP relay is configured for this interface)
Ethernet8 Inactive (DHCP relay is always on)
Ethernet9 Active
Vendor information:
Vendor ID: default
Sub-options Data
---------------- ----------------
1 192.0.2.0
2 “vendor”
Vendor ID: vendorClassIDA
Sub-options Data
---------------- --------------------
254 192.0.2.8, 192.0.2.9
Subnet: 192.0.2.0/24
Subnet name: subnetFooV4
Range: 192.0.2.100 to 192.0.2.199
DNS server(s): 192.0.2.1 192.0.2.10
Lease duration: 3 days 0 hours 0 minutes
Default gateway address: 192.0.2.3
TFTP server:
subnet-tftp.example.com (Option 66)
192.0.2.6 192.0.2.7 (Option 150)
TFTP boot file: subnet-bootfile.conf
Active leases: 1
Reservations:
MAC address: 1a1b.1c1d.1e1f
IPv4 address: 192.0.2.201
MAC address: 2a2b.2c2d.2e2f
IPv4 address: 192.0.2.150
Displaying Disabled Subnets
When a subnet becomes disabled, the show dhcp server
[ipv4|ipv6] output displays the disabled message under
Disabled reason(s). None of the disabled subnets have active
leases. Currently, the output displays only two disabled reasons.
switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
Interface Status
-------------------------------------------------
Ethernet1 Active
Subnet: 10.0.0.0/24 (Subnet is disabled)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0
Disabled reason(s):
Overlapping subnets: 10.0.0.0/8
Subnet: 10.0.0.0/8 (Subnet is disabled)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.5.5.5
Default gateway address: 10.0.0.3
Active leases: 0
Disabled reason(s):
Overlapping subnets: 10.0.0.0/24
For Overlapping ranges:
switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
Interface Status
-------------------------------------------------
Ethernet1 Active
Subnet: 10.0.0.0/8 (Subnet is disabled)
Range: 10.0.0.1 to 10.0.0.10
Range: 10.0.0.9 to 10.0.0.12
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0
Disabled reason(s):
Overlapping range: 10.0.0.9 to 10.0.0.12
E.g. Duplicate static IP address reservation:
Subnet: 10.0.0.0/8 (Subnet is disabled)
Subnet name:
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.5.5.5
Default gateway address: 10.0.0.3
Active leases: 0
Reservations:
MAC address: 1a1b.1c1d.1e1f
IPv4 address: 10.0.0.11
MAC address: 2a2b.2c2d.2e2f
IPv4 address: 10.0.0.11
Disabled reason(s):
Duplicate IPv4 address reservation: 10.0.0.11
For DHCPv6, Direct and Relay indicates that the DHCP
Server accepts broadcast and relayed
messages.
switch# show dhcp server ipv6
IPv6 DHCP server is active
Debug log is enabled
DNS server(s): fe80::6
DNS domain name: aristanetworks.example.com
Lease duration: 1 days 3 hours 30 minutes
Active leases: 0
IPv6 DHCP interface status:
Interface Status
--------------- ------
Ethernet1 Active
Ethernet3 Active
Subnet: fe80::/10
Subnet name: foo
Range: fe80::1 to fe80::3
DNS server(s): fe80::4 fe80::5
Direct: Inactive (Multiple interfaces match this subnet: Ethernet1 Ethernet3)
Relay: Active
Active leases: 0
For DHCPv6, a subnet may match only one interface and vice versa. Otherwise the
subnet is disabled and no lease assigned for that
subnet.
interface Ethernet1
no switchport
ipv6 address 2001:db8:0:10::1/64
dhcp server ipv6
interface Ethernet3
no switchport
ipv6 address 2001:db8:0:11::1/64
dhcp server ipv6
dhcp server
subnet 2001:db8::/56
The following enables DHCPv6 on Ethernet1 (with address fc00::1/7 and fe80::1/10),
and then configures subnets fc00::/7 and fe80::/64 for
DHCPv6.
interface Ethernet1
no switchport
ipv6 address fc00::1/7
ipv6 address fe80::1/64 link-local
dhcp server ipv6
dhcp server
subnet fc00::/7
subnet fe80::/64
#show dhcp server ipv6
IPv6 DHCP server is active
DNS server(s): fc00::2
DNS domain name: aristanetworks.example.com
Lease duration: 1 days 3 hours 30 minutes
Active leases: 0
IPv6 DHCP interface status:
Interface Status
--------------- ------
Ethernet1 Active
Subnet: fc00::/7
Subnet name: foo
Range: fc00::1 to fc00::5
DNS server(s): fc00::6 fc00::8
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
Active leases: 0
Subnet: fe80::/64
Subnet name: subnetBarV6
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
Active leases: 0
Leases
The following output displays the IP addresses allocated by the DHCP Server with the
show dhcp server [ipv4|ipv6] leases command. It
also displays the expected end time for the address, the time when the address is
assigned, and the equivalent MAC
address.
switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a
2000:0:0:40::b
End: 2019/06/20 18:06:33 UTC
Last transaction: 2019/06/20 14:36:33 UTC
MAC address: 165a.a86d.ffac
DHCP Server Show Commands
Use the show dhcp server command to display DHCP server
information.
DHCPv4 display
example:
switch# show dhcp server ipv4
IPv4 DHCP Server is active
Debug log is enabled
DNS server(s): 10.2.2.2
DNS domain name: domainFoo
Lease duration: 1 days 0 hours 0 minutes
TFTP server:
serverFoo (Option 66)
10.0.0.3 (Option 150)
TFTP file: fileFoo
Active Leases: 1
IPv4 DHCP interface status:
Interface Status
-------------------------------------------------
Ethernet1 Inactive (Could not determine VRF)
Ethernet2 Inactive (Not in default VRF)
Ethernet3 Inactive (Kernel interface not created yet)
Ethernet4 Inactive (Not up)
Ethernet5 Inactive (No IP address)
Ethernet6 Active
Vendor information:
Vendor ID: default
Sub-options Data
---------------- ----------------
1 192.0.2.0, 192.0.2.1
Vendor ID: vendorFoo
Sub-options Data
---------------- -----------
2 192.0.2.2
3 “Foo”
Subnet: 10.0.0.0/8
Subnet name: subnetFoo
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.1.1.1 10.2.2.2
Lease duration: 3 days 3 hours 3 minutes
Default gateway address: 10.0.0.3
TFTP server:
subnetServerFoo (Option 66)
10.0.0.4 (Option 150)
TFTP boot file: subnetFileFoo
Active leases: 1
Reservations:
MAC address: 1a1b.1c1d.1e1f
IPv4 address: 10.0.0.1
MAC address: 2a2b.2c2d.2e2f
IPv4 address: 10.0.0.2
For DHCPv6, there are two additional fields in subnet information output,
Direct field and the
Relay field. These two fields specify if
the DHCP Server is accepting broadcast or relayed messages.
The
Direct field displays
Active when the subnet matches the
interface with DHCPv6 configured. This indicates the server is accepting broadcast
messages.
The Direct field
displays Inactive when there is another existing subnet already matching
the interface, or when the subnet matches more than one DHCP configured
interface.
Examples of outputs for the DHCPv6 show dhcp
server command:
In this example, DHCPv6 is configured
with subnet fe80::/10 while being enabled on
Ethernet1 with address
fe80::1/64 and on
Ethernet3 with address
fe80::2/64.
switch# show dhcp server ipv6
IPv6 DHCP server is active
Debug log is enabled
DNS server(s): fe80::6
DNS domain name: testaristanetworks.com
Lease duration: 1 days 3 hours 30 minutes
Active leases: 0
IPv6 DHCP interface status:
Interface Status
--------------- ------
Ethernet1 Active
Ethernet3 Active
Subnet: fe80::/10
Subnet name: foo
Range: fe80::1 to fe80::3
DNS server(s): fe80::4 fe80::5
Direct: Inactive (Multiple interfaces match this subnet: Ethernet1 Ethernet3)
Relay: Active
Active leases: 0
This example illustrates when multiple subnets match an interface. In this
example, DHCPv6 is configured with subnets fc00::/7 and
fe80::/10 while being enabled on Ethernet1 with
address fe80::1/10 and
fc00::1/7.
switch# show dhcp server ipv6
IPv6 DHCP server is active
DNS server(s): fc00::2
DNS domain name: testaristanetworks.com
Lease duration: 1 days 3 hours 30 minutes
Active leases: 0
IPv6 DHCP interface status:
Interface Status
--------------- ------
Ethernet1 Active
Subnet: fc00::/7
Subnet name: foo
Range: fc00::1 to fc00::5
DNS server(s): fc00::6 fc00::8
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
Active leases: 0
Subnet: fe80::/10
Subnet name: bar
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
Active leases: 0
When disabled, the show dhcp server command displays
the disable message with a reason. The number of active leases of the disabled
subnets will be 0. In this example, there are overlapping
subnets.
switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
Interface Status
-------------------------------------------------
Ethernet1 Active
Subnet: 10.0.0.0/24 (Subnet is disabled - overlapping subnet 10.0.0.0/8)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0
Subnet: 10.0.0.0/8 (Subnet is disabled - overlapping subnet 10.0.0.0/24)
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0
In this example, the display output shows overlapping
ranges.
switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
Interface Status
-------------------------------------------------
Ethernet1 Active
Subnet: 10.0.0.0/8 (Subnet is disabled - range 10.0.0.9-10.0.0.12 overlaps with an existing pool)
Range: 10.0.0.1 to 10.0.0.10
Range: 10.0.0.9 to 10.0.0.12
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0
This example shows duplicate static IP address
reservation.
Subnet: 10.0.0.0/8 (Subnet is disabled - ipv4-address 10.0.0.11 is reserved more than once)
Subnet name:
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0
Reservations:
MAC address: 1a1b.1c1d.1e1f
IPv4 address: 10.0.0.11
MAC address: 2a2b.2c2d.2e2f
IPv4 address: 10.0.0.11
Use the show dhcp server leases command to display
detailed information about the IP addresses allocated by the DHCP Server (including
the IP address, the expected end time for that address, the time when the address is
handed out, and the equivalent MAC
address).
switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a
2000:0:0:40::b
End: 2019/06/20 18:06:33 UTC
Last transaction: 2019/06/20 14:36:33 UTC
MAC address: 165a.a86d.ffac
DHCP Relay Global Configuration Mode
Configure DHCP Relay using the dhcp
relay command in the global configuration mode. The command
places the switch in DHCP Relay mode and allows the configuration of DHCP Relay on several
interfaces with a single command. The configuration entered in the DHCP Relay global
configuration mode can be overridden by equivalent interface specific commands.
Examples
The dhcp relay command places the switch in the DHCP Relay
configuration
mode.
Specify the IP address of the default DHCP or DHCPv6 Server. Multiple IP addresses can be
specified and DHCP requests forward to all specified helper addresses. Configure an
ip helper-addressIP_Address under each desired routing interface.
Use the following commands to forward DHCP broadcast packets received on interface
Ethernet1 and Vlan2 to DHCP
servers at 10.0.0.1, 10.0.0.2, and to
hostname
DefaultDHCPHostname:
switch(config)# interface ethernet1
switch(config-if-Et1)# no switchport
switch(config-if-Et1)# ip address 192.168.1.1/16
switch(config)# interface vlan2
switch(config-if-Et1)# ip address 172.16.1.1/16
switch(config)# dhcp relay
switch(config-dhcp-relay)# server 10.0.0.1
switch(config-dhcp-relay)# server 10.0.0.2
switch(config-dhcp-relay)# server DefaultDHCPHostname
Use the following commands to forward DHCPv6 broadcast packets received on interface
ethernet1 to a DHCPv6 Server at
fc00::3.
switch(config)# interface ethernet1
switch(config-if-Et1)# no switchport
switch(config-if-Et1)# ipv6 address fc00::1/10
switch(config)# dhcp relay
switch(config-dhcp-relay)# server fc00::3
The configuration points a routed interface to the specified DHCP and DHCPv6 server, if the
configuration meets following criteria:
The default VRF contains the routed interface.
The interface has an IP address configured.
The configuration does not occur on a Management or a Loopback interface.
Use the following commands to remove the default DHCPv4 or DHCPv6
Server.
switch(config)# dhcp relay
switch(config-dhcp-relay)# no server 10.0.0.1
switch(config-dhcp-relay)# no server 10.0.0.2
switch(config-dhcp-relay)# no server DefaultDHCPHostname
switch(config-dhcp-relay)# no server fc00::3
To override the default DHCP Server on an interface, the parameter,ip
helper-addressIP_Address, must be used.
Use the following commands to forward a DHCP broadcast packet received on interface
Ethernet1 to DHCP Servers at 10.0.0.1,
10.0.0.2 and hostname
DefaultDHCPHostname, but VLAN2 broadcasts packets to the
DHCP Server at 10.0.0.3
only.
switch(config)# interface ethernet 1
switch(config-if-Et1)# no switchport
switch(config-if-Et1)# ip address 192.168.1.1/16
switch(config)# interface vlan2
switch(config-if-Et1)# ip address 172.16.1.1/16
switch(config-if-Et1)# ip helper-address 10.0.0.3
switch(config)# dhcp relay
switch(config-dhcp-relay)# server 10.0.0.1
switch(config-dhcp-relay)# server 10.0.0.2
switch(config-dhcp-relay)# server DefaultDHCPHostname
To override the default DHCPv6 Server on an interface, the parameter, ipv6
helper-addressIPv6_Address> must be used.
Use the following commands to forward a DHCPv6 broadcast packet received on interface
Ethernet1 to DHCPv6 Server at fc00::3, and VLAN2 broadcasts
packets to DHCPv6 Server at fc00::4
only.
Configure DHCP Relay for IPv4 unnumbered interfaces by adding a DHCP IPv4 helper address
and configuring the vendor option.
Use the information option command to enter DHCP Relay
Information Option Configuration
Mode:
switch(config)# dhcp relay
switch(config-dhcp-relay)# information option
switch(config-information-option)# vendor-option
Configure Option-37 in DHCPv6 Relay to include the host name of the switch along with MAC
address and interface name in the remote id of the option. It requires the
remote-id format to be specified in the configuration mode.
Use the following command to add the
remote-id:
switch(config)# ipv6 dhcp relay option remote-id format %m:%h:%p
You can disable DHCP or DHCPv6 Relay functionality from a specific interface. This disables
both DHCP Relay global and interface mode configurations.
Use the following command to disable DHCP Relay functionality
only.
Virtual Router Redundancy Protocol (VRRP) and DHCP Relay
Virtual Router Redundancy Protocol (VRRP) provides high availability for the default
gateway within a broadcast domain. In VRRP-based deployments with DHCP Relay, each
participating router forwarded DHCP requests using its interface IP address, which
resulted in duplicate relay requests, duplicate DHCP server ACKs, and increased
control-plane noise. This feature solves these issues by making DHCP relay processing
VRRP state-aware.
After disabling backup requests, only the VRRP Master router performs DHCP relay
processing, ensuring a single authoritative relay agent per subnet. Routers in the
Backup state suppress all DHCP relay processing and drop the requests, reducing
control-plane overhead. When VRRP failovers, the newly elected Master automatically
assumes relay responsibilities.
The fhrp parameter in DHCP Relay configures the relay agent to
use the First Hop Redundancy Protocol (FHRP) virtual IP address as the Gateway IP
address in relayed DHCP request packets instead of the interface physical IP
address.
To configure this feature, use the following
commands:
You must configure VRRP as active on the respective interfaces before enabling FHRP and checking the VRRP state before relaying DHCP packets.
On a master router, the configuration relays DHCP packets, and on a backup router, the configuration drops DHCP packets. Be sure to apply the configuration
consistently across both master and backup routers.
Displaying DHCP Relay
The show ip dhcp relay command displays all the
interfaces enabled with DHCP Relay and the server configured on these interfaces.
Example
switch# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCPv6 Relay Link-layer Address Option (79) is disabled
DHCPv6 Relay Remote ID (Option 37) encoding format: MAC address:interface ID
DHCP Smart Relay is disabled
Default L3 interface DHCP servers:
DHCPv4 servers: 10.0.0.1
10.0.0.2
DefaultDHCPHostname
DHCPv6 servers: fc00::3
Interface: Ethernet1
DHCP Smart Relay is disabled
DHCPv6 all subnet relaying is disabled
Using default DHCPv4 servers
Using default DHCPv6 servers
Interface: Ethernet2
DHCP Smart Relay is disabled
DHCPv6 all subnet relaying is disabled
Using default DHCPv4 servers
DHCPv6 servers: fc00::4
Interface: Vlan2
DHCP Smart Relay is disabled
DHCPv6 all subnet relaying is disabled
DHCPv4 servers: 11.0.0.3
DHCPv6 servers: fc00::4
Interface: Vlan3
DHCP Smart Relay is disabled
DHCPv6 all subnet relaying is disabled
DHCPv4 Relay is disabled
DHCPv6 Relay is disabled
Use the show ip dhcp relay command to display DHCP Relay for unnumbered
interfaces:
switch# show ip dhcp relay
DHCP Relay Option (82) is enabled
DHCP Relay vendor-specific suboption (9) under information option (82)
DHCP Relay Across VRF
The EOS DHCP relay agent supports
forwarding of DHCP requests to DHCP servers located in a different VRF
to the DHCP client interface VRF. In order to enable VRF support for
the DHCP relay agent, Option 82 (DHCP Relay Agent Information Option)
must first be enabled. The DHCP relay agent uses Option 82 to pass client
specific information to the DHCP server.
These sections describe DHCP Relay across VRF features:
The DHCP relay agent inserts Option 82 information into the DHCP forwarded request, which
requires the DHCP server belongs to a network on an interface, and that interface
belongs to a different VRF than the DHCP client interface. Option 82 information
includes the following:
VPN identifier - The VRF name for the ingress interface of the DHCP
request, inserted as sub-option 151.
Table 1. VPN Identifier
SubOpt
Len
ASCII VRF Identifier
151
7
V
R
F
N
A
M
E
Link selection - The subnet address of the interface that receives the
DHCP request, inserted as sub-option 5. After enabling the DHCP smart relay, the
link selection fills with the subnet of the active address. The relay agent sets
the Gateway IP address (gIPaddr) to its IP address so that DHCP messages can be
routed over the network to the DHCP server.
Table 2. Link Selection
SubOpt
Len
Subnet IP Address
5
4
A1
A2
A3
A4
Server identifier override - The primary IP address of the interface that
receives the DHCP request, inserted as sub-option 11. After enabling the DHCP
smart relay, the server identifier fills with the active address, one of the
primary or secondary addresses chosen by smart relay mechanism.
Table 3. Link Selection
SubOpt
Len
Overriding Server Identifier
Address
11
4
B1
B2
B3
B4
VSS control suboption as suboption 152 - The DHCP server strips out this
suboption when sending the response to the relay, indicating that the DHCP
server used VPN information to allocate IP address.
Circuit ID - Identifies the circuit, interface or VLAN, on the switch that received the request.
Remote ID - Identifies the remote host.
Note: The DHCP server must be capable of handling VPN identifier information in Option 82.
Direct communication between DHCP client and server may not be possible if they reside in
separate VRFs. The Server identifier override and Link Selection sub-options set the
relay agent to act as the DHCP server, and enable all DHCP communication to flow through
the relay agent.
The relay agent adds all the appropriate sub-options, and forwards all request packets, including
renew and release,to the DHCP server. When the relay receives the DHCP server response
messages, EOS removes Option 82 information and forwards the response to the DHCP client
in the client VRF.
Configuring DHCP Relay
EOS inserts the DHCP relay agent information option into DHCP messages relayed to the DHCP
server. The ip
helper-address command enables DHCP relay on an interface
and relays DHCP messages to the specified IPv4 address.
Example
This command enables DHCP relay on the interface ethernet 1/2;
and relays DHCP messages to the server at
1.1.1.1.
switch(config)# interface ethernet 1/2
switch(config-if-Et1/2)# ip helper-address 1.1.1.1
switch(config-if-Et1/2)#
The commands provided in the following examples enable the attachment of VRF-related tags
in the relay agent information option. If both the DHCP client interface and server
interface exist on the same VRF, default or non-default, then EOS does not insert the
VRF-related DHCP relay agent information option.
Examples
This command configures the DHCP relay to add option 82
information.
switch(config)# ip dhcp relay information option
These commands configures two new VRF instances and assign them Route
Distinguishers
(RDs).
The default format uses string denoted by %p. Setting the encoding to %x enables
hex encoding for the circuit ID. The configured value must be a valid hex number. If not configured, DHCP Relay uses the default format.
To specify the format for the remote-id encoding, use the
following
command:
The default format uses string denoted by %p. Setting the encoding to %x enables
hex encoding for the remote ID. The configured value must be a valid hex number. If not configured, DHCP Relay uses the default format.
DHCP Relay Global Configuration Mode Show Command
Example
This command displays the VRF specifier for the
server:
switch# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is enabled
DHCP Smart Relay is disabled
Interface: Ethernet9
Option 82 Circuit ID: Ethernet9
DHCP Smart Relay is disabled
DHCP servers: 10.40.2.3
10.40.2.3:vrf=qchyh-vrf
DHCP Relay in VXLAN EVPN
The ip dhcp relay information option (Global)
command enables the configuration of the DHCP server to uniquely identify
the origin of the request using a source-interface and the helper address.
Configure the source interface with a routable address used by the
DHCP server to uniquely identify the DHCP relay agent that forwarded the
client request.
Configuring DHCP Relay in VXLAN EVPN (IPv4)
Use the following command to enable the DHCP relay information option
(Option 82) required to specify
a source interface.
switch(config)# ip dhcp relay information option
The following configures a Loopback interface as the source interface.
switch(config)# interface Loopback1
switch(config-if-Lo1)# ip address 1.1.1.1/24
Use the following commands to configure the Loopback interface as the
specified source interface for the helper address.
switch(config)# interface vlan100
switch(config-if-Vl100)# ip helper-address 10.1.1.4 source-interface Loopback1
Use the following commands to configure the Loopback interface when the
DHCP server resides in a different VRF
(red). The source interface must
be configured in the DHCP server VRF for the command to take effect.
switch(config)# interface Loopback3
switch(config-if-Lo3)# vrf red
switch(config-if-Lo3)# ip address 1.1.1.1/24
switch(config)# interface vlan100
switch(config-if-Vl100)# ip helper-address 10.1.1.4 vrf red source-interface Loopback3
The following command disables the use of source interface along with the
helper address.
switch(config)# interface vlan100
switch(config-if-Vl100)# no ip helper-address 10.1.1.4 source-interface Loopback1
Configuring DHCP Relay in VXLAN EVPN (IPv6)
Use the following commands to configure a local
interface.
Use the following commands to configure the Loopback interface when the
DHCP server is in a different VRF (red).
The local interface must be configured in the DHCP server's VRF for
the command to take effect.
Configuring the Client Link Layer Address for the IPv6 DHCP Relay Agent
Configuring DHCPv6 Relay for Option 37
Clearing IPv6 DHCP Relay Counters
Configuring the IPv6 DHCP Relay Agent (Global)
The ipv6 dhcp relay always-on command enables the switch DHCP
IPv6 Relay Agent globally regardless of the DHCP IPv6 Relay Agent status on any
interface. EOS enables DHCP IPv6 Relay Agent by default if at least one routable
interface has an ipv6 dhcp relay destination statement.
The ipv6 dhcp relay destination command enables the DHCP IPv6
Relay Agent function and specifies the client message destination address on an
interface.
Example
This command enables the DHCP IPv6 Relay Agent function and sets the client message
destination address to 2001:0db8:0:1::1 on
interface ethernet
4.
Configuring the Client Link Layer Address for the IPv6 DHCP Relay Agent
The ipv6 dhcp relay option link-layer address command
enables the DHCPv6 relay agent to configure the Client Link Layer Address option to
solicit and request messages. In other words, the command enables the Client Link Layer
Address option (79) in the Global Configuration Mode. The noipv6 dhcp relay option link-layer address command disables
the link layer address option (79) in the Global Configuration Mode.
Example
This command enables the insertion of Client Link Layer Address option (79) in the Global
Configuration
Mode.
The DHCPv6 Relay Option 37 allows a DHCPv6 relay agent to insert a Remote-ID option
(Option 37) into DHCPv6 messages. This option provides the DHCPv6 server with
information about the client's location, such as the MAC address of the relay agent,
the ingress interface, and the VLAN ID. This is useful for network administrators to
track the origin of DHCP requests and to enforce policies based on the client's
location.
Use the following command to specify using the MAC address, hostname, and interface
name for the
Remote-ID:
switch(config)# ipv6 dhcp relay option remote-id format %m:%h:%p
Displaying the Remote-ID Configuration Information
Use the show ip dhcp
relay command to display the Option 37
configuration:
switch# show ip dhcp relay
DHCP relay is active
DHCPv6 relay remote ID option (37) encoding format: MAC address:hostname:interface name
Clearing IPv6 DHCP Relay Counters
The clear ipv6 dhcp relay counters command resets the DHCP
relay counters. The configuration mode determines which counters to reset:
Global configuratio: - Clears the counters for the switch and for all
interfaces.
Interface configuration - Clears the counter for the configuration mode
interface.
Examples
These commands clear all DHCP relay counters on the
switch.
The show ip dhcp
relay command displays the status of DHCP relay agent
parameters on the switch and each interface where at least one feature parameter is
listed. The command displays the status for both global and interface
configurations.
Example
This command displays the DHCP Agent Relay parameter
status.
switch(config)# interface ethernet 1/2
switch(config-if-Et1/2)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCPv6 Relay Link-layer Address Option (79) is disabled
DHCP Smart Relay is disabled
Interface: Ethernet1/2
DHCP Smart Relay is disabled
DHCP servers: 1::1
2001:db8:0:1::1
switch(config-if-Et1/2)#
IPv6 DHCP Relay Counters
The show ipv6 dhcp relay counters command displays the number
of DHCP packets received, forwarded, or dropped on the switch and on all interfaces
enabled as DHCP relay agents.
Example
This command displays the IP DHCP relay counter
table.
switch> show ipv6 dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 376 376 0 | 4 days, 19:55:12 ago
All Resp | 277 277 0 |
| |
Ethernet4 | 207 148 0 | 4 days, 19:54:24 ago
switch>
DHCP Snooping with Bridging
In this configuration, in addition to sending DHCP packets to relay after
adding information option, the packets can also bridge within the VLAN. In the bridging mode, the
switch intercepts DHCP packets, inserts option-82 if not already present, and bridges the packet
within the VLAN. This mode of DHCP snooping can be configured without DHCP relay
configuration.
Note: EOS supports DHCP Snooping with Bridging on MLAG configurations.
Configuring DHCP Snooping with Bridging
Following are the steps to configure DHCP snooping with bridging:
Enable DHCP snooping feature using the ip dhcp snooping
command.
switch# ip dhcp snooping
Enable the insertion of option-82 in DHCP request packets using the ip dhcp snooping information
option command. By default,
option-82 is disabled and must be enabled for DHCP Snooping to be
functional.
switch# ip dhcp snooping information option
Enable DHCP snooping on the corresponding VLANs using the ip dhcp
snooping vlan command. By
default,EOS disables DHCP snooping on any
VLAN.
switch# ip dhcp snooping vlan
Set the circuit-id information sent in option-82. By default, EOS sends the
Interface name and VLAN ID. Remote circuit-id contains the MAC address
of the relay
agent.
switch# ip dhcp snooping information option circuit-id type 2 format
%h:%p Hostname and interface name
%p:%v Interface name and VLAN ID
Enable bridging capabilities of DHCP snooping using the ip dhcp snooping
bridging command. This command enables DHCP snooping
with or without DHCP relay
configuration.
The ipv6 dhcp snooping command enables DHCP snooping globally
on the switch. DHCP snooping provides a Layer 2 feature that can be configured on
LAN switches. Arista switches support Option-37 insertion that allows relay agents
to provide remote-ID information in DHCP request packets.
Note: DHCPv6 VLAN classification and DHCPv4 VLAN classification share same hardware
resource.
Examples
The following configuration enables the IPv6 DHCP snooping feature at the global
level.
The following commands display the IPv6 DHCP snooping
state.
switch(config)# ipv6 dhcp snooping
switch(config)# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
2789-2790
DHCPv6 Snooping is operational on following VLANs:
2789
Insertion of Option-37 is enabled
DHCP Snooping with Bridging Show Commands
The show dhcp
snooping displays the DHCP snooping with bridging
information.
switch# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
650
DHCP Snooping bridging is operational on following VLANs:
650
Insertion of Option-82 is enabled
Circuit-id sub-option Type: 0
Circuit-id format: Interface name:Vlan ID
Remote-id: 00:1c:73:8d:eb:67 (Switch MAC)
Troubleshooting
Configure all the needed commands to enable DHCP snooping and operational on all the
VLANs.
show ip dhcp snooping displays the DHCP snooping status.
show ip dhcp snooping counters displays dropped snooped
packets.
show ip dhcp snooping counters debug displays the reason for
dropped packets.
The clear ip dhcp relay counters command resets the DHCP
relay counters. The configuration mode determines which counters are reset:.
The Interface configuration command clears the counter for
the configuration mode interface.
Command Mode
Privileged EXEC
Command Syntax
clear ip dhcp relay counters
[interface_name]
Parameters
interface_name - Specify the interface to clear counters..
Add the following options:
no parameter - Clears counters for the switch and
for all interfaces.
interface ethernete_num - Clears counters for the specified Ethernet
interface.
interface loopbackl_num - Clears counters for the specified loopback
interface.
interface port-channelp_num - Clears counters for the specified
port-channel Interface.
interface vlanv_num -Clears counters for the specified VLAN
interface.
Examples
These commands clear the DHCP relay counters for vlan
1045 and shows the counters before and after the
clear
command.
switch# show ip dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 376 376 0 | 4 days, 19:55:12 ago
All Resp | 277 277 0 |
| |
Vlan1001 | 207 148 0 | 4 days, 19:54:24 ago
Vlan1045 | 376 277 0 | 4 days, 19:54:24 ago
switch# clear ip dhcp relay counters interface vlan 1045
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 380 380 0 | 4 days, 21:19:17 ago
All Resp | 281 281 0 |
| |
Vlan1000 | 207 148 0 | 4 days, 21:18:30 ago
Vlan1045 | 0 0 0 | 0:00:07 ago
These commands clear all DHCP relay counters on the
switch.
switch(config-if-Vl1045)# exit
switch(config)# clear ip dhcp relay counters
switch(config)# show ip dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|-------------
All Req | 0 0 0 | 0:00:03 ago
All Resp | 0 0 0 |
| |
Vlan1000 | 0 0 0 | 0:00:03 ago
Vlan1045 | 0 0 0 | 0:00:03 ago
clear ip dhcp snooping
counters
The clear ip dhcp snooping counters command resets the DHCP
snooping packet counters.
Command Mode
Privileged EXEC
Command Syntax
clear ip dhcp snooping counters [counter_type]
Parameters
counter_type - Specify the type of counter to reset. Options
include the following:
no parameter - Counters for each VLAN.
debug - Aggregate counters and drop cause
counters.
Examples
This command clears the DHCP snooping counters for each
VLAN.
switch# clear ip dhcp snooping counters
switch# show ip dhcp snooping counters
| Dhcp Request Pkts | Dhcp Reply Pkts |
Vlan | Rcvd Fwdd Drop | Rcvd Fwdd Drop | Last Cleared
-----|------ ----- ------|----- ---- ------|-------------
100 | 0 0 0 | 0 0 0 | 0:00:10 ago
switch#
This command clears the aggregate DHCP snooping
counters.
switch# clear ip dhcp snooping counters debug
switch# show ip dhcp snooping counters debug
Counter Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received 0 0
Forwarded 0 0
Dropped - Invalid VlanId 0 0
Dropped - Parse error 0 0
Dropped - Invalid Dhcp Optype 0 0
Dropped - Invalid Info Option 0 0
Dropped - Snooping disabled 0 0
Last Cleared: 0:00:08 ago
switch#
clear ipv6 neighbors
The clear ipv6 neighbors command removes the specified
dynamic IPv6 neighbor discovery cache entries. Commands that do not specify an IPv6
address remove all dynamic entries for the listed interface. Commands that do not
specify an interface remove all dynamic entries.
Command Mode
Privileged EXEC
Command Syntax
clear ipv6 neighbors
[port][dynamic_ipv6]
Parameters
port Interface through which neighbor is accessed. Options
include the following:
no parameter - Removes all dynamic entries.
interface ethernete_num - Specify the Ethernet interface by
e_num.
interface loopbackl_num - Specify the Loopback interface by
l_num.
interface port-channel p_num - Specify the Port-channel
interface by p_nump_num.
interface vlanv_num - Specify the VLAN interface by
v_num.
dynamic_ipv6 - Specifies the address of entry to remove.
Options include the following:
no parameter - Removes all dynamic entries for specified
interface.
ipv6_addr - Removes the IPv6 address of
the entry.
Example
This command removes all dynamic neighbor entries for vlan
200.
switch# clear ipv6 neighbors vlan 200
switch#
clear ipv6 dhcp relay
counters
The clear ipv6 dhcp relay counters command resets the DHCP
relay counters. If you do not specify a port, the command clears the counters for
the switch and for all interfaces. Otherwise, the command clears the counter for the
specified interface.
Command Mode
Privileged EXEC
Command Syntax
clear ipv6 dhcp relay counters [port]
Parameters
port - Specify the interface to access the neighbor. Options
include the following:
no parameter - Removes all dynamic entries.
interface ethernete_num - Specify the Ethernet interface by
e_num.
interface loopbackl_num - Specify the Loopback interface by
l_num.
interface port-channel p_num - Specify the Port-channel interface by
p_nump_num.
interface vlanv_num - Specify the VLAN interface by
v_num.
Example
These commands clear the DHCP relay counters for interface ethernet
4 and shows the counters before and after the
clear
command.
switch(config)# show ipv6 dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 376 376 0 | 4 days, 19:55:12 ago
All Resp | 277 277 0 |
| |
Ethernet4 | 207 148 0 | 4 days, 19:54:24 ago
switch(config)# interface ethernet 4
switch(config-if-Et4)# clear ipv6 dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 380 380 0 | 4 days, 21:19:17 ago
All Resp | 281 281 0 |
| |
Ethernet4 | 0 0 0 |4 days, 21:18:30 ago
These commands clear all DHCP relay counters on the switch.
switch(config-if-Et4)# exit
switch(config)# clear ipv6 dhcp relay counters
switch(config)# show ipv6 dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|-------------
All Req | 0 0 0 | 0:00:03 ago
All Resp | 0 0 0 |
| |
Ethernet4 | 0 0 0 | 0:00:03 ago
switch(config)#
clear ipv6 dhcp snooping
counters
The clear ipv6 dhcp snooping counters command resets the
DHCP snooping packet counters.
Command Mode
Privileged EXEC
Command Syntax
clear ipv6 dhcp snooping counters
[counter_type]
Parameters
counter_type - Specifies the type of counter to
reset.
no parameter - Clears the counters for each VLAN.
debug - Clears aggregate counters and drop cause
counters.
Examples
This command clears the number of DHCP packets sent and received on each
VLAN.
switch# clear ipv6 dhcp snooping counters
switch# show ipv6 dhcp snooping counters
| Dhcpv6 Request Pkts | Dhcpv6 Reply Pkts |
Vlan | Rcvd Fwdd Drop | Rcvd Fwdd Drop | Last Cleared
-----|------ ------ -------|------ ----- ------|-------------
2789 | 1 1 0 | 1 1 0 | 0:03:09 ago
This command clears the number of DHCP packets sent on the
switch.
The default-gateway command in DHCP Server Subnet Configuration Mode populates DHCP Option 3 (Router Option)
in the DHCP payload sent from the switch to the client and allows communication to another VLAN or network.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
DHCP Server IPv4 Subnet Configuration
Command Syntax
default-gateway
no default-gateway
default default-gateway
Parameters
default-gatewayipv4_address - Add a default gateway to the subnet.
Example
Use the following commands to add the default-gateway, 10.10.10.1, to
subnet
172.16.23.11/32:
switch(config)# dhcp server
switch(config-dhcp-server)# subnet 172.16.23.11/32
switchconfig-dhcp-subnet-ipv4)# default-gateway 10.10.10.1
switchconfig-dhcp-subnet-ipv4)#
default-gateway
The default-gateway command in DHCP Server Subnet Configuration Mode populates DHCP Option 3 (Router Option)
in the DHCP payload sent from the switch to the client and allows communication to another VLAN or network.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
DHCP Server IPv6 Subnet Configuration
Command Syntax
default-gateway
no default-gateway
default default-gateway
Parameters
default-gatewayipv6_address
Example
Use the following commands to add the default-gateway,
2001:db8:cafe:a100::99, to subnet
2001:db8:acad:1::fe21/32:
switch(config)# dhcp server
switch(config-dhcp-server)# subnet 2001:db8:acad:1::fe21/32
switchconfig-dhcp-subnet-ipv6)# default-gateway 2001:db8:cafe:a100::99
switchconfig-dhcp-subnet-ipv6)#
dhcp relay
The dhcp relay command places the switch in the DHCP relay
mode. Execute this command in the Global Configuration Mode.
The no dhcp relay command removes DHCP relay configuration
from the running-config.
Command Mode
Global Configuration Mode
Command Syntax
dhcp relay
no dhcp relay
Example
The dhcp relay command places the switch in the DHCP relay
configuration mode.
The dhcp relay ipv6 command in the DHCP Relay Configuration
Mode configures DHCP Relay IPv6 routes and disable DHCP route persistence or synchronize
neighbors.
The dhcp server command places the switch in the DHCP relay
mode. Execute this command in the DHCP Server Configuration Mode.
The no dhcp server command removes DHCP relay configuration
from the running-config.
Command Mode
Global Configuration Mode
Command Syntax
dhcp server
no dhcp server
Example
The dhcp server command places the switch in the DHCP relay
configuration mode.
switch(config)# dhcp server
switch(config-dhcp-server)#
dhcp server client
The dhcp server client command in the IPv4 or IPv6 Subnet
Configuration Mode configures client options for the DHCP server. Execute this
command under the dhcp server configuration mode.
Command Mode
DHCP Server Configuration
DHCP Server Subnet Configuration
DHCP Server IPv4 or IPv6 Subnet Range Configuration
Command Syntax
dhcp server client class [ipv4|ipv6] definitionclient_classassignments[default-gateway|dns|lease|option|private-option|tftp]
Parameters
[ipv4|ipv6] - Select the IP address family.
definitionclient_class - Add a class for the client
definition.
default-gateway - Configure the client class
default gateway sent to DHCP clients.
dns - Configure the client class DNS.
lease - Configure the client class lease.
option - Configure the client class DHCP
options.
private-option - Configure the client class's
private options.
tftp - Configure the client class's TFTP
options.
Example
Use the dhcp server client class default-gateway command to
add a client definition for the IPv4 DHCP client class default gateway of 10.0.0.1.
options.
switch(config-dhcp-server)# client class ipv4 definition test1 default-gateway 10.0.0.1
dhcp server debug
The dhcp server debug log command configures DHCP server
debugging configuration. Execute this command in the DHCP Server Configuration Mode.
Command Mode
DHCP Server Configuration Mode
Command Syntax
dhcp server debuglogfile
Parameters
logfile - Specify the file location to store debugging
logs.
Example
Use the dhcp server log command to add a file location for
debugging logs.
switch(config-dhcp-server)# debug log
dhcp server dns
The dhcp server dns command configures DHCP server DNS
options. Execute this command in the DHCP Server Configuration Mode and DHCP Server
IPv4 Subnet Configuration Mode.
Command Mode
DHCP Server Configuration
DHCP Server IPv4 or IPv6 Subnet Configuration
Command Syntax
dhcp server dns [domain namedomain_name][server [ipv4|ipv6]ip_address
Parameters
domain namedomain_name - Specify the domain name of the DNS
server.
server [ipv4|ipv6]ip_address - Specify the DNS server as IPv4 or
IPv6 and the IP address of the server.
Example
Use the dhcp server dns command to add an IPv4 DNS server,
192.168.10.5, to the DHCP configuration.
options.
switch(config-dhcp-server)# dns server ipv4 192.168.10.5
dhcp server lease
The dhcp server lease command configures DHCP server lease
options. Execute this command in the DHCP Server Configuration Mode and DHCP Server
IPv4 Subnet Configuration Mode.
Command Mode
DHCP Server Configuration
DHCP Server IPv4 or IPv6 Subnet Configuration
Command Syntax
dhcp server lease time [ipv4|ipv6]daysdayshourshoursminutesminutes
Parameters
[ipv4|ipv6] - Configure the lease for IPv4 or
IPv6.
daysdays - Specify the number of days for the lease to
be in effect from 0 to 2000 days.
hourshours - Specify the
number of hours for the lease to be in effect from 0 to 23 hours.
minutesminutes - Specify
the number of minutes for the lease to be in effect from 0 to 59
minutes.
Example
Use the dhcp server lease command to add an IPv4 lease to
be in effect for 10 days, to the DHCP configuration.
switch(config-dhcp-server)# dns lease time ipv4 10 days
dhcp server next-server
The dhcp server next-server command in the DHCP Server Configuration Mode
populates a specific legacy field in the DHCP packet header called the siaddr, Server
IP address. During initialization, a switch requires information about the location of a DHCP server. After
receiving an IP address for the bootstrap process, the switch contacts the TFTP or HTTP server and downloads
the configuration file specified in the bootfile command.
Command Mode
DHCP Server Configuration
Command Syntax
next-serveripv4_address
no next-server
Parameters
next-serveripv4_address - Specify the IPv4 address for the DHCP
server.
Example
Use the following commands to add the IPv4 address, 172.16.23.3, as the
DHCP
server:
switch(config)# dhcp server
switch(config-dhcp-server)# next-server 172.16.23.3
switch(config-dhcp-server)#
dhcp server option
The dhcp server option command configures DHCP server
options. Execute this command in the DHCP Server Configuration Mode.
Command Mode
DHCP Server Configuration
DHCP Server IPv4 or IPv6 Subnet Configuration
Command Syntax
dhcp server option ipv4code[always-send data type [hex |string] data]]quoted_stringhex[client-id disable]hourshoursminutesminutes
dhcp server option ipv6code[always-send data type [hex |string] data]]quoted_stringhex[client-id disable]hourshoursminutesminutes
Parameters
[ipv4|ipv6] - Configure the option for IPv4 or
IPv6.
code - Specify the option number from the DHCP
options.
[always-send data type [hex |string] data]]quoted_stringhex - Specify to send the option whether or not the
client requested it.
type hex datahex_number - Specify the option type
client-id disable - Prevent the DHCPv4 server from
sending back the client ID.
Example
Use the dhcp server option command to add an IPv4 DHCP
code, 67, to the DHCP configuration.
switch(config-dhcp-server)# option ipv4 option 67
dhcp server private-option
The dhcp server private-option command configures DHCP
server private options. Execute this command in the DHCP Server Configuration Mode.
Command Mode
DHCP Server Configuration Mode
Command Syntax
dhcp server private-option [ipv4|ipv6]code[always-send data type [hex |string] data]]quoted_stringhex
Parameters
[ipv4|ipv6] - Configure the option for IPv4 or
IPv6.
code - Specify the option number from 224 to
254.
[always-send data type [hex |string] data]]quoted_string>hex - Specify to send the option whether or
not the client requested it.
Example
Use the dhcp server option command to add an IPv4 private
option code, 225, to always send the option to the DHCP configuration.
switch(config-dhcp-server)# option ipv4 private-option 225 always-send private-option ipv4 225 always-send type string data "Code Sent"
dhcp server subnet
The dhcp server subnet command configures DHCP server
subnet options. Execute this command in the DHCP Server Configuration
Mode.
Command Mode
DHCP Server Configuration Mode
Command Syntax
dhcp server subnetipv4_addressipv6_address
Parameters
ipv4_address> - Configure the IPv4 subnet.
ipv6_address - Configure the IPv6 subnet.
Example
Use the dhcp server subnet command to add an IPv4 subnet,
198.168.0.0/24, to the DHCP configuration.
switch(config-dhcp-server)# subnet 198.168.0.0/24
dhcp server subnet client
The dhcp server subnet [ipv4 | ipv6] client command
configures client options for the DHCP server. Execute this command in the DHCP
Server Configuration Mode.
Command Mode
DHCP Server Configuration Mode
Command Syntax
dhcp server subnet [ipv4|ipv6] client class definitionclient_class[default-gateway|dns|lease|name|range|reservations|tftp]
Parameters
[ipv4|ipv6] - Select the IP address family.
definitionclient_class - Add a class for the client
definition.
default-gatewayip_address - Configure the client class default
gateway sent to DHCP clients.
dns server - Configure the client class DNS.
leasedayshourshoursminutesminutes -
Configure the client class lease in days, hours, and minutes.
namename - Configure the subnet name.
rangeip_address_startip_address_end - Configure the range of IP
addresses for the subnet.
reservations mac-addressmac_address[hostname | ipv4-address] - Configure the MAC
address to use for reservations.
tftp - Configure the client class's TFTP
options.
Example
Use the dhcp server subnet ipv4 client class
default-gateway command to add a client definition for the IPv4
DHCP client class default gateway of 10.0.0.1.
options.
switch(config-dhcp-server)#subnet ipv4 client class ipv4 definition test1 default-gateway 10.0.0.1
dhcp server tftp
The dhcp server tftp command configures DHCP
server TFTP options. Execute this command in the DHCP Server Configuration Mode.
Command Mode
DHCP Server Configuration Mode
Command Syntax
dhcp server tftp server [file [ipv4|ipv6]file_name][option [150|66]] ipv4
Parameters
file [ipv4|ipv6]file_name - Configure the IPv4 or IPv6 boot file
name.
option [150|66]] ipv4ip_address - Configure the TFTP DHCP option as 150
or 66 with an IPv4 address.
Example
Use the dhcp server tftp command to add option 150 with an
IPv4 address 198.168.0.11, to the DHCP configuration.
The dhcp server vendor-option command configures the DHCP
server vendor identifier options. Execute this command under the DHCP Server
Configuration Mode.
Command Mode
DHCP Server Configuration Mode
Command Syntax
dhcp server vendor-option ipv4vendor_iddefaultvendor_idsub-optionsub-option_code
Parameters
vendor_id - Configure the vendor identifier.
defaultvendor_id - Set as the default vendor specific
option.
sub-optionsub-option_code - Set the sub-option code from
1-254.
Example
Use the dhcp server vendor-option command to add vendor
option, 1:4:c0:0:2:8 , to the DHCP configuration.
The dhcp server vendor-option command configures the DHCP
server vendor identifier options. Execute this command in the DHCP Server
Configuration Mode.
Command Mode
DHCP Server Configuration Mode
Command Syntax
dhcp server vendor-option ipv4vendor_iddefaultvendor_idsub-optionsub-option_codetype[array | ipv4-address |string]array [ipv4-address data ip_address[string dataquoted_string
Parameters
vendor_id - Configure the vendor identifier.
defaultvendor_id - Set as the default vendor specific
option.
sub-optionsub-option_code - Set the sub-option code from
1-254.
Example
Use the dhcp server vendor-option command to add the vendor
option, 1:4:c0:0:2:8, to the DHCP Server configuration.
The high-availability command in the DHCP Server Configuration Mode enters the High Availability (HA)
Configuration Mode and allows the configuration of HA for a primary and secondary DHCP server. The parameter, mode, places the DHCP server in
hot stand-by mode for HA.
The [no | default] versions of the command disable the feature and
remove the configuration from the running-config.
Use the following commands to specify the local DHCP server HA role as primary:
switch(config)# dhcp-server
switch(config-dhcp-server)# high-availability
switch(config-dhcp-server-ha)# role primary
switch(config-dhcp-server-ha)#
high-availability heartbeat
The high-availability heartbeat command places the switch in
the DHCP Server High Availability Configuration Mode configures the heartbeat and
timeout interval for a DHCP server in HA mode.
The [no | default] versions of the command disable the feature and
remove the configuration from the running-config.
heartbeat intervalsecondsseconds -Specify the interval between heartbeats between 1 and 65 seconds
with a default interval of 10 seconds.
heartbeat timeoutsecondsseconds - Specify the time to wait for a heartbeat response
before detecting the peer DHCP server as offline. Configure a value between 2 and 65 seconds with a default value of 60 seconds.
Examples
Use the following commands to configure a heartbeat interval of 30 seconds:
switch(config)# dhcp server
switch(config-dhcp-server)# high-availability
switch(config-dhcp-ha)# interval 30 seconds
switch(config-dhcp-ha)#
Use the following commands to configure a heartbeat timeout of 30 seconds:
switch(config)# dhcp server
switch(config-dhcp-server)# high-availability
switch(config-dhcp-ha)# timeout 30 seconds
switch(config-dhcp-ha)#
high-availability peer role
The high-availability peer role command in the DHCP Server High Availability Configuration Mode configures DHCP
peer servers for HA.
The [no | default] versions of the command disable the feature and
remove the configuration from the running-config.
peer [ipv4 | ipv6] - Configure the IPv4 or IPv6 address for the HA
peer.
role [primary | secondary] - Configure the peer HA
DHCP server as primary or secondary.
Example
Use the following commands to configure the IPv4 address, 10.0.2.2, as the secondary HA
DHCP server:
switch(config)# dhcp server
switch(config-dhcp-server)# high-availability
switch(config-dhcp-ha)# peer 10.0.2.2
switch(config-dhcp-ha-10.0.2.2)# role secondary
switch(config-dhcp-ha-10.0.2.2)#
ip dhcp relay all-subnets
The ip dhcp relay all-subnets command configures the DHCP
smart relay status in the Interface Configuration Mode. DHCP smart relay supports
forwarding DHCP requests with a client secondary IP addresses in the gateway address
field. Enabling DHCP smart relay on an interface requires that you enable DHCP relay
on that interface.
By default, an interface assumes the global DHCP smart relay setting as configured by
the ip dhcp relay all-subnets default command. The
ip dhcp relay all-subnets command, when
configured, takes precedence over the global smart relay setting.
The no ip dhcp relay all-subnets command disables DHCP
smart relay on the configuration mode interface. The default ip dhcp
relay all-subnets command restores the interface to the
default DHCP smart relay setting, as configured by the ip dhcp relay
all-subnets default command, by removing the corresponding
ip dhcp relay all-subnets or no ip
dhcp relay all-subnets statement from
running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ip dhcp relay all-subnets
no ip dhcp relay all-subnets
default ip dhcp relay all-subnets
Examples
This command enables DHCP smart relay on VLAN interface
100.
switch(config)# interface vlan 100
switch(config-if-Vl100)# ip helper-address 10.4.4.4
switch(config-if-Vl100)# ip dhcp relay all-subnets
switch(config-if-Vl100)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: Vlan100
DHCP Smart Relay is enabled
DHCP servers: 10.4.4.4
switch(config-if-Vl100)#
This command disables DHCP smart relay on VLAN interface
100.
switch(config-if-Vl100)# no ip dhcp relay all-subnets
switch(config-if-Vl100)# show active
interface Vlan100
no ip dhcp relay all-subnets
ip helper-address 10.4.4.4
switch(config-if-Vl100)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: Vlan100
DHCP Smart Relay is disabled
DHCP servers: 10.4.4.4
switch(config-if-Vl100)#
This command enables DHCP smart relay globally, configures VLAN interface
100 to use the global setting, then
displays the DHCP relay
status.
switch(config)# ip dhcp relay all-subnets default
switch(config)# interface vlan 100
switch(config-if-Vl100)# ip helper-address 10.4.4.4
switch(config-if-Vl100)# default ip dhcp relay
switch(config-if-Vl100)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: Vlan100
Option 82 Circuit ID: 333
DHCP Smart Relay is enabled
DHCP servers: 10.4.4.4
switch(config-if-Vl100)#
ip dhcp relay all-subnets
default
The ip dhcp relay all-subnets default command configures
the global DHCP smart relay setting. DHCP smart relay supports forwarding DHCP
requests with a client secondary IP addresses in the gateway address field. The
default global DHCP smart relay setting is disabled.
The global DHCP smart relay setting applies to all interfaces for which an ip dhcp relay all-subnets statement does not exist. Enabling
DHCP smart relay on an interface requires that you also enable DHCP relay on that
interface.
The no ip dhcp relay all-subnets default and
default ip dhcp relay all-subnets default commands
restore the global DHCP smart relay default setting of disabled by removing the
ip dhcp relay all-subnets default command from
running-config.
Command Mode
Global Configuration
Command Syntax
ip dhcp relay all-subnets default
no ip dhcp relay all-subnets default
default ip dhcp relay all-subnets default
Example
This command configures the global DHCP smart relay setting to
enabled.
switch(config)# ip dhcp relay all-subnets default
switch(config)#
ip dhcp relay always-on
The ip dhcp relay always-on command enables the DHCP relay
agent on the switch regardless of the DHCP relay agent status on any interface. By
default, EOS enables the DHCP relay agent only if you have one routable interface
configured with an ip helper-address statement.
The no ip dhcp relay always-on and default ip
dhcp relay always-on commands remove the ip dhcp
relay always-on command from running-config.
Command Mode
Global Configuration
Command Syntax
ip dhcp relay always-on
no ip dhcp relay always-on
default ip dhcp relay always-on
Example
This command enables the DHCP relay
agent.
switch(config)# ip dhcp relay always-on
switch(config)#
ip dhcp relay information
option (Global)
The ip dhcp relay information option command configures the
switch to attach tags to DHCP requests before forwarding them to the DHCP servers
designated by the ip helper-address commands. The command
specifies the tag contents for packets forwarded by the configured interface. The
default value for each interface configured with an ip helper-address is the name and number of the
interface.
The no ip dhcp relay information option and
default ip dhcp relay information option commands
restore the switch default setting of not attaching tags to DHCP requests by
removing the ip dhcp relay information option command from
running-config.
Command Mode
Global Configuration
Command Syntax
ip dhcp relay information option
no ip dhcp relay information option
default ip dhcp relay information option
Example
This command enables the attachment of tags to DHCP requests forwarded to DHCP server
addresses.
switch(config)# ip dhcp relay information option
switch(config)#
ip dhcp relay information option circuit-id
The ip dhcp relay information option circuit-id command
specifies the content of tags that the switch attaches to DHCP requests before
forwarding them from the configuration mode interface to DHCP server addresses
specified by ip helper-address commands. Tags attach to
outbound DHCP requests only if you enable the information option on the switch
(ip dhcp relay information option circuit-id).
The no ip dhcp relay information option circuit-id and
default ip dhcp relay information option circuit-id
commands restore the default content setting for the
configuration mode interface by removing the corresponding command from
running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Loopback Configuration
Interface-Management Configuration
Interface-Port-channel Configuration
Interface-VLAN Configuration
Command Syntax
ip dhcp relay information option circuit-idid_label
no ip dhcp relay information option circuit-id
default ip dhcp relay information option circuit-id
Parameters
id_label- Specifies the tag content. Use a format in
alphanumeric characters (maximum 15 characters).
Example
This command configures x-1234 as the tag content for
packets send from VLAN 200.
switch(config)# interface vlan 200
switch(config-if-Vl200)# ip dhcp relay information option circuit-id x-1234
switch(config-if-Vl200)#
ip dhcp snooping
The ip dhcp snooping command enables DHCP snooping globally
on the switch. Configure DHCP snooping as a set of Layer 2 processes and use it with
DHCP servers to control network access to clients with specific IP/MAC addresses.
The switch supports Option-82 insertion,a DHCP snooping process that allows relay
agents to provide remote-ID and circuit-ID information to DHCP reply and request
packets. DHCP servers use this information to determine the originating port of DHCP
requests and associate a corresponding IP address to that port. DHCP servers use
port information to track host location and IP address usage by authorized physical
ports.
DHCP snooping uses the information option (Option-82) to include the switch MAC
address as the router-ID along with the physical interface name and VLAN number as
the circuit-ID in DHCP packets. After adding the information to the packet, the DHCP
relay agent forwards the packet to the DHCP server as specified by the DHCP
protocol.
DHCP snooping on a specified VLAN requires all of these conditions to be met:
Enable DHCP snooping globally.
Enabled insertion of option-82 information in DHCP packets.
Enable DHCP snooping on the specified VLAN.
Enable DHCP relay on the corresponding VLAN interface.
The no ip dhcp snooping and default ip dhcp
snooping commands disables global DHCP snooping by removing
the ip dhcp snooping command from
running-config.
ip helper-address enables the DHCP relay agent on a
configuration mode interface.
Example
This command globally enables snooping on the switch, displaying DHCP snooping status
prior and after invoking the
command.
switch(config)# show ip dhcp snooping
DHCP Snooping is disabled
switch(config)# ip dhcp snooping
switch(config)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is not operational
DHCP Snooping is configured on following VLANs:
None
DHCP Snooping is operational on following VLANs:
None
Insertion of Option-82 is disabled
switch(config)#
ip dhcp snooping bridging
The ip dhcp snooping bridging command enables the DHCP
snooping bridging configuration.
The no ip dhcp snooping bridging command removes the DHCP
snooping bridging configuration from the running-config.
Command Mode
Global Configuration Mode
Command Syntax
ip dhcp snooping bridging
no ip dhcp snooping bridging
Example
This command configures the DHCP snooping bridging.
switch# configure
switch(config)# ip dhcp snooping bridging
ip dhcp snooping information
option
The ip dhcp snooping information option command enables the
insertion of option-82 DHCP snooping information in DHCP packets on VLANs where you
have DHCP snooping enabled. DHCP snooping provides a Layer 2 switch process that
allows relay agents to provide remote-ID and circuit-ID information to DHCP reply
and request packets. DHCP servers use this information to determine the originating
port of DHCP requests and associate a corresponding IP address to that port.
DHCP snooping uses information option (Option-82) to include the switch MAC address
(router-ID) along with the physical interface name and VLAN number (circuit-ID) in
DHCP packets. After adding the information to the packet, the DHCP relay agent
forwards the packet to the DHCP server through DHCP protocol processes.
DHCP snooping on a specified VLAN requires all of these conditions to be met:
Enable DHCP snooping globally.
Enabled insertion of option-82 information in DHCP packets.
Enable DHCP snooping on the specified VLAN.
Enable DHCP relay on the corresponding VLAN interface.
Ifnot enabling DHCP snooping globally, the ip dhcp snooping information
option command persists in
running-config without any operational
effect.
The no ip dhcp snooping information option and
default ip dhcp snooping information option
commands disable the insertion of option-82 DHCP snooping information in DHCP
packets by removing the ip dhcp snooping information
option statement from
running-config.
Command Mode
Global Configuration
Command Syntax
ip dhcp snooping information option
no ip dhcp snooping information option
default ip dhcp snooping information option
Example
These commands enable DHCP snooping on DHCP packets from ports on snooping-enabled
VLANs. DHCP snooping was previously enabled on the
switch.
switch(config)# ip dhcp snooping information option
switch(config)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
100
DHCP Snooping is operational on following VLANs:
100
Insertion of Option-82 is enabled
Circuit-id format: Interface name:Vlan ID
Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch(config)#
ip dhcp snooping vlan
The ip dhcp snooping vlan command enables DHCP snooping on
specified VLANs. DHCP snooping provides a Layer 2 process that allows relay agents
to provide remote-ID and circuit-ID information in DHCP packets. DHCP servers use
this data to determine the originating port of DHCP requests and associate a
corresponding IP address to that port. Configure DHCP snooping on a global and VLAN
basis.
VLAN snooping on a specified VLAN requires each of these conditions:
Enable DHCP snooping globally.
Enable insertion of option-82 information in DHCP packets.
Enable DHCP snooping on the specified VLAN.
Enable DHCP relay on the corresponding VLAN interface.
If not enabling global DHCP snooping, the ip dhcp snooping
vlan command persists in
running-config without any operational
affect.
The no ip dhcp snooping information option and
default ip dhcp snooping information option
commands disable DHCP snooping operability by removing the ip dhcp
snooping information option statement from
running-config.
Command Mode
Global Configuration
Command Syntax
ip dhcp snooping vlanv_range
no ip dhcp snooping vlanv_range
default ip dhcp snooping vlanv_range
Parameters
v_range - Specifies the range of VLANs to enable DHCP
snooping. Formats include a number, a number range, or a comma-delimited list of
numbers and ranges. Numbers range from 1 to
4094.
Example
These commands enable DHCP snooping globally, DHCP snooping on VLAN interface
100, and DHCP snooping on
vlan100.
switch(config)# ip dhcp snooping
switch(config)# ip dhcp snooping information option
switch(config)# ip dhcp snooping vlan 100
switch(config)# interface vlan 100
switch(config-if-Vl100)# ip helper-address 10.4.4.4
switch(config-if-Vl100)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
100
DHCP Snooping is operational on following VLANs:
100
Insertion of Option-82 is enabled
Circuit-id format: Interface name:Vlan ID
Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch(config)#
ipv6 dhcp relay always-on
The iv6p dhcp relay always-on command enables the
switch DHCP relay agent on the switch regardless of the DHCP relay agent status on
any interface. By default, the DHCP relay agent is enabled only if at least one
routable interface is configured with an ipv6 dhcp relay
destination statement.
The no ipv6 dhcp
relay always-onand default ipv6 dhcp relay always-on commands remove
the ipv6 dhcp relay always-on command from
running-config.
The ipv6 dhcp relay destination command enables the DHCPv6
relay agent and sets the destination address on the configuration mode
interface.
The no ipv6 dhcp relay destination and default ipv6 dhcp relay destination commands remove the corresponding ipv6 dhcp relay destination command from running-config. When the commands do not list an IPv6 address, all ipv6 dhcp relay destination commands are removed from running-config.
source-addressipv6_addr specify the source IPv6 address to
communicate with DHCP server.
Guidelines
If the source-address parameter is specified, then the DHCP client receives an IPv6
address from the subnet of source IP address. The source-address must be one of the
configured addresses on the interface.
Example
This command enables the DHCPv6 relay agent and sets the destination address to
2001:0db8:0:1::1 on interface ethernet
4.
switch(config)# interface ethernet 4
switch(config-if-Et4)# ipv6 dhcp relay destination 2001:0db8:0:1::1
switch(config-if-Et4)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCPv6 Relay Link-layer Address Option (79) is disabled
DHCP Smart Relay is disabled
Interface: Ethernet4
DHCP Smart Relay is disabled
DHCP servers: 1::1
2001:db8:0:1::1
switch(config-if-Et4)#
ipv6 dhcp relay option
link-layer address
The ipv6 dhcp relay option link-layer address command
enables the DHCPv6 relay agent to configure the client link layer address option to
solicit and request messages. In other words, the command enables the link layer
address option (79) in the global configuration mode.
The no ipv6 dhcp relay option link-layer address command
disables the link layer address option (79) in the global configuration mode.
Command Mode
Global Configuration
Command Syntax
ipv6 dhcp relay option link-layer address
no ipv6 dhcp relay option link-layer address
default ipv6 dhcp relay option link-layer address
Example
This command enables the insertion of link layer address option (79) in the global
configuration
mode.
The ipv6 dhcp relay option command configures DHCPv6 Relay
Option 37, Remote-ID, to add the MAC address, interface ID or name, and hostname as the
remote-id format. The no version of the command removes the
configuration from the running-config.
no ipv6 dhcp relay option remote-id format {%m:%h:%p | %m:%i | %m:%p}
Parameters
remote-id - Add Option 37 to the DHCP Relay
configuration.
format - Select one of the following as the format for the
remote-id:
%m:%h:%p - Specify the MAC address, hostname,
and interface name as the remote-id.
%m:%i - Specify the MAC address and interface
ID as the remote-id.
%m:%p - Specify the MAC address and interface
name as the remote-id.
Example
Use the following command to specify using the MAC address, hostname, and interface name
for the
Remote-ID:
switch(config)# ipv6 dhcp relay option remote-id format %m:%h:%p
ipv6 dhcp snooping
The ipv6 dhcp snooping command enables DHCP snooping
globally on the switch.
The no ipv6 dhcp snooping and default ipv6 dhcp
snooping commands disable global DHCP snooping by removing the
ipv6 dhcp snooping command from running-config.
vlan enables IPv6 DHCP snooping for a specific
VLAN. Numbers range from 1 to 4094.
$ end of range.
vlan-range VLANs based on the snooping enabled.
Formats include a number, a number range, or a comma-delimited list of
numbers and ranges. Numbers range from 1 to
4094.
Examples
The following configuration enables IPv6 DHCP snooping feature at the global
level.
The following command display IPv6 DHCP snooping
state.
switch(config)# ipv6 dhcp snooping
switch(config)# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
2789-2790
DHCPv6 Snooping is operational on following VLANs:
2789
Insertion of Option-37 is enabled
name
The name command in DHCP Server Subnet Configuration Mode
creates a name for the subnet and improves readability of the subnet list.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
DHCP Server IPv4 or IPv6 Subnet Configuration
Command Syntax
name
no name
default name
Parameters
namename - Specify a name for the subnet.
Example
Use the following commands to configure a name, remote_switch, to subnet
172.16.23.11/32:
switch(config)# dhcp server
switch(config-dhcp-server)# subnet 172.16.23.11/32
switchconfig-dhcp-subnet-ipv4)# name remote_switch
switchconfig-dhcp-subnet-ipv4)#
prefix-delegation
The prefix-delegation command in DHCP Server IPv6 Subnet
Configuration Mode configures a block of IPv6 addresses for a downstream router on the
network. The router then splits the block into subnets and assigns the IPv6 addresses to
devices on its network.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
DHCP Server IPv6 Subnet Configuration
Command Syntax
prefix-delegation
no prefix-delegation
default prefix-delegation
Parameters
prefix-delegationipv6_address_range - Specify a block of IPv6 addresses for the IPv6 subnet.
Example
Use the following commands to delegate a block of IPv6 addresses, 2001:db8:100:aa00::/56, to subnet
2001:db8:100::/48:
switch(config)# dhcp server
switch(config-dhcp-server)# subnet 2001:db8:100::/48
switchconfig-dhcp-subnet-ipv6)# prefix-delegation 2001:db8:100:aa00::/56
switchconfig-dhcp-subnet-ipv6)#
range
The range command in DHCP Server Subnet Configuration Mode
explicitly defines the contiguous block of IP addresses that the DHCP server is allowed to dynamically lease to clients.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
subnet [ipv4 \
ipv6] - Specify an IPv4 or IPv6 address for
the subnet.
rangestart_ipaddressend_ipaddress - Specify a range for the subnet.
Example
Use the following commands to configure a name, remote_switch, to subnet
172.16.23.11/32:
switch(config)# dhcp server
switch(config-dhcp-server)# subnet 172.16.23.11/32
switchconfig-dhcp-subnet-ipv4)# range 172.16.23.100 172.16.23.200
switchconfig-dhcp-subnet-ipv4)#
reservations mac-address
The reservations mac-address command in DHCP Server IPv4 Subnet
Reservations Configuration Mode builds static DHCP bindings from the client MAC address
on the reservations list. Once in the DHCP Server IPv4 Subnet Reservations MAC Address
Configuration Mode, add reservations for a hostname and an IPv4 address to map to the
MAC address.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
DHCP Server IPv4 Subnet Reservations Configuration
Command Syntax
reservations mac-address
Parameters
reservations mac-addressmac_address - Specify a MAC address reservation for the subnet.
hostnamehostname - Specify a host name to map to the MAC
address.
ipv4-addressip_address - Specify an IPv4 address to map to the
MAC address.
Example
Use the following commands to configure a reservation for MAC address,
80:A9:97:27:1A:AC, and IPv4 address, 172.26.23.25
to the subnet reservation. 172.16.23.11/32:
Use the show dhcp server command to display DHCP server information.
Command Mode
EXEC
Command Syntax
show dhcp server [ipv4 | ipv6 |
leases | vrf]
Parameters
ipv4 Displays details related to IPv4.
ipv6 Displays details related to IPv6.
leases Displays active leases.
A.B.C.D/E IPv4 subnet.
NAME Subnet name.
Examples
The following output displays
DHCPv4.
switch# show dhcp server ipv4
IPv4 DHCP Server is active
Debug log is enabled
DNS server(s): 10.2.2.2
DNS domain name: mydomain
Lease duration: 1 days 0 hours 0 minutes
TFTP server:
myserver (Option 66)
10.0.0.3 (Option 150)
TFTP file: fileFoo
Active Leases: 1
IPv4 DHCP interface status:
Interface Status
-------------------------------------------------
Ethernet1 Inactive (Could not determine VRF)
Ethernet2 Inactive (Not in default VRF)
Ethernet3 Inactive (Kernel interface not created yet)
Ethernet4 Inactive (Not up)
Ethernet5 Inactive (No IP address)
Ethernet6 Active
Vendor information:
Vendor ID: default
Sub-options Data
---------------- ----------------
1 192.0.2.0, 192.0.2.1
Vendor ID: vendorFoo
Sub-options Data
---------------- -----------
2 192.0.2.2
3 “data”
Subnet: 10.0.0.0/8
Subnet name: subnetFoo
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.1.1.1 10.2.2.2
Lease duration: 3 days 3 hours 3 minutes
Default gateway address: 10.0.0.3
TFTP server:
subnetServerFoo (Option 66)
10.0.0.4 (Option 150)
TFTP boot file: subnetFiletftp
Active leases: 1
Reservations:
MAC address: 1a1b.1c1d.1e1f
IPv4 address: 10.0.0.1
MAC address: 2a2b.2c2d.2e2f
IPv4 address: 10.0.0.2
In this example, DHCPv6 is configured with subnet
fe80::/10 while being enabled on
Ethernet1 with address
fe80::1/64 and on Ethernet3
with address
fe80::2/64.
switch# show dhcp server ipv6
IPv6 DHCP server is active
Debug log is enabled
DNS server(s): fe80::6
DNS domain name: testaristanetworks.com
Lease duration: 1 days 3 hours 30 minutes
Active leases: 0
IPv6 DHCP interface status:
Interface Status
--------------- ------
Ethernet1 Active
Ethernet3 Active
Subnet: fe80::/10
Subnet name: foo
Range: fe80::1 to fe80::3
DNS server(s): fe80::4 fe80::5
Direct: Inactive (Multiple interfaces match this subnet: Ethernet1 Ethernet3)
Relay: Active
Active leases: 0
This example illustrates when multiple subnets match an interface. In this example,
DHCPv6 is configured with subnets fc00::/7 and
fe80::/10 while being enabled on Ethernet1 with
address fe80::1/10 and
fc00::1/7.
switch# show dhcp server ipv6
IPv6 DHCP server is active
DNS server(s): fc00::2
DNS domain name: testaristanetworks.com
Lease duration: 1 days 3 hours 30 minutes
Active leases: 0
IPv6 DHCP interface status:
Interface Status
--------------- ------
Ethernet1 Active
Subnet: fc00::/7
Subnet name: data
Range: fc00::1 to fc00::5
DNS server(s): fc00::6 fc00::8
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
Active leases: 0
Subnet: fe80::/10
Subnet name: bar
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
Active leases: 0
After disabling a subnet, the show dhcp server command
displays the disable message with a reason. The number of active leases of the
disabled subnets displays as 0. In this example, there are
overlapping subnets.
switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
Interface Status
-------------------------------------------------
Ethernet1 Active
Subnet: 10.0.0.0/24 (Subnet is disabled - overlapping subnet 10.0.0.0/8)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0
Subnet: 10.0.0.0/8 (Subnet is disabled - overlapping subnet 10.0.0.0/24)
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0
In this example, the display output shows overlapping
ranges.
switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
Interface Status
-------------------------------------------------
Ethernet1 Active
Subnet: 10.0.0.0/8 (Subnet is disabled - range 10.0.0.9-10.0.0.12 overlaps with an existing pool)
Range: 10.0.0.1 to 10.0.0.10
Range: 10.0.0.9 to 10.0.0.12
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0
This example displays duplicate static IP address
reservation.
Subnet: 10.0.0.0/8 (Subnet is disabled - ipv4-address 10.0.0.11 is reserved more than once)
Subnet name:
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0
Reservations:
MAC address: 1a1b.1c1d.1e1f
IPv4 address: 10.0.0.11
MAC address: 2a2b.2c2d.2e2f
IPv4 address: 10.0.0.11
Use the show dhcp server leases command to display
detailed information about the IP addresses allocated by the DHCP Server (including
the IP address, the expected end time for that address, the time when the address is
handed out, and the equivalent MAC
address).
switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a
2000:0:0:40::b
End: 2019/06/20 18:06:33 UTC
Last transaction: 2019/06/20 14:36:33 UTC
MAC address: 165a.a86d.ffac
show dhcp server leases
Use the show dhcp server leases command to display DHCP server lease information.
Command Mode
EXEC
Command Syntax
show dhcp server leases [ipv4 | ipv6]
Parameters
ipv4 - Displays details related to IPv4.
ipv6 - Displays details related to IPv6.
Example
Use the show dhcp server leases command to display detailed
information about the IP addresses allocated by the DHCP Server including the IP
address, the expected end time for that address, the time when assigning the address,
and the equivalent MAC
address.
switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a
2000:0:0:40::b
End: 2019/06/20 18:06:33 UTC
Last transaction: 2019/06/20 14:36:33 UTC
MAC address: 165a.a86d.ffac
show ip dhcp relay
The show ip dhcp relay command displays the DHCP relay
agent configuration status on the switch.
Command Mode
EXEC
Command Syntax
show ip dhcp relay
Example
This command displays the DHCP relay agent configuration
status.
switch> show ip dhcp relay
DHCP Relay is active
DHCP Relay Option (82)is enabled
DHCP Relay vendor-specific suboption (9) under information option (82)
DHCP Smart Relay is enabled
Interface: Vlan100
DHCP Smart Relay is disabled
DHCP servers: 10.4.4.4
switch>
show ip dhcp relay counters
The show ip dhcp relay counters command displays the number
of DHCP packets received, forwarded, or dropped on the switch and on all interfaces
enabled as DHCP relay agents.
Command Mode
EXEC
Command Syntax
show ip dhcp relay counters
Example
This command displays the IP DHCP relay counter
table.
switch> show ip dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 376 376 0 | 4 days, 19:55:12 ago
All Resp | 277 277 0 |
| |
Vlan1000 | 0 0 0 | 4 days, 19:54:24 ago
Vlan1036 | 376 277 0 | 4 days, 19:54:24 ago
switch>
show ip dhcp snooping
The show ip dhcp snooping command displays the DHCP
snooping configuration.
Command Mode
EXEC
Command Syntax
show ip dhcp snooping
Example
This command displays the switch’s DHCP snooping
configuration.
switch> show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
100
DHCP Snooping is operational on following VLANs:
100
Insertion of Option-82 is enabled
Circuit-id format: Interface name:Vlan ID
Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch>
show ip dhcp snooping
counters
The show ip dhcp snooping counters command displays
counters that track the quantity of DHCP request and reply packets received by the
switch. The output displays data for each VLAN or aggregated for all VLANs with
counters for packets dropped.
Command Mode
EXEC
Command Syntax
show ip dhcp snooping counters
[counter_typedebug]
Parameters
counter_type - Displays the type of counter.
no parameter - Command displays counters for each VLAN.
debug - Command displays aggregate counters and
drop cause counters.
Examples
This command displays the number of DHCP packets sent and received on each
VLAN.
switch> show ip dhcp snooping counters
| Dhcp Request Pkts | Dhcp Reply Pkts |
Vlan | Rcvd Fwdd Drop | Rcvd Fwdd Drop | Last Cleared
-----|------ ----- ------|----- ---- ------|-------------
100 | 0 0 0 | 0 0 0 | 0:35:39 ago
switch>
This command displays the number of DHCP packets sent on the
switch.
switch> show ip dhcp snooping counters debug
Counter Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received 0 0
Forwarded 0 0
Dropped - Invalid VlanId 0 0
Dropped - Parse error 0 0
Dropped - Invalid Dhcp Optype 0 0
Dropped - Invalid Info Option 0 0
Dropped - Snooping disabled 0 0
Last Cleared: 3:37:18 ago
switch>
show ip dhcp snooping
hardware
The show ip dhcp snooping hardware command displays
internal hardware DHCP snooping status on the switch.
Command Mode
EXEC
Command Syntax
show ip dhcp snooping hardware
Example
This command DHCP snooping hardware
status.
switch> show ip dhcp snooping hardware
DHCP Snooping is enabled
DHCP Snooping is enabled on following VLANs:
None
Vlans enabled per Slice
Slice: FixedSystem
None
switch>
show ipv6 dhcp relay
counters
The show ipv6 dhcp relay counters command displays the
number of DHCP packets received, forwarded, or dropped on the switch and on all
interfaces enabled as DHCP relay agents.
Command Mode
EXEC
Command Syntax
show ipv6 dhcp relay counters
Example
This command displays the IP DHCP relay counter
table.
switch> show ipv6 dhcp relay counters
| Dhcp Packets |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req | 376 376 0 | 4 days, 19:55:12 ago
All Resp | 277 277 0 |
| |
Ethernet4 | 207 148 0 | 4 days, 19:54:24 ago
switch>
show ipv6 dhcp snooping
The show ipv6 dhcp snooping command displays information
about the DHCP snooping configuration.
This command displays the switch’s DHCP snooping
configuration.
switch# show ipv6 dhcp snooping
DHCPv6 Snooping is enabled
DHCPv6 Snooping is operational
DHCPv6 Snooping is configured on following VLANs:
2789-2790
DHCPv6 Snooping is operational on following VLANs:
2789
Insertion of Option-37 is enabled
show ipv6 dhcp snooping
counters
The show ipv6 dhcp snooping counters command displays
counters that track the quantity of DHCP request and reply packets that the switch
receives. Data is either presented for each VLAN or aggregated for all VLANs with
counters for packets dropped.
Command Mode
EXEC
Command Syntax
show ipv6 dhcp snooping counters [COUNTER_TYPE]
Parameters
COUNTER_TYPE The type of counter that the
command displays.
no parameter command displays counters for each VLAN.
debug command displays aggregate counters and
drop cause counters.
Examples
This command displays the number of DHCP packets sent and received on each
VLAN.
switch# show ipv6 dhcp snooping counters
| Dhcpv6 Request Pkts | Dhcpv6 Reply Pkts |
Vlan | Rcvd Fwdd Drop | Rcvd Fwdd Drop | Last Cleared
-----|------ ------ -------|------ ----- ------|-------------
2789 | 1 1 0 | 1 1 0 | 0:03:09 ago
This command displays the number of DHCP packets sent on the
switch.
switch# show ipv6 dhcp snooping counters debug
Counter Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received 1 1
Forwarded 1 1
Dropped - Invalid VlanId 0 0
Dropped - Parse error 0 0
Dropped - Invalid Dhcp Optype 0 0
Dropped - Invalid Remote-ID Option 0 0
Dropped - Snooping disabled 0 0
Last Cleared: 0:04:29 ago
show ipv6 dhcp snooping
hardware
The show ipv6 dhcp snooping hardware command displays
internal hardware DHCP snooping status on the switch.
Command Mode
EXEC
Command Syntax
show ipv6 dhcp snooping hardware
Example
This command displays DHCP snooping hardware
status.
switch# show ipv6 dhcp snooping hardware
DHCPv6 Snooping is enabled
DHCPv6 Snooping is enabled on following VLANs:
2789
Vlans enabled per Slice
Slice: Linecard0-0
2789
Slice: Linecard0-1
2789
Slice: Linecard0-2
2789
Slice: Linecard0-3
2789
A virtual IP (VIP) address
is an IP address that does not directly connect to a specific interface.
Inbound packets sent to a Virtual IP address are redirected to a physical
network interface. VIPs support connection redundancy by assigning the
address to multiple switches. If one device becomes unavailable, packets
sent to the address are still serviced by the functioning device.
Arista switches support virtual IP addresses through Virtual Router Redundancy Protocol, version
2 (VRRPv2), Virtual Router Redundancy Protocol, version 3
(VRRPv3), and Virtual-ARP (VARP). This section describes the
Arista switch support of virtual IP addresses and contains these
topics:
A virtual router, also known as a virtual router group, is defined by a Virtual Router Identifier
(VRID) and a virtual IP address. A virtual routers mapping of
VRID and IP address must be consistent among all switches
implementing the virtual router group. A virtual routers scope
is restricted to a single LAN.
A LAN may contain multiple virtual routers for distributing traffic. Each virtual router on a LAN
is assigned a unique VRID. A switch may be configured with
virtual routers among multiple LANs.
VRRP uses priority ratings to assign Master
or Backup roles for each VRRP router configured for a virtual router
group. The Master router sends periodic VRRP Advertisement messages along
the LAN and forwards packets received by the virtual router to their
destination. Backup routers are inactive but are available to assume
Master router duties when the current Master fails.
A VRRP can be configured to allow VRRP
routers with higher priority to take over Master router duties. Alternatively,
the group can be configured to prevent a router from preemptively assuming
the Master role. A VRRP router is always assigned the Master of any virtual
router configured with the address owned by the VRRP router, regardless
of the preemption prevention setting.
On 7280R3, 7500R3 and 7800R3 series, maximally 14 unique VRRP groups can
be configured along with VARP and MLAG Peer gateway virtual MAC
capabilities.
VRRPv3
RFC 5798 defines version 3 of the Virtual Router Redundancy Protocol (VRRP) for both
IPv4 and IPv6. It is based on version 2 of VRRP, as defined in RFC 3768.
VARP
Virtual VRRP (VARP) allows multiple switches to simultaneously route packets from a common IP
address in an active-active router configuration. Each switch is configured
with the same set of virtual IP addresses on corresponding VLAN interfaces
and a common virtual MAC address. In MLAG configurations, VARP is preferred
over VRRP because VARP does not require traffic to traverse the peer-link to
the master router as VRRP would.
A maximum of 500 virtual IP addresses
can be assigned to a VLAN interface. All virtual addresses on all VLAN
interfaces resolve to the same virtual MAC address.
VARP functions by having each switch respond
to ARP and GARP requests for the configured router IP address with the
virtual MAC address. The virtual MAC address is only for inbound packets
and never used in the source field of outbound packets.
When ip routing is enabled, packets to the virtual MAC address are
routed to the next hop destination.Figure 1. VARP Configuration
The following topics are included in this section:
To implement a virtual router, it must be configured and
enabled. A virtual router is typically configured before it is
enabled; this ensures that the VRRP router operates as required
before its priority settings immediately make it the master
virtual router. Because assigning a primary address to a virtual
router enables it, address assignment is normally performed
after all other configuration tasks.
The no vrrp command
removes all VRRP commands for the specified virtual router from
running-config.
Virtual Router Configuration
Most configuration tasks are optional because all mandatory parameters have a default value. The
following virtual router parameters are configurable:
VRRP version (default = version 2)
Router priority (default = 100)
Preemption option (default is enabled)
Advertisement timer (default = one second)
Description (optional parameter)
Peer authentication (optional parameter)
Secondary IP addresses (optional parameter)
VRRP Version
The vrrp ipv4 version command
sets the version of VRRP for the corresponding IPv4 virtual router. IPv6 version is
not configurable as it only supports version 3. The version selected in a VRRP group
can either be same for all group members or independent of each other. By default,
Arista switches use VRRP version 2, which supports only IPv4 environments. VRRP
version 3 supports both IPv4 and IPv6 environments.
Example
This command causes vlan 20 to use VRRP version
3.
The VRRP routers within a virtual router group determine the Master router through priority
settings. Priority values range from 254 (highest
priority) to 1 (lowest priority). Priority is either set
by a CLI command or is assigned the default value of 100.
A switch specifies priority settings for each of its virtual routers. Once set, VRRP
priority level can also be changed by a tracked object. The vrrp tracked-object
command configures the VRRP client process to track an object created by the track command and
react if its status changes to down.
Preemption mode determines when a VRRP router with a higher priority rating becomes the Master
router. If preemption is enabled, the VRRP router with the highest priority immediately becomes the
Master router. If preemption is disabled, a VRRP router with a higher priority value does not become
the Master router unless the current Master becomes unavailable; this is applicable when a new VRRP
router becomes available on the LAN or VRRP routers priority value changes for the virtual
router.
The vrrp priority-level command
configures the switchs priority setting for the specified virtual router.
Example
This command sets the priority value of 250 for the virtual
router with VRID 15 on VLAN
20.
The vrrp preempt delay command
configures a period between an event that elevates a switch to master VRRP router
status and the switch's assumption of master VRRP router role. Command options
configure delays during normal operation and after a switch reboot.
Advertisement Interval
The Master router sends periodic VRRP Advertisement messages to other VRRP routers. The vrrp advertisement
interval command specifies the interval between successive
advertisement message transmissions.
The advertisement interval also defines the timeout that determines when the switch assumes the
Master router role. This timeout interval is three times the advertisement interval.
Example
This command sets the advertisement interval of 10 seconds
for virtual router 35 on vlan
100.
The vrrp session
description command associates a text string to the specified
virtual router. The maximum string length is 80
characters. The string has no functional impact on the virtual router.
Example
This command associates the text string Laboratory Router
to virtual router 15 on vlan
20.
VRRP peer authentication validates VRRP advertisement packets that the switch receives from other
VRRP routers in a specified virtual router group. When a virtual router uses authentication, all
VRRP routers in the group must use the same authentication parameters.
The vrrp peer
authentication command configures virtual router authentication
parameters for the specified virtual router.
Example
This command implements plain-text authentication, using
12345 as the key, for virtual router
40 on vlan
100.
switch(config-if-vl100)#vrrp 40 peer authentication text 12345
switch(config-if-vl100)#
Secondary Addresses
The vrrp ipv4 secondary
command assigns a secondary IP address to a virtual router. Secondary addresses are
optional; a virtual routers configuration may include more than one secondary
address command. The primary and secondary address list must be identical for all
switches in a virtual router group.
Virtual Router Enabling and
the Primary IP address
The vrrp ipv4 command configures
the primary IP address of the specified virtual router and enables the virtual router if the primary
address is contained within the configuration mode interfaces IP address subnet. A virtual routers
configuration may contain only one primary IP address assignment command; subsequent
vrrp ipv4 commands reassign the virtual routers primary IP address.
Example
This command enables virtual router group 15 (VRID) on
vlan 20 and assigns
10.1.1.5 as the virtual routers
primary
address.
The vrrp disabled command
places the switch in stopped state for the specified virtual router. While in stopped
state, the switch cannot act as a Master or backup router for the virtual router group.
The no vrrp disabled command changes the switchs virtual
router state to backup or master if the virtual router is properly
configured.
VRRP can also be shut down when the status of a tracked object configured by the vrrp tracked-object
command changes to down.
Examples
This command places the switch in stopped mode for virtual router
24 on vlan
20.
This command moves the switch out of stopped mode for virtual router
24 on vlan
20.
switch(config-if-vl20)# no vrrp 24 disabled
switch(config-if-vl20)#
This command configures the switch to enter stopped mode for virtual router
24 on vlan
20 if the status of tracked-object
interfaceE6/48 changes to
down.
The no vrrp and no vrrp ipv4 commands delete the
specified virtual IP address from the interface. Additionally, the no
vrrp command removes all residual VRRP commands for the virtual
router.
Examples
This command removes all VRRP configuration commands for virtual router
10 on vlan
15.
switch(config-if-vl15)# no vrrp 10
switch(config-if-vl15)#
This command disables virtual router 25 on
vlan20 and removes the primary IP address from
its
configuration.
switch(config-if-vl20)# no vrrp 25 ipv4 10.1.1.5
switch(config-if-vl20)#
VRRP Configuration for IPv6
To implement a virtual router,
it must be configured and enabled. A virtual router is typically configured
before it is enabled; this ensures that the VRRP router operates as required
before its priority settings immediately make it the master virtual router.
Because assigning a primary address to a virtual router enables it, address
assignment is normally performed after all other configuration tasks.
The no vrrp command removes all VRRP
commands for the specified virtual router from
running-config.
Configuring VRRP for IPv6
Specify the VRRP Version
The vrrp ipv4 version command
sets the version of VRRP used on an interface. The version selected in a VRRP group
must be the same for all group members. By default, Arista switches use VRRP version
2, which is not compatible with IPv6.
Example
This command causes vlan 20 to use VRRP version
3.
The vrrp tracked-object command
configures the VRRP client process to track an object created by the track command and
react if its status changes to down.
Example
This command causes interface vlan 20 to disable VRRP when
tracked object ETH8 changes
state.
Preemption mode determines when a VRRP router with a higher priority rating becomes the Master
router. If preemption is enabled, the VRRP router with the highest priority immediately becomes the
Master router. If preemption is disabled, a VRRP router with a higher priority value does not become
the Master router unless the current Master becomes unavailable; this is applicable when a new VRRP
router becomes available on the LAN or VRRP routers priority value changes for the virtual
router.
The vrrp preempt command controls the
preempt mode setting of the specified virtual router. By default, preempt mode is
enabled.
Example
This command enables preempt mode for the virtual router 30
on vlan
20.
Use the following commands
to display the VRRP configurations and status.
Show VRRP Group
The show vrrp command displays information
about the Virtual Router Redundancy Protocol (VRRP) groups configured on a specified
interface.
Example
This command displays a table of information for VRRP groups on the
switch.
switch# show vrrp interface vlan 3060 brief
Interface Id Ver Pri Time State VrIps
Vlan3060 1 3 100 3609 Master 2001::2
2001::3
Vlan3060 2 3 100 3609 Master 2002::2
2002::3
switch#
VARP Configuration
Implementing VARP consists
of assigning virtual IP addresses to VLAN interfaces and configuring
a virtual MAC address.
Virtual IP Addresses
The ip virtual-router
address command assigns a virtual IP address to the VLAN interface being
configured. Unlike VRRP, the virtual IP address does not have to be in the same subnet as
the physical interface.
A virtual IPv4 address may optionally be configured with a subnet, but doing so modifies the
behavior of ARP requests sent from the router. When the router sends an ARP request for an
IPv4 address in a virtual subnet, the ARP request uses the virtual IPv4 address as the
source IP address and the virtual MAC address as the source MAC address inside the ARP
header. For virtual IP addresses configured without the subnet option, no modifications are
made to outgoing ARP requests.
Examples
These commands configure a Switch Virtual Interface (SVI) and a virtual IP address for
VLAN
10.
These commands configure a Switch Virtual Interface (SVI) and a virtual IPv4 address
with a subnet for vlan 10. A static route is added to indicate
that the virtual subnet is reachable through vlan
10.
switch(config)# ip route 192.0.0.0/24 vlan 10
switch(config)# interface vlan 10
switch(config-if-Vl10)# ip address 10.0.0.2/24
switch(config-if-Vl10)# ip virtual-router address 192.0.0.6/24
switch(config-if-Vl10)# exit
switch(config)#
Virtual MAC Address
The ip virtual-router
mac-address command assigns a virtual MAC address to the switch. The
switch maps all virtual router IP addresses to this MAC address. The address is
receive-only; the switch never sends packets with this address as the source.
When the destination MAC of a packet destined to a remote network matches the virtual MAC
address, the MLAG peer forwards the traffic to the next hop destination. Each MLAG peer must
have the same routes available, either through static configuration or learned through a
dynamic routing protocol.
Example
This command configures a virtual MAC
address.
switch(config)# ip virtual-router mac-address 001c.7300.0099
switch(config)#
Show Virtual MAC Address
To display the virtual router MAC and IP addresses, enter the show ip virtual-router
command.
Example
This command displays the virtual router addresses assigned on the
switch.
switch# show ip virtual-router
IP virtual router is configured with MAC address: 24cd.5a29.cc31
Interface IP Address Virtual IP Address Status Protocol
Vlan15 10.1.1.3/24 10.1.1.15 up up
Vlan15 10.1.1.3/24 10.1.1.16 up up
Vlan15 10.1.1.3/24 10.1.1.17 up up
Vlan20 10.12.1.6/24 10.1.1.51 up up
Vlan20 10.12.1.6/24 10.1.1.53 up up
Vlan20 10.12.1.6/24 10.1.1.55 up up
switch#
Show IPv6 Virtual-Router
The show ipv6
virtual-router command displays the virtual MAC address assigned to the
switch and all virtual IPv6 addresses assigned to each VLAN interface.
Example
This command displays a table of information for IPv6 VRRP groups on the
switch.
switch# show ipv6 virtual-router
IP virtual router is configured with MAC address: 001c.7300.0099
MAC address advertisement interval: 30 seconds
Interface Vlan4094
State is up
Protocol is up
IPv6 address
2001:b8:2001::1011/64
Virtual IPv6 address
2001:db8:ac10:fe01::
switch#
This section provides code that implements three VRRP configurations:
Example 1 configures two switches in a single virtual router group. This
implementation protects the LAN against the failure of one router.
Example 2 configures two switches into two virtual routers within a single LAN.
This implementation protects the LAN against the failure of one router and
balances traffic between the routers.
Example 3 configures three switches to implement virtual routers on two LANs.
Each LAN contains two virtual routers. One switch is configured into four
virtual routers – two on each LAN.
VRRP Example 1: One Virtual Router on One
LAN
The network diagram displays the Example 1 network. Two switches are configured as VRRP routers
to form one virtual router.Figure 2. VRRP Example 1 Network Diagram
The following code configures the first switch (Router A) as the master
router and the second switch (Router B) as a
backup router for virtual router 10 on
vlan 50. Router
A becomes the Master virtual router by setting
its priority at 200; Router
B maintains the default priority of
100. The advertisement interval is
three seconds on both switches. Priority preemption is enabled by
default.
Switch Code that Implements Router A on the First Switch
switch-A(config)# interface vlan 50
switch-A(config-if-vl50)# ip address 10.10.4.1/24
switch-A(config-if-vl50)# no vrrp 10
switch-A(config-if-vl50)# vrrp 10 priority 200
switch-A(config-if-vl50)# vrrp 10 advertisement interval 3
switch-A(config-if-vl50)# vrrp 10 ip 10.10.4.10
switch-A(config-if-vl50)# exit
Switch Code that Implements Router B on the Second Switch
switch-B(config)# interface vlan 50
switch-B(config-if-vl50)# ip address 10.10.4.2/24
switch-B(config-if-vl50)# no vrrp 10
switch-B(config-if-vl50)# vrrp 10 advertisement interval 3
switch-B(config-if-vl50)# vrrp 10 ip 10.10.4.10
switch-B(config-if-vl50)# exit
VRRP Example 2: Two Virtual Routers on One
LAN
The network diagram displays Example 2. Two switches are configured as VRRP routers to form two
virtual routers on one LAN. Using two virtual routers distributes the LAN
traffic between the switches.Figure 3. VRRP Example 2 Network Diagram
The following code configures two switches as a master and a backup router for two virtual
routers on vlan 50.
Router A is the master for virtual
router 10 and backup for virtual
router 20.
Router B is the master for virtual
router 20 and backup for virtual
router 10.
VRRP advertisement interval is 3
seconds on virtual router 10 and
5 seconds on virtual
router 20.
Priority preemption is enabled by default for both virtual
routers.
Switch Code that Implements Router A on the First Switch
switch-A(config)# interface vlan 50
switch-A(config-if-vl50)# ip address 10.10.4.1/24
switch-A(config-if-vl50)# no vrrp 10
switch-A(config-if-vl50)# vrrp 10 priority 200
switch-A(config-if-vl50)# vrrp 10 advertisement interval 3
switch-A(config-if-vl50)# vrrp 10 ip 10.10.4.10
switch-A(config-if-vl50)# no vrrp 20
switch-A(config-if-vl50)# vrrp 20 advertisement interval 5
switch-A(config-if-vl50)# vrrp 20 ip 10.10.4.20
switch-A(config-if-vl50)# exit
Switch Code that Implements Router B on the Second Switch
switch-B(config)# interface vlan 50
switch-B(config-if-vl50)# ip address 10.10.4.2/24
switch-B(config-if-vl50)# no vrrp 10
switch-B(config-if-vl50)# vrrp 10 advertisement interval 3
switch-B(config-if-vl50)# vrrp 10 ip 10.10.4.10
switch-B(config-if-vl50)# no vrrp 20
switch-B(config-if-vl50)# vrrp 20 priority 200
switch-B(config-if-vl50)# vrrp 20 advertisement interval 5
switch-B(config-if-vl50)# vrrp 20 ip 10.10.4.20
switch-B(config-if-vl50)# exit
VRRP Example 3: Two Virtual Routers on Two
LANs
The network diagram displays Example 3. Three switches are configured as VRRP routers to form
four virtual router groups two groups on each of two LANs.Figure 4. VRRP Example 3 Network Diagram
The following code configures the three switches as follows:
Router A is the master for virtual
router 10 and backup for virtual
router 20 on vlan
100.
Router A is the master for virtual
router 30 and backup for virtual
router 40 on vlan
150.
Router B is the master for virtual
router 20 and backup for virtual
router 10 on vlan
100.
Router C is the master for virtual
router 40 and backup for virtual
router 30 on vlan
150.
VRRP advertisement interval is set to one second on all virtual
routers.
Priority preemption is disabled on all virtual routers.
Switch Code that Implements Router A on the First Switch
switch-A(config)# interface vlan 100
switch-A(config-if-vl100)# ip address 10.10.4.1/24
switch-A(config-if-vl100)# no vrrp 10
switch-A(config-if-vl100)# vrrp 10 priority 200
switch-A(config-if-vl100)# no vrrp 10 preempt
switch-A(config-if-vl100)# vrrp 10 ip 10.10.4.10
switch-A(config-if-vl100)# vrrp 10 advertisement interval 1
switch-A(config-if-vl100)# no vrrp 20
switch-A(config-if-vl100)# no vrrp 20 preempt
switch-A(config-if-vl100)# vrrp 20 ip 10.10.4.20
switch-A(config-if-vl100)# interface vlan 150
switch-A(config-if-vl150)# ip address 40.10.5.7/24
switch-A(config-if-vl150)# no vrrp 30
switch-A(config-if-vl150)# vrrp 30 priority 200
switch-A(config-if-vl150)# no vrrp 30 preempt
switch-A(config-if-vl150)# vrrp 30 ip 40.10.5.31
switch-A(config-if-vl100)# vrrp 30 advertisement interval 1
switch-A(config-if-vl150)# no vrrp 40
switch-A(config-if-vl150)# no vrrp 40 preempt
switch-A(config-if-vl150)# vrrp 40 ip 40.10.5.32
switch-A(config-if-vl150)# exit
Switch Code that Implements Router B on the Second Switch
switch-B(config)# interface vlan 100
switch-B(config-if-vl100)# ip address 10.10.4.2/24
switch-B(config-if-vl100)# no vrrp 10
switch-B(config-if-vl100)# no vrrp 10 preempt
switch-B(config-if-vl100)# vrrp 10 ip 10.10.4.10
switch-B(config-if-vl100)# no vrrp 20
switch-B(config-if-vl100)# vrrp 20 priority 200
switch-B(config-if-vl100)# no vrrp 20 preempt
switch-B(config-if-vl100)# vrrp 20 ip 10.10.4.20
switch-A(config-if-vl100)# vrrp 20 advertisement interval 1
switch-B(config-if-vl100)# exit
Switch Code that Implements Router C on the Third Switch
switch-C(config)# interface vlan 150
switch-C(config-if-vl150)# ip address 40.10.5.8/24
switch-C(config-if-vl150)# no vrrp 30
switch-C(config-if-vl150)# no vrrp 30 preempt
switch-C(config-if-vl150)# vrrp 30 ip 40.10.5.31
switch-C(config-if-vl150)# no vrrp 40
switch-C(config-if-vl150)# vrrp 40 priority 200
switch-C(config-if-vl150)# no vrrp 40 preempt
switch-C(config-if-vl150)# vrrp 40 ip 40.10.5.32
switch-A(config-if-vl100)# vrrp 40 advertisement interval 1
switch-C(config-if-vl150)# exit
VARP Example
This section provides code that implements a VARP configuration. The network diagram displays the
Example 1 network. Two switches in an MLAG domain are configured as VARP routers.
The following code configures 10.10.4.10 as the virtual IP
address for VLAN 50,
10.24.4.1 as the virtual IP
address for VLAN 70, and
001c.7300.0999 as the virtual MAC
address on both switches.Figure 5. VARP Example Network Diagram
Switch Code that Implements VARP on the First Switch
switch-A(config)# ip virtual-router mac-address 001c.7300.0999
switch-A(config)# interface vlan 50
switch-A(config-if-vl50)# ip address 10.10.4.1/24
switch-A(config-if-vl50)# ip virtual-router address 10.10.4.10
switch-A(config-if-vl50)# interface vlan 70
switch-A(config-if-vl70)# ip address 10.24.4.17/24
switch-A(config-if-vl70)# ip virtual-router address 10.24.4.1
switch-A(config-if-vl70)# exit
Switch Code that Implements VARP on the Second Switch
switch-B(config)# ip virtual-router mac-address 001c.7300.0999
switch-B(config)# interface vlan 50
switch-B(config-if-vl50)# ip address 10.10.4.2/24
switch-B(config-if-vl50)# ip virtual-router address 10.10.4.10
switch-B(config-if-vl50)# interface vlan 70
switch-B(config-if-vl70)# ip address 10.24.4.18/24
switch-B(config-if-vl70)# ip virtual-router address 10.24.4.1
switch-B(config-if-vl70)# exit
VRRP and VARP Configuration
Commands
This section contains descriptions
of CLI commands that support VRRP and VARP.
The ip fhrp accept-mode command configures the switch to
permit SSH access to the VRRP Master and VARP Master router. All routers within a
VRRP or VARP group should be configured consistently. By default, SSH access to the
VRRP and VARP Master routers is not permitted.
The no ip fhrp accept-mode and default ip fhrp
accept-mode commands restores the default SSH access
availability by removing the ip fhrp accept-mode command
from running-config.
Command Mode
Global Configuration
Command Syntax
ip fhrp accept-mode
no ip fhrp accept-mode
default ip fhrp accept-mode
Example
This command configures the switch to permit SSH access to the VRRP and VARP Master
routers.
switch(config)# ip fhrp accept-mode
switch(config)# show running-config
!
ip fhrp accept-mode
!
switch(config)#
ip virtual-router address
The ip virtual-router address command assigns a virtual
IPv4 address to the VLAN interface being configured. (To assign a virtual IPv6
address to a VLAN interface, use the ipv6 virtual-router
address command.) Unlike VRRP, the virtual IP address does
not have to be in the same subnet as the physical interface.
A virtual IP address may optionally be
configured with a subnet, but doing so will modify the behavior of ARP
requests sent from the router. When the router sends an ARP request for
an IP address in a virtual subnet, the ARP request will use the virtual
IP address as the source IP address and the virtual MAC address as the
source MAC address inside the ARP header. For virtual IP addresses
configured without the subnet option, no modifications are made to outgoing
ARP requests.
A maximum of 500 virtual IP addresses can be assigned to a
VLAN interface. All virtual addresses on all VLAN interfaces resolve to the same
virtual MAC address configured through the ip virtual-router
mac-address command.
This command is typically used in MLAG
configurations to create identical virtual routers on switches connected
to the MLAG domain through an MLAG.
The no ip virtual-router address and default ip
virtual-router address commands remove the specified virtual
IP address from the configuration mode interface by deleting the corresponding
ip virtual-router address command from
running-config. If the command does not specify an address,
all virtual IPv4 addresses are removed from the interface.
Command Mode
Interface-VLAN Configuration
Command Syntax
ip virtual-router addressipv4_addr
no ip virtual-router address [ipv4_addr]
default ip virtual-router address
[ipv4_addr]
Parameter
ipv4_addr IP address of router. Dotted decimal
notation.
Examples
These commands configure a Switch Virtual Interface (SVI) and a virtual IP
address for vlan
10.
switch(config)# interface vlan 10
switch(config-if-Vl10)# ip address 10.0.0.2/24
switch(config-if-Vl10)# ip virtual-router address 10.0.0.6
switch(config-if-Vl10)# exit
These commands configure a Switch Virtual Interface (SVI) and a virtual IP
address with a subnet for vlan 10. A static route
is added to indicate that the virtual subnet is reachable through
vlan
10.
switch(config)# ip route 192.0.0.0/24 vlan 10
switch(config)# interface vlan 10
switch(config-if-Vl10)# ip address 10.0.0.2/24
switch(config-if-Vl10)# ip virtual-router address 192.0.0.6/24
switch(config-if-Vl10)# exit
ip virtual-router mac-address
The ip virtual-router mac-address command assigns a virtual
MAC address to the switch. The switch maps all virtual router IP addresses to this
MAC address. The address is receive-only; the switch never sends packets with this
address as the source. The virtual router is not configured on the switch until this
virtual mac-address is assigned.
This command is typically used in MLAG configurations to create identical virtual
routers on switches connected to the MLAG domain through an MLAG. When the
destination MAC of a packet destined to a remote network matches the virtual MAC
address, the MLAG peer forwards the traffic to the next hop destination. Each MLAG
peer must have the same routes available, either through static configuration or
learned through a dynamic routing protocol.
The no ip virtual-router mac-address command removes a
virtual MAC address from the interface by deleting the corresponding ip
virtual-router mac-address command from
running-config.
Command Mode
Global Configuration
Command Syntax
ip virtual-router mac-address [mac_addr]
no ip virtual-router mac address [mac_addr]
Parameter
mac_addr MAC IP address (dotted hex notation). Select an
address does not appear on the switch.
Example
This command configures a virtual MAC
address.
switch(config)# ip virtual-router mac-address 001c.7300.0099
switch(config)#
ip virtual-router mac-address
advertisement-interval
The ip virtual-router mac-address advertisement interval
command specifies the period between the transmission of consecutive gratuitous ARP
requests that contain the virtual router mac address for each virtual-router IP
address configured on the switch. The default period is 30
seconds.
The no ip virtual-router mac-address advertisement-interval
command restores the default period of 30 seconds by
removing the ip virtual-router mac-address
advertisement-interval command from
running-config.
Command Mode
Global Configuration
Command Syntax
ip virtual-router mac-address advertisement-intervalperiod
no ip virtual-router mac-address advertisement-interval
default ip virtual-router mac-address advertisement-interval
Parameter
period advertisement interval (seconds). Values range from
0 to 86400. Default is
30.
Example
This command configures a MAC address advertisement interval of one minute
(60
seconds).
switch(config)# ip virtual-router mac-address advertisement-interval 60
switch(config)#
ipv6 virtual-router address
The ipv6 virtual-router address command assigns a virtual
IPv6 address to the VLAN interface being configured. (To assign a virtual IPv4
address to a VLAN interface, use the ip virtual-router address command.) Unlike VRRP,
the virtual IP address does not have to be in the same subnet as the physical
interface.
A maximum of 500 virtual IP addresses can be assigned to a
VLAN interface. All virtual addresses on all VLAN interfaces resolve to the same
virtual MAC address configured through the ip virtual-router
mac-address command.
This command is typically used in MLAG
configurations to create identical virtual routers on switches connected
to the MLAG domain through an MLAG.
The no ipv6 virtual-router address and default
ipv6 virtual-router address commands remove the specified
virtual IPv6 address from the configuration mode interface by deleting the
corresponding ipv6 virtual-router address command from
running-config. If the command does not specify an address,
all virtual IPv6 addresses are removed from the interface.
Command Mode
Interface-VLAN Configuration
Command Syntax
ipv6 virtual-router addressnet_addr
no ipv6 virtual-router address [net_addr]
default ipv6 virtual-router address
[net_addr]
Parameter
net_addr network IPv6 address.
Example
These commands configure a Switch Virtual Interface (SVI) and a virtual IPv6 address
for vlan
10.
The no vrrp command removes all VRRP configuration commands
for the specified virtual router on the configuration mode interface. The
default vrrp command also reverts VRRP
configuration parameters to default settings by removing the corresponding
vrrp commands.
group Virtual Router Identifier (VRID). Values range from
1 to 255.
Example
This command removes all VRRP configuration commands for virtual router
group 10 on vlan
15.
switch(config)# interface vlan 15
switch(config-if-vl15)# no vrrp 10
switch(config-if-vl15)#
show ip virtual-router
The show ip virtual-router command displays the virtual MAC
address assigned to the switch and all virtual IP addresses assigned to each VLAN
interface.
Command Mode
EXEC
Command Syntax
show ip virtual-router
Messages
IP virtual router is not configured a virtual MAC address is not
assigned to the switch.
No interface with virtual IP address no virtual IP addresses are
assigned to any VLAN interfaces.
Examples
This command displays a table of information for VRRP groups on the
switch.
switch# show ip virtual-router
IP virtual router is configured with MAC address: 24cd.5a29.cc31
Interface IP Address Virtual IP Address Status Protocol
Vlan15 10.1.1.3/24 10.1.1.15 up up
Vlan15 10.1.1.3/24 10.1.1.16 up up
Vlan15 10.1.1.3/24 10.1.1.17 up up
Vlan20 10.12.1.6/24 10.1.1.51 up up
Vlan20 10.12.1.6/24 10.1.1.53 up up
Vlan20 10.12.1.6/24 10.1.1.55 up up
switch#
This command generates a response that indicates a virtual MAC address is
not assigned to the
switch.
switch# show ip virtual-router
IP virtual router is not configured
switch#
show ipv6 virtual-router
The show ipv6 virtual-router command displays the virtual
MAC address assigned to the switch and all virtual IPv6 addresses assigned to each
VLAN interface.
Command Mode
EXEC
Command Syntax
show ipv6 virtual-router
Messages
IPv6 virtual router is not configured a virtual MAC address is not
assigned to the switch.
No interface with virtual IPv6 address no virtual IPv6 addresses are
assigned to any VLAN interfaces.
Example
This command displays a table of information for IPv6 VRRP groups on the
switch.
switch# show ipv6 virtual-router
IP virtual router is configured with MAC address: 001c.7300.0099
MAC address advertisement interval: 30 seconds
Interface Vlan4094
State is up
Protocol is up
IPv6 address
2001:b8:2001::1011/64
Virtual IPv6 address
2001:db8:ac10:fe01::
switch#
show vrrp
The show vrrp command displays information about the
Virtual Router Redundancy Protocol (VRRP) groups configured on a specified
interface. Parameter options control the amount and formatting of the displayed
information.
Command Mode
Privileged EXEC
Command Syntax
show vrrp [INFO_LEVEL]
[STATES]
show vrrpINTFGROUP_NUM [INFO_LEVEL]
[STATES]
show vrrpGROUP_NUMINTF_GROUP [INFO_LEVEL]
[STATES]
Parameters
INTF specifies the VRRP groups for which the command
displays status. When the parameter is omitted or specifies only an
interface, the group list is filtered by the STATES parameter.
no parameter specified groups on all interfaces.
interface ethernete_num specified groups on Ethernet
interface.
interface loopbackl_num specified groups on loopback
interface.
interface managementm_num specified groups on management
interface.
interface port-channelp_num specified groups on port channel
interface.
interface vlanv_num specified groups on VLAN
interface.
interface VXLANvx_num specified groups on VXLAN
interface.
GROUP_NUM the VRRP ID number of the group for which
the command displays status.
no parameter all groups on specified interface.
vrid_num Virtual Router Identifier (VRID).
Value ranges from 1 to
255.
INFO_LEVEL Specifies format and amount of displayed
information. Options include:
no parameter displays a block of data for each VRRP
group.
brief displays a single table that lists
information for all VRRP groups.
STATES Specifies the groups, by VRRP router state,
that are displayed. Options include:
no parameter displays data for groups in the master or
backup states.
all displays all groups, including groups
in the stopped and interface down states.
Examples
This command displays a table of information for VRRP groups on the
switch.
switch# show vrrp brief
Interface Id Ver Pri Time State VrIps
Vlan1006 3 2 100 3609 Master 127.38.10.2
Vlan1006 4 3 100 3609 Master 127.38.10.10
Vlan1010 1 2 100 3609 Master 128.44.5.3
Vlan1014 2 2 100 3609 Master 127.16.14.2
This command displays data blocks for all VRRP groups on vlan
46, regardless of the VRRP
state.
switch# show vrrp interface vlan 1006 all
Vlan1010 - Group 1
VRRP Version 2
State is Stopped
Virtual IPv4 address is 128.44.5.3
Virtual MAC address is 0000.5e00.0101
Mac Address Advertisement interval is 30s
VRRP Advertisement interval is 1s
Preemption is enabled
Preemption delay is 0s
Preemption reload delay is 0s
Priority is 100
Master Router is 0.0.0.0
Master Advertisement interval is 1s
Skew time is 0.609s
Master Down interval is 3.609s
This command displays data for all VRRP group 2 on
vlan
1014.
switch# show vrrp interface vlan 1014 group 2
Vlan1006 - Group 2
VRRP Version 2
State is Master
Virtual IPv4 address is 127.38.10.2
Virtual MAC address is 0000.5e00.0103
Mac Address Advertisement interval is 30s
VRRP Advertisement interval is 1s
Preemption is enabled
Preemption delay is 0s
Preemption reload delay is 0s
Priority is 100
Master Router is 127.38.10.1 (local), priority is 100
Master Advertisement interval is 1s
Skew time is 0.609s
Master Down interval is 3.609s
vrrp advertisement interval
The vrrp advertisement interval command configures the
interval between successive advertisement messages that the switch sends to VRRP
routers in the specified virtual router group. The switch must be the groups Master
virtual router to send advertisement messages. The advertisement interval must be
configured identically on all physical routers in the virtual router group.
The advertisement interval also influences
the timeout interval that defines when the virtual router becomes the
master virtual router. When preemption is enabled, the virtual router
becomes the master when three times the advertisement interval elapses
after the switch detects master router priority conditions.
The no vrrp advertisement interval and default
vrrp advertisement interval commands restore the default
advertisement interval of one second for the specified virtual router by removing
the corresponding vrrp advertisement interval command from
running-config. The no
vrrp command also removes the vrrp
advertisement interval command for the specified virtual
router.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgroupadvertisement intervaladv_time
no vrrpgroupadvertisement interval
default vrrpgroupadvertisement interval
Parameters
group Virtual Router Identifier (VRID). Values
range from 1 to 255.
adv_time advertisement interval (seconds). Values
range from 1 to 255. Default value is
1.
Example
This command sets the advertisement interval of five seconds for the virtual router
35 on vlan
100.
The vrrp disabled command places the switch in stopped
state for the specified virtual router. While in stopped state, the switch cannot
act as a master or backup router for the virtual router
group.
The no vrrp disabled and default vrrp
disabled commands remove the corresponding vrrp
disabled command from running-config. This
changes the switch's virtual router state to backup or
master if the virtual router is properly configured.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgroupdisabled
no vrrpgroupdisabled
default vrrpgroupdisabled
Parameter
group Virtual Router IDentifier (VRID). Values range from
1 to 255.
Examples
These commands place the switch in stopped mode for virtual router
24 on vlan
20.
This command moves the switch out of stopped mode for virtual router
24 on vlan
20.
switch(config-if-vl20)# no vrrp 24 disabled
switch(config-if-vl20)#
vrrp ipv4
The vrrp ipv4 command configures the primary IP address for
the specified VRRP virtual router. The command also activates the virtual router if
the primary address is contained in the interfaces subnet. A VRRP virtual routers
configuration may contain only one primary IP address assignment command; subsequent
vrrp ipv4 commands replace the existing primary
address assignment.
The vrrp ipv4
secondary command assigns a secondary IP address to the VRRP
virtual router.
The no vrrp ipv4and default vrrp
ipv4 commands disable the VRRP virtual router and deletes the
primary IP address by removing the corresponding vrrp ipv4
statement from running-config. The no vrrp command also removes the
vrrp ipv4 command for the specified virtual
router.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgroupipv4ipv4_address
no vrrpgroupipv4ipv4_address
default vrrpgroupipv4ipv4_address
Parameters
group Virtual Router IDentifier (VRID). Values
range from 1 to 255.
This command excludes the pseudo-header
in IPv4 VRRPv3 checksum calculation on the VRRP group on the configuration
mode interface of the switch and supports IPv4 VRRPv3 interoperability.
The no form of the command deletes the vrrp ipv4 checksum
pseudo-header exclude configuration from the Ethernet
interface on the switch.
The exit command returns the switch to global configuration
mode.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgroupipv4 checksum pseudo-header exclude
no vrrpgroupipv4 checksum pseudo-header exclude
Parameter
group Virtual Router IDentifier (VRID). Values range from
1 to 255.
Example
This command excludes the pseudo-header in IPv4 VRRPv3 checksum calculation on VRRP
group 1 on interface ethernet
1.
The vrrp ipv4 secondary command assigns a secondary IP
address to the specified virtual router. Secondary IP addresses are an optional
virtual router parameter. A virtual router may contain multiple secondary address
commands. The IP address list must be identical for all VRRP routers in a virtual
router group.
The virtual router is assigned a primary IP address with the vrrp ipv4 command.
The no vrrp ipv4 secondary and default vrrp
ipv4 secondary commands remove the secondary IP address for
the specified VRRP virtual router by deleting the corresponding vrrp
ipv4 secondary statement from running-config. The no
vrrp command also removes all vrrp ipv4
secondary commands for the specified virtual router.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgroupipv4ipv4_addrsecondary
no vrrpgroupipv4ipv4_addrsecondary
default vrrpgroupipv4ipv4_addrsecondary
Parameters
group Virtual Router IDentifier (VRID). Values
range from 1 to 255.
ipv4_addr secondary IPv4 address of the virtual
router.
The vrrp ipv4 version command enables VRRP on the
configuration mode interface and configures the VRRP version for the specified VRRP
virtual router.
The no vrrp ipv4 version and default vrrp ipv4
version commands restore the default VRRP version to VRRPv2 by
removing the corresponding vrrp ipv4 version statement
from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgroupipv4 versionVERSION_NUMBER
no vrrpgroupipv4 version
default vrrpgroupipv4 version
Parameters
group Virtual Router IDentifier (VRID). Values
range from 1 to 255.
VERSION_NUMBER Specifies VRRP version that the
switch uses. Default value is 2 (VRRPv2) Options include:
2 VRRP v2 supports IPv4 environment.
3 VRRP v3 supports IPv4 and IPv6 environment.
Examples
This command enables VRRPv3 for IPv6 on interface ethernet
3.
switch(config)# interface ethernet 3
switch#(config-if-Et3)# vrrp 1 ipv4 version 3
This command removes VRRPv3 from interface ethernet
3 and reverts to the default
VRRPv2.
switch(config)# interface ethernet 3
switch(config-if-Et3)# no vrrp 1 ipv4 version
vrrp ipv6
The vrrp ipv6 command configures the IPv6 address for the
specified VRRP virtual router. The command also activates the virtual router if the
primary address is contained in the interfaces subnet.
The no vrrp ipv6 and default vrrp
ipv6 commands disable the VRRP virtual router and deletes the
IPv6 address by removing the corresponding vrrp ipv6
statement from running-config. The no vrrp command also removes the
vrrp ipv6 command for the specified virtual
router.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgroupipipv6_address
no vrrpgroupipipv6_address
default vrrpgroupipipv6_address
Parameters
group Virtual Router IDentifier (VRID). Values
range from 1 to
255.
ipv6_address IPv6 address of the virtual
router.
Examples
This command enables address 2001:db8:0:1::1 for
IPv6 VRRP on vlan
20.
The vrrp mac-address advertisement-interval command
specifies the interval between advertisement packets sent by the master router to
the VRRP group members.
The vrrp mac-address advertisement-interval 0,
no vrrp mac-address advertisement-interval and
default vrrp mac-address advertisement-interval
commands disable the feature by removing the vrrp mac-address
advertisement-interval command from
running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgroupmac-address advertisement-intervalperiod
no vrrpgroupmac-address
default vrrpgroupmac-address
Parameters
group Virtual Router IDentifier (VRID). Values
range from 1 to 255.
period interval in which the master router sends
advertisement packets (seconds). Value ranges from 0 to
3600. Selecting 0 as the
interval disables this feature.
Examples
This command specifies the interval between advertisement packets sent to
the members of VRRP group 3 on vlan
20.
The vrrp peer authentication command configures parameters
the switch uses to authenticate virtual router packets it receives from other VRRP
routers in the group.
The no vrrp peer authentication and default
vrrp peer authentication commands disable VRRP peer
authentication of packets from the specified virtual router by removing the
corresponding vrrp peer authentication command from
running-config . The no
vrrp command also removes the vrrp peer
authentication command for the specified virtual router.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgrouppeer authenticationAUTH_PARAMETER
no vrrpgrouppeer authentication
default vrrpgrouppeer authentication
Parameters
group Virtual Router IDentifier (VRID). Values
range from 1 to 255.
AUTH_PARAMETER encryption level and authentication
key used by router. Options include:
texttext_key plain-text authentication,
text_key is text.
text_key plain-text authentication,
text_key is text.
ietf-md5 key-string 0text_key IP authentication of MD5 key
hash, text_key is text.
ietf-md5 key-stringtext_key IP authentication of MD5 key
hash, text_key is text.
ietf-md5 key-string 7coded_key IP authentication of MD5 key
hash, coded_key is MD5 hash.
Guidelines
This command is applicable to VRRPv2 which supports IPv4 addresses only.
Examples
This command implements plain-text authentication, using
12345 as the key, for virtual router
40 on vlan
100.
The vrrp preempt command controls a virtual routers preempt
mode setting. When preempt mode is enabled, if the switch has a higher priority it
will preempt the current master virtual router. When preempt mode is disabled, the
switch can become the master virtual router only when a master virtual router is not
present on the subnet, regardless of VRRP priority level settings. By default,
preempt mode is enabled.
The no vrrp preemptcand default vrrp
preemptccommands disable preempt mode for the specified
virtual router; the default vrrp preempt command stores a
corresponding no vrrp preempt statement in
running-config. The vrrp preempt
command enables preempt mode by removing the corresponding no vrrp
preempt statement from running-config.
The no vrrp command also
enables preempt mode by removing the no vrrp preempt
command for the specified virtual router.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgrouppreempt
no vrrpgrouppreempt
default vrrpgrouppreempt
Parameter
group Virtual Router IDentifier (VRID). Values range from
1 to 255.
The vrrp preempt delay command specifies the interval
between a VRRP preemption event and the point when the switch becomes the master
VRRP router. A preemption event is any event that results in the switch having the
highest virtual router priority setting while preemption is enabled. The vrrp preempt command enables
preemption for a specified virtual router.
The command configures two delay periods:
minimum time delays master VRRP takeover when VRRP is fully
implemented.
reload time delays master VRRP takeover after VRRP is initialized
following a switch reload (boot).
Note: If the switch senses that there are no other active switches in the virtual router
group, it will bypass any configured preempt time delay and become the VRRP master
after the standard master downtime interval (3*advertisement interval + skew
time).
Running-config maintains separate delay statements for minimum
and reload parameters. Commands may list both parameters. Commands that list
one parameter do not affect the omitted parameter. Values range from 0
to 3600 seconds (one hour). The default delay is zero seconds
for both parameters.
The no vrrp preempt delay and default vrrp
preempt delay commands reset the specified delay to the
default of zero seconds. Commands that do no list either parameter resets both
periods to zero. The no
vrrp command also removes all vrrp preempt
delay commands for the specified virtual router.
This command sets the minimum and reload preempt time to
0 for virtual router
20 on vlan
40.
switch(config-if-vl40)# no vrrp 20 preempt delay
switch(config-if-vl40)#
vrrp priority-level
The vrrp priority-level command configures the switchs
priority setting for a VRRP virtual router. Priority values range from
1 to 254. The default
value is 100.
The router with the highest VRRP priority level setting for a group becomes the
master virtual router for that group. The master virtual router controls the IP
address and is responsible for forwarding traffic sent. The vrrp preempt command
controls the time when a switch can become the master virtual router.
The no vrrp priority-level and default vrrp
priority-level commands restore the default priority of 100 to
the virtual router on the configuration mode interface by removing the corresponding
vrrp priority-level command from
running-config. The no
vrrp command also removes the vrrp
priority-level command for the specified virtual router.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgrouppriority-levellevel
no vrrpgrouppriority-levellevel
default vrrpgrouppriority-levellevel
Parameters
group Virtual Router IDentifier (VRID). Values
range from 1 to 255.
level priority setting for the specified virtual
router. Values range from 1 to 254.
Example
This command sets the virtual router priority value of 250
for virtual router group 45 on vlan
20.
The vrrp session description command associates a text
string to a VRRP virtual router on the configuration mode interface. The string has
no functional impact on the virtual router. The maximum length of the string is
80 characters.
The no vrrp session description and default
vrrp session description commands remove the text string
association from the VRRP virtual router by deleting the corresponding
vrrp session description command from
running-config. The no
vrrp command also removes the vrrp session
description command for the specified virtual router.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgroupsession descriptionlabel_text
no vrrpgroupsession description
default vrrpgroupsession description
Parameters
group Virtual Router IDentifier (VRID). Values
range from 1 to 255.
label_text text that describes the virtual router.
Maximum string length is 80 characters.
Example
This command associates the text string Laboratory Router
to virtual router 15 on vlan
20.
The vrrp timers delay reload command delays the time for
VRRP initialization after a system reboot.
The no vrrp timers delay reload and default
vrrp timers delay reload commands restore the default value of
0 by deleting the vrrp timers delay
reload statement from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgrouptimers delay reload [INTERVAL]
no vrrpgrouptimers delay reload
default vrrpgrouptimers delay reload
Parameters
INTERVAL The number of seconds for the delay (seconds). Options
include:
no parameter Default value of 0
seconds.
0 to 3600 seconds. Ranges between 0 to
60 minutes.
Examples
These commands configure the VRRP reload delay interval to
15
minutes.
The vrrp tracked-object command configures the VRRP client
process on the configuration mode interface to track the specified tracked object
and react when its status changes to down. The tracked object is created by
the track
command.
The no vrrp tracked-object and default vrrp
tracked-object commands cause the VRRP client process to stop
tracking the specified tracked object by removing the corresponding vrrp
tracked-object command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
vrrpgrouptracked-objectobject_nameACTIONamount
no vrrpgrouptracked-objectobject_nameACTION
default vrrpgrouptracked-objectobject_nameACTION
Parameters
group Virtual Router IDentifier (VRID). Values
range from 1 to
255.
object_name name of tracked object.
amount amount to decrement VRRP priority level.
Values range from 1 to
254.
ACTION The action that VRRP is to take when the tracked
objects status changes to down. Options include:
decrement decrease VRRP priority level by
amount.
shutdown shut down VRRP on the
configuration mode interface.
If both decrement and
shutdown are configured on the
same interface for the same VRRP group, then VRRP will be shut down
on the interface if the tracked object is down.
Example
This command causes interface ethernet 5 to disable VRRP
when tracked object eth8 changes
state.
IPv4 and IPv6 ingress counters (count bridged and routed
traffic, supported only on front-panel ports) can be enabled and disabled using the
hardware counter feature ip in
command:
[no] hardware counter feature ip in
For IPv4 and IPv6 ingress and egress counters that include only
routed traffic (supported on Layer3 interfaces such as
routed ports and L3 subinterfaces only), use the following commands:
Note: The DCS-7300X, DCS-7250X, DCS-7050X, and DCS-7060X platforms
do not require configuration for IPv4 and IPv6 packet counters for only routed
traffic. They are collected by default. Other platforms (DCS-7280SR, DCS-7280CR, and
DCS-7500-R) need the feature enabled.
[no] hardware counter feature ip in layer3
[no] hardware counter feature ip out layer3
hardware counter feature ip
Use the hardware counter feature ip command to enable ingress
and egress counters at Layer 3. The no and default forms of the command
disables the feature. The feature is enabled by default.
Command Mode
Configuration mode
Command Syntax
hardware counter feature ip in|out layer3
no hardware counter feature ip in|out layer3
default hardware counter feature in|out layer3
Example
This example enables ingress and egress ip counters for Layer
3.
switch(config)# hardware counter feature in layer3
switch(config)# hardware counter feature out layer3
You can also query the output from the show interfaces counters
ip command through SNMP via the ARISTA-IP-MIB.
To clear the IPv4 or IPv6 counters, use the clear
counters command.
Example
switch# clear counters
Dedicated ARP Entry for TX IPv4 and IPv6 Counters
IPv4/IPv6 egress Layer 3 (hardware counter feature ip out layer3)
counting on DCS-7280SR, DCS-7280CR, and DCS-7500-R platforms work based on ARP entry of
the next hop. By default, IPv4's next-hop and IPv6's next-hop resolve to the same MAC
address and interface that shared the ARP entry.
To differentiate the counters between IPv4 and IPv6, disable
arp entry sharing with the following command:
ip hardware fib next-hop arp dedicated
Note: This command is required for IPv4 and IPv6 egress counters
to operate on the DCS-7280SR, DCS-7280CR, and DCS-7500-R platforms.
Considerations
Packet sizes greater than 9236 bytes are not counted by per-port IPv4 and IPv6 counters.
Only the DCS-7260X3, DCS-7368, DCS-7300, DCS-7050SX3, DCS-7050CX3, DCS-7280SR,
DCS-7280CR and DCS-7500-R platforms support the hardware counter feature ip in command.
The switch uses rule-based lists to control packet access to ports and to select routes for redistribution to routing domains defined by dynamic routing protocols.
This section describes the construction of Access Control Lists (ACLs), prefix lists, and route maps and includes the following topics:
The following provides an introduction to Access Control Lists (ACL), Service ACLs, Route Maps, Prefix Lists, and Router Access Control List (RACL) Divergence:
The switch processes ACLs, Service ACLs, route maps, and prefix lists in order, beginning with the first rule and continuing until a match is found.
An ACL contains a list of rules that control the inbound and outbound flow of packets into Ethernet interfaces, subinterfaces, port-channel interfaces, or the switch control plane. The switch supports implementing various filtering criteria, including IP and MAC addresses and TCP/UDP ports, with include/exclude options without compromising its performance or feature set. Filtering syntax is the industry standard.
Note: EOS supports egress IPv4 and IPv6 Port Access Control Lists (PACLs) by default. To enable egress MAC PACLs, add the configuration to the current TCAM profile.
A Service ACL applies a control-plane process to control connections to, or packets processed by, the agent process.
A route map contains a list of rules that control the redistribution of IP routes into a protocol domain based on criteria such as route metrics, access control lists, next-hop addresses, and route tags. Additionally, route maps can modify route parameters during redistribution.
A prefix list contains a list of rules that defines route redistribution access for a specified IP address space. Route maps often use prefix lists to filter routes.
The RACL divergence optimizes hardware resource usage on each forwarding ASIC. EOS installs ACLs only on the hardware components corresponding to the member interfaces of the SVIs with an applied ACL, and saves hardware resources and scales the RACLs to a larger configuration.
Tip: Use the show commands to display the interface mapping, Ternary Content Addressable Memory (TCAM) entries, and TCAM utilization information.
IPv4 matches on IPv4 source or destination addresses, with L4 modifiers including protocol, port number, IPsec tunnel interfaces, and DSCP value.
IPv6 matches on IPv6 source or destination addresses, with L4 modifiers including protocol, port number, or GRE tunnel interface.
Standard IPv4 matches only on source IPv4 addresses.
Standard IPv6 matches only on source IPv6 addresses.
MAC matches on L2 source and destination addresses.
ACLs can also be made dynamic using payload, turning them into a User-Defined Field (UDF) alias for use in other ACLs.
ACL Structure
An ACL is an ordered list of rules that defines access restrictions for the entities (the control plane or an interface) to which it is applied. Route maps also use ACLs to select routes for redistribution into specified routing domains.
ACL rules specify the data to which packet contents are compared when filtering data.
The interface forwards packets that match all commands in a permit rule.
The interface drops packets that match all commands in a deny rule.
The interface drops packets that do not match at least one rule.
Upon its arrival at an interface, the switch compares a packet’s fields to the first rule of the ACL applied to the interface. Packets that match the rule are forwarded (permit rule) or dropped (deny rule). The process continues whereby the switch compares packets that do not match the rule to the next rule in the list and continues until the packet either matches a rule or the rule list is exhausted. The interface drops packets that do not match a rule.
The sequence number designates the rule's placement in the ACL.
ACL Rules
The switch compares an ACL rule's command list to inbound and outbound packet fields. When all of a rule’s criteria match a packet’s contents, the interface performs the action specified by the rule.
The set of available commands depends on the ACL type and the specified protocol within the rule. The following is a list of commands available for supported ACL types:
IPv4 ACL Rule Parameters
All rules in IPv4 ACLs include the following criteria:
Protocol: The packet’s IP protocol. Valid rule inputs include:
Protocol name for a limited set of common protocols.
A subnet address (CIDR or address mask). Discontiguous masks are supported.
A host IP address (dotted decimal notation.)
Using any to denote that the rule matches all source addresses.
Destination Address: The packet’s destination IP address. Valid rule inputs include:
A subnet address (CIDR or address mask). Discontiguous masks are supported.
A host IP address (dotted decimal notation.)
Using any to denote that the rule matches all destination addresses.
All rules in IPv4 ACLs may include the following criteria:
Fragment: Rules filter on the fragment bit.
Time-to-live: Compares the packet TTL (time-to-live) value to a specified value and is valid in ACLs applied to the control plane. The validity of ACLs applied to the data plane varies by switch platform. Comparison options include:
Equal: Packets match if the packet value equals the statement value.
Greater than: Packets match if the packet value is greater than the statement value.
Less than: Packets match if the packet value is less than the statement value.
Not equal: Packets match if the packet value does not equal the statement value.
The availability of the following optional criteria depends on the specified protocol:
Source Ports / Destination Ports: A rule filters on ports when the specified protocol supports IP address-port combinations. Rules provide one of these port filtering values:
Using any denotes that the rule matches all ports.
A list of ports that matches the packet port. The maximum list size is 10 ports.
Negative port list. The rule matches any port not in the list. The maximum list size is 10 ports.
Integer (lower bound): The rule matches any port with a number larger than the integer.
Integer (upper bound): The rule matches any port with a number smaller than the integer.
Range integers: The rule matches any port whose number is between the integers.
Flag bits: Rules filter TCP packets on flag bits.
Message type: Rules filter ICMP type or code.
Tracked: Matches packets in existing ICMP, UDP, or TCP connections and is valid in ACLs applied to the control plane. The validity of ACLs applied to the data plane varies by switch platform.
IPv6 ACL Rule Parameters
Note: When calculating the size of ACLs, be aware that Arista switches install four rules in every IPv6 ACL so that ICMPv6 neighbor discovery packets bypass the default drop rule.
All rules in IPv6 ACLs include the following criteria:
Protocol: All rules filter on the packet’s IP protocol field. Rule input options include:
Protocol name for a limited set of common protocols.
An IPv6 prefix (CIDR). Discontiguous masks are supported.
A host IP address (dotted decimal notation).
Using any to denote that the rule matches all addresses.
Destination Address: The packet’s destination IP address. Valid rule inputs include:
A subnet address (CIDR or address mask). Discontiguous masks are supported.
A host IP address (dotted decimal notation).
Using any to denote that the rule matches all addresses.
All rules in IPv6 ACLs may include the following criteria:
Fragment: Rules filter on the fragment bit.
HOP Compares the packet’s hop-limit value to a specified value. Comparison options include:
eq: Packets match if the hop-limit value equals the statement value.
gt: Packets match if the hop-limit value is greater than the statement value.
lt: Packets match if the hop-limit value is less than the statement value.
neq: Packets match if the hop-limit value is not equal to the statement value.
The availability of the following optional criteria depends on the specified protocol:
Source Ports / Destination Ports: A rule filters on ports when the specified protocol supports IP address-port combinations. Rules provide one of these port filtering values:
Using any denotes that the rule matches all ports.
A list of ports that matches the packet port. The maximum list size is 10 ports.
Negative port list. The rule matches any port not in the list. The maximum list size is 10 ports.
Integer (lower bound): The rule matches any port with a number larger than the integer.
Integer (upper bound): The rule matches any port with a number smaller than the integer.
Range integers: The rule matches any port whose number is between the integers.
Flag bits: Rules filter TCP packets on flag bits.
Message type: Rules filter ICMP type or code.
Tracked: Matches packets in existing ICMP, UDP, or TCP connections and is valid in ACLs applied to the control plane. The validity of ACLs applied to the data plane varies by switch platform.
Standard IPv4 and IPv6 ACL Rule Parameters
Note: When calculating the size of ACLs, be aware that Arista switches install four rules in every IPv6 ACL so that ICMPv6 neighbor discovery packets bypass the default drop rule.
Standard ACLs filter only on the source address.
MAC ACL Rule Parameters
MAC ACLs filter traffic on a packet’s layer 2 header. Criteria that MAC ACLs use to filter packets include:
Source Address and Mask: The packet’s source MAC address. Valid rule inputs include:
MAC address range (address mask in 3x4 dotted hexadecimal notation).
Using any to denote that the rule matches all source addresses.
Destination Address and Mask: The packet’s destination MAC address. Valid rule inputs include:
MAC address range (address mask in 3x4 dotted hexadecimal notation).
Using any to denote that the rule matches all destination addresses.
Protocol: The packet’s protocol as specified by its EtherType field contents. Valid inputs include:
Protocol name for a limited set of common protocols.
Assigned protocol number for all protocols.
Creating and Modifying Lists
The switch provides configuration modes for creating and modifying ACLs. The command that enters an ACL configuration mode specifies the name of the list that the mode modifies. When the configuration mode is exited, the switch saves the list to the running configuration.
ACLs are created and modified in ACL configuration mode.
Standard ACLs are created and modified in Standard-ACL-configuration mode.
MAC ACLs are created and modified in MAC-ACL-configuration mode.
Lists created in one mode cannot be modified in any other mode.
A sequence number determines a rule's position within a list. New rules are inserted into a list based on their sequence numbers. You can reference a rule's sequence number to delete it from a list.
Implement an Access Control List (ACL) by assigning the list to an Ethernet interface, subinterface, port channel interface, or control plane. The switch assigns a default ACL to the control plane unless the configuration contains a valid control-plane ACL assignment statement. Ethernet and port-channel interfaces are not assigned an ACL by default. Apply standard ACLs to interfaces in the same manner as other ACLs.
IPv4 and MAC ACLs are separately applied for inbound and outbound packets. An interface or subinterface can be assigned multiple ACLs, with a limit of one ACL per packet direction per ACL type. A subset of all available switches supports Egress ACLs. The control plane does not support egress ACLs.
Applying ACLs describes procedures for applying ACLs to interfaces or the control plane.
ACL Rule Tracking
ACL rule tracking determines how ACL rules impact traffic on the interfaces where those rules are applied. ACLs provide two tracking mechanisms:
ACL logging: Logs a syslog entry when a packet matches specified ACL rules.
ACL counters: ACL counters increment when a packet matches a rule in specified ACLs.
ACL Logging
ACL rules provide a log option that produces a log message when a packet matches the rule. ACL logging creates a syslog entry when a packet matches an ACL rule where logging is enabled. Packets that match a logging-enabled ACL rule are copied to the CPU by the hardware. These packets trigger the creation of a syslog entry. The information provided in the entry depends on the ACL type or the protocol specified by the ACL. The system applies hardware rate limiting to packets written to the CPU, which prevents potential Denial-of-Service attacks. The logging rate is also limited in software to avoid creating syslog lists that are too large for human operators to use in practical ways.
The system assigns an ACL counter to each ACL rule. The activity of the ACL counters for rules within a list depends on the list’s counter state. When the list is in a counting state, the ACL counter of a rule increments when the rule matches a packet. When the list is in a non-counting state, the counter does not increment. A list’s counter state applies to all rules in the ACL. The default state for new ACLs is non-counting.
The system maintains the values of the counters for all rules in the list when an ACL changes from a counting state to a non-counting state or is no longer applied to any interfaces that increment counters. The counters do not reset. When the ACL returns to counting mode or is applied to an interface that increments counters, the counter operation continues from its last value.
Counters never decrement and are reset only through CLI commands.
Egress ACL counters count the number of packets matching rules associated with egress ACLs applied to various interfaces in a switch. 7050 and 7060 series switches maintain these counters for every TCAM rule. On these platforms, commands such as show platform trident tcam, show platform trident counters, and show ip access-list always display packet counters greater than zero.
Other switches do not enable counters by default. You must configure counters for each ACL. The show hardware counter and show ip access-list commands display the counters.
Configuring Egress ACL Counters
7050 and 7060 series switches enable egress ACL counters and do not require configuration.
For other platforms, to enable egress ACL counters for a specific ACL, use the counters per-entry command in the ACL's configuration mode.
Example
As shown in the following example, configure the counters per-entry command in the ACL configuration mode.
switch(config)# ip access-list acl1
switch(config-acl-acl1)# counters per-entry
Enabling Egress Counters Globally
7050 and 7060 series switches enable egress counters.
For other switches, enable IPv4 and IPv6 egress ACL counters in the global configuration mode using the hardware counter feature acl out command.
Example
The following examples show how to enable IPv4 and IPv6 egress ACL counters:
switch(config)# hardware counter feature acl out ipv4
switch(config)#
switch(config)# hardware counter feature acl out ipv6
switch(config)#
Disabling Egress Counters Globally
For 7050 and 7060 series switches, egress counters cannot be disabled.
For other switches, disable IPv4 and IPv6 egress ACL counters in the global configuration mode by using the hardware counter feature acl out command.
The following examples show how to disable IPv4 and IPv6 egress ACL counters:
switch(config)# no hardware counter feature acl out ipv4
switch(config)#
switch(config)# no hardware counter feature acl out ipv6
switch(config)#
Egress Counter Roll Over in the Global Mode
The counters roll over when the counter value for an ACL rule exceeds 2^64 (2 to the power of 64).
Example
In the following example, the hardware counter feature acl ipv6 out command is configured using units and packets.
switch(config)# hardware counter feature acl ipv6 out units packets
switch(config)#
The clear ip access-lists counters command clears the counters for all of the IPv4 ACLs or a specific IPv4 ACL, either globally or per CLI session.
Example
In the following example the ACL list named red is selected.
switch(config)# clear ip access-list counters red session
switch(config)#
The IPv6 egress ACL counters do not work in unshared mode.
Example
Use the hardware access-lists resource sharing vlan ipv6 out command to enable egress IPv6 ACL sharing.
switch(config)# hardware access-list resource sharing vlan ipv6 out
switch(config)#
The clear ipv6 access-list counters command clears the counters for all of the IPv6 ACLs or a specific IPv6 ACL, either globally or per CLI session.
Example
In the following example the ACL list named green is selected.
switch(config)# clear ipv6 access-list counters green session
switch(config)#
Displaying Egress ACL Counters
Use the following show commands to display information on Egress ACL Counters.
Use the show ip access-lists command to display all the IPv4 ACLs, or a specific IPv4 ACL configured in a switch. The output contains details such as ACL rules and counter values for each rule.
switch(config)# show ip access-list acl1
IP Access List acl1
counter per-entry
10 deny ip 11.1.1.0/24 any dscp af11
20 deny ip any any [match 39080716, 0:00:00 ago]
Total rules configured: 2
Configured on Ingress: Et2/1
Active on Ingress: Et2/1
Use the show ipv6 access-lists command to display all the IPv6 ACLs or a specific IPv6 ACL configured in a switch. The output contains details such as rules in an ACL and respective counter values with each rule.
switch(config)# show ipv6 access-list acl1
IPV6 Access List acl1
counter per-entry
10 permit ipv6 any any [match 3450000, 0:00:10 ago]
20 deny ipv6 any any
Total rules configured: 2
Configured on Ingress: Et2/1
Active on Ingress: Et2/1
The counter name EgressAclDropCounter in the output of this show command signifies the aggregate counter value for the remaining egress IPv4 ACL. In this example, the deny rules, with per-rule counters, do not allocate. No per-rule counters are allocated if you do not configure the counter per-entry parameter for the respective ACL.
switch(config)# show hardware counter drop
Summary:
Total Adverse (A) Drops: 0
Total Congestion (C) Drops: 0
Total Packet Processor (P) Drops: 250
Type Chip CounterName : Count : First Occurrence : Last Occurrence
-------------------------------------------------------------------------------
P Fap0 EgressAclDropCounter : 250 : 2015-11-11 22:39:02 : 2015-11-11 22:51:44
ACL Configuration
You create and modify Access Control Lists (ACLs) in an ACL-configuration mode. You can edit a list only in the mode where you created it. The switch provides five configuration modes for creating and modifying access control lists:
ACL configuration mode for IPv4 access control lists.
IPv6-ACL configuration mode for IPv6 access control lists.
Std-ACL configuration mode for Standard IPv4 access control lists.
Std-IPv6-ACL configuration mode for Standard IPv6 access control lists.
MAC-ACL configuration mode for MAC access control lists.
These sections describe the creation and modification of ACLs:
The switch enters the appropriate ACL Configuration Mode for the list. When adding the name of an existing ACL to the command, subsequent commands edit that list (see Modifying an ACL for additional information).
Examples
This command places the switch in ACL Configuration Mode to create an ACL named test1.
switch(config)# ip access-list test1
switch(config-acl-test1)#
This command places the switch in ACL Configuration Mode to create a Standard ACL named stest1.
switch(config)# ip access-list standard stest1
switch(config-std-acl-stest1)#
This command places the switch in ACL Configuration Mode to create an MAC ACL named mtest1.
switch(config)# mac access-list mtest1
switch(config-mac-acl-mtest1)#
Saving List Modifications
ACL Configuration Modes are group-change modes. Changes made in a group-change mode are saved when exiting the mode. To discard changes, use the abort command instead of exit.
Examples
Use the following commands to configure the first three rules into a new ACL.
switch(config-acl-test1)# permit ip 10.10.10.0/24 any
switch(config-acl-test1)# permit ip any host 10.20.10.1
switch(config-acl-test1)# deny ip host 10.10.10.1 host 10.20.10.1
To view the edited list, use the show command.
switch(config-acl-test1)# show
IP Access List test1
10 permit ip 10.10.10.0/24 any
20 permit ip 10.30.10.0/24 host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
Because EOS has not saved the changes, the ACL remains empty, as displayed by show ip access-lists.
switch(config-acl-test1)# show ip access-lists test1
switch(config-acl-test1)#
Use the exit command to save all current changes to the ACL and exit the ACL configuration mode.
switch(config-acl-test1)# exit
switch(config)# show ip access-lists test1
IP Access List test1
10 permit ip 10.10.10.0/24 any
20 permit ip 10.30.10.0/24 host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
Total rules configured: 4
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
To apply the ACL test1 on an interface, Ethernet1/1, for example, and on the ingress direction, use the following command:
switch(config)# int et1/1
switch(config-if-Et1/1)# ip access-group test1 in
Use the exit command to save all changes to the Ethernet interface and exit the interface configuration mode.
switch(config-if-Et1/1)# exit
switch(config)#
switch(config)# show ip access-lists test1
IP Access List test1
10 permit ip 10.10.10.0/24 any
20 permit ip 10.30.10.0/24 host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
Total rules configured: 4
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
Discarding List Changes
The abort command exits ACL Configuration mode without saving pending changes.
Examples
The following commands enter the first three rules into a new ACL.
switch(config-acl-test1)# permit ip 10.10.10.0/24 any
switch(config-acl-test1)# permit ip any host 10.20.10.1
switch(config-acl-test1)# deny ip host 10.10.10.1 host 10.20.10.1
To view the edited list, use the show command.
switch(config-acl-test1)# show
IP Access List test1
10 permit ip 10.10.10.0/24 any
20 permit ip 10.30.10.0/24 host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
To discard the changes, use the abort command. If the ACL existed before entering the ACL Configuration Mode, the abort command restores the version that existed before entering the ACL Configuration Mode. Otherwise, the show ip access-lists command displays no output.
switch(config-acl-test1)# abort
switch(config)#
Modifying an ACL
An existing ACL, including those applied to interfaces, can be modified by entering the appropriate configuration mode for the ACL as described in Creating and Opening a List. By default, while modifying an ACL, all traffic is blocked on any interface using the ACL.
Permit All Traffic During ACL Update
To avoid packet loss and interference with features like routing and dynamic NAT, you can configure the following switches to permit all traffic on Ethernet and VLAN interfaces during ACL modifications:
To append a rule to the end of a list, enter the rule without a sequence number while in ACL configuration mode for the list. The switch computes the new rule’s sequence number by adding 10 to the last rule’s sequence number.
Examples
The following command configures the switch to permit all traffic during ACL modifications on interfaces using the ACL. The rules in modified ACLs go into effect after exiting ACL configuration mode and after populating the ACL rules in hardware.
The following commands enter the first three rules into a new ACL.
switch(config-acl-test1)# permit ip 10.10.10.0/24 any
switch(config-acl-test1)# permit ip any host 10.20.10.1
switch(config-acl-test1)# deny ip host 10.10.10.1 host 10.20.10.1
To view the edited list, use the show command.
switch(config-acl-test1)# show
IP Access List test1
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
The following command appends a rule to the ACL. The new rule’s sequence number is 40.
switch(config-acl-test1)# permit ip any any
switch(config-acl-test1)# show
IP Access List test1
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
Inserting a Rule
To insert a rule into an ACL, enter the rule with a sequence number between the existing rules’ numbers.
Example
The following command inserts a rule between the first two by assigning the sequence number 15.
Switch(config-acl-test1)# 15 permit ip 10.30.10.0/24 host 10.20.10.1
Switch(config-acl-test1)# show
IP Access List test1
10 permit ip 10.10.10.0/24 any
15 permit ip 10.30.10.0/24 host 10.20.10.1
20 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
Deleting a Rule
To remove a rule from the current ACL, perform one of these commands:
Enter no, followed by the sequence number to delete a rule.
Enter no, followed by the actual rule to delete it.
Enter default, followed by the actual rule to delete it.
Examples
These equivalent commands remove rule 20 from the list.
switch(config-acl-test1)# no 20
switch(config-acl-test1)# no permit ip any host 10.20.10.1
switch(config-acl-test1)# default permit ip any host 10.20.10.1
This ACL results from entering one of the preceding commands.
switch(config-acl-test1)# show
ip access list test1
10 permit ip 10.10.10.0/24 any
15 permit ip 10.30.10.0/24 host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
Resequencing Rule Numbers
Sequence numbers determine the order of the rules in an ACL. After editing a list and deleting existing rules while inserting new rules between existing rules, the sequence number distribution may not be uniform. Resequencing rule numbers changes the sequence number of rules to provide a constant difference between adjacent rules. The resequence (ACLs) command adjusts the sequence numbers of ACL rules.
Example
The resequence (ACLs) command renumbers rules in the test1 ACL. The sequence number of the first rule is 100; subsequent rule numbers are incremented by 20.
switch(config-acl-test1)# show
IP Access List test1
10 permit ip 10.10.10.0/24 any
25 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
50 permit ip any any
90 remark end of list
switch(config-acl-test1)# resequence 100 20
switch(config-acl-test1)# show
IP Access List test1
100 permit ip 10.10.10.0/24 any
120 permit ip any host 10.20.10.1
140 deny ip host 10.10.10.1 host 10.20.10.1
160 permit ip any any
180 remark end of list
ACL Rule Tracking Configuration
ACL Rules provide a log option that produces a syslog message about the packets matching a desired packet. ACL Logging creates a syslog entry when a packet matches an ACL rule with logging enabled.
Example
The following command creates an ACL Rule with logging enabled.
switch(config-acl-test1)# 15 permit ip 10.30.10.0/24 host 10.20.10.1 log
switch(config-acl-test1)#
The format of the generated Syslog message depends on the ACL type and the specified protocol:
Messages generated by a TCP or UDP packet matching an IP ACL:
Variables in the Syslog messages display the following values:
acl - Specifies the name of the ACL.
intf - Specifies the name of the interface receiving the packet.
filter - Specifies the action triggered by the ACL as denied or permitted.
protocol - Specifies the IP protocol specified by the packet.
vlan - Specifies the number of the VLAN receiving the packet.
ether - Specifies the EtherType protocol specified by the packet.
src-ip and dst-ip - Specifies the source and destination IP addresses.
src-prt and dst-prt - Specifies the source and destination ports.
src-mac and dst-mac - Specifies the source and destination MAC addresses.
ACLs provide a command that configures as counter state as counting or non-counting. The counter state applies to all rules in the ACL. The initial state for new ACLs defaults to non-counting.
The following command places the configuration mode ACL in counting mode.
switch(config-acl-test1)# counters per-entry
switch(config-acl-test1)# exit
switch(config-acl-test1)# show ip access-list test1
IP Access List test1
counters per-entry
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
50 remark end of list
Total rules configured: 5
Configured on Ingress: Et1
Active on Ingress: Et1
The following command clears the ACL counter for the test1 ACL.
switch(config)# clear ip access-lists counters test1
switch(config)#
Displaying ACLs
Display ACLs using the show running-config command. The show ip access-lists command also displays ACL rosters and contents as specified by command parameters.
When editing an ACL, the show (ACL configuration modes) command displays the current or pending list as specified by command parameters.
Displaying a List of ACLs
To display the roster of ACLs on the switch, use the show [ip | ipv6 | mac] access-lists command with the summary option.
Example
The following command lists the available IPv4 access control lists.
switch(config)# show ip access-lists summary
IPV4 ACL default-control-plane-acl
Total rules configured: 12
Configured on: control-plane
Active on : control-plane
IPV4 ACL list2
Total rules configured: 3
IPV4 ACL test1
Total rules configured: 6
IPV4 ACL test_1
Total rules configured: 1
IPV4 ACL test_3
Total rules configured: 0
switch(config)#
Each command can display the contents of one ACL or of all ACLs of the type specified by the command:
To display the contents of one ACL, enter showacl_typeaccess-lists followed by the name of the ACL. The acl_type can be ip, ipv6, mac or null.
To display the contents of all ACLs on the switch, enter the command without any options.
ACLs in counting mode display the number of inbound packets matching each rule in the list and the elapsed time since the last match.
Examples
The following command displays the rules in the default-control-plane-acl IP ACL, configuration, and status.
switch# show ip access-lists default-control-plane-acl
IP Access List default-control-plane-acl [readonly]
counters per-entry
10 permit icmp any any
20 permit ip any any tracked [match 1725, 0:00:00 ago]
30 permit ospf any any
40 permit tcp any any eq ssh telnet www snmp bgp https
50 permit udp any any eq bootps bootpc snmp [match 993, 0:00:29 ago]
60 permit tcp any any eq mlag ttl eq 255
70 permit udp any any eq mlag ttl eq 255
80 permit vrrp any any
90 permit ahp any any
100 permit pim any any
110 permit igmp any any [match 1316, 0:00:23 ago]
120 permit tcp any any range 5900 5910
Total rules configured: 12
Configured on Ingress: control-plane(default VRF)
Active on Ingress: control-plane(default VRF)
The following command displays the rules, configuration, and status of all the IP ACLs on the switch.
switch# show ip access-lists
IP Access List default-control-plane-acl [readonly]
counters per-entry
10 permit icmp any any
20 permit ip any any tracked [match 1371, 0:00:00 ago]
30 permit ospf any any
40 permit tcp any any eq ssh telnet www snmp bgp https
50 permit udp any any eq bootps bootpc snmp
60 permit tcp any any eq mlag ttl eq 255
70 permit udp any any eq mlag ttl eq 255
80 permit vrrp any any
90 permit ahp any any
100 permit pim any any
110 permit igmp any any [match 1316, 0:00:23 ago]
120 permit tcp any any range 5900 5910
Total rules configured: 12
Configured on Ingress: control-plane(default VRF)
Active on Ingress: control-plane(default VRF)
IP Access List list2
10 permit ip 10.10.10.0/24 any
20 permit ip 10.30.10.0/24 host 10.20.10.1
30 permit ip any host 10.20.10.1
40 deny ip host 10.10.10.1 host 10.20.10.1
50 permit ip any any
Total rules configured: 5
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
IP Access List test1
switch(config)#
Displaying ACL Modifications
While editing an ACL in ACL Configuration Mode, the show command provides options for displaying ACL contents.
To display the list, as modified in ACL configuration mode, enter show or show pending.
To display the list, as stored in running-config, enter show active.
To display differences between the pending list and the stored list, enter show diff.
Examples
The examples in this section display previously configured ACL commands.
The configuration stores these parameters:
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.21.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
50 remark end of list
The current edit session removed this command, and the change not yet stored to the running-config:
20 permit ip any host 10.21.10.1
The current edit session added these commands to the ACL, and the change not yet stored to the running-config:
20 permit ip 10.10.0.0/16 any
25 permit tcp 10.10.20.0/24 any
45 deny pim 239.24.124.0/24 10.5.8.4/30
The following command displays the pending ACL as modified in the ACL Configuration Mode.
switch(config-acl-test_1)# show pending
IP Access List test_1
10 permit ip 10.10.10.0/24 any
20 permit ip 10.10.0.0/16 any
25 permit tcp 10.10.20.0/24 any
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
45 deny pim 239.24.124.0/24 10.5.8.4/30
50 remark end of list
The following command displays the ACL as stored in the configuration.
switch(config-acl-test_1)# show active
IP Access List test_1
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.21.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
50 remark end of list
The following command displays the difference between the saved and modified ACLs.
A plus sign (+) denotes rules added to the pending list.
A minus sign (-) denotes rules removed from the saved list.
switch(config-acl-test_1)# show diff
---
+++
@@ -1,7 +1,9 @@
IP Access List test_1
10 permit ip 10.10.10.0/24 any
- 20 permit ip any host 10.21.10.1
+ 20 permit ip 10.10.0.0/16 any
+ 25 permit tcp 10.10.20.0/24 any
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
+ 45 deny pim 239.24.124.0/24 10.5.8.4/30
Displaying Egress ACL Counters
The following show commands display Egress ACL Counters information.
Use the show ip access-lists command to display all the IPv4 ACLs, or a specific IPv4 ACL configured in a switch. The output contains details such as rules in an ACL as well as the respective counter values with each rule, configuration, and status.
switch(config)# show ip access-list acl1
IP Access List acl1
counter per-entry
10 deny ip 11.1.1.0/24 any dscp af11
20 deny ip any any [match 39080716, 0:00:00 ago]
Total rules configured: 2
Configured on Ingress: Et2/1
Active on Ingress: Et2/1
Use the show ipv6 access-lists command to display all the IPv6 ACLs or a specific IPv6 ACL configured in a switch. The output contains details such as rules in an ACL and the respective counter values with each rule along with the configuration and status.
switch(config)# show ipv6 access-list acl1
IPV6 Access List acl1
counter per-entry
10 permit ipv6 any any [match 3450000, 0:00:10 ago]
20 deny ipv6 any any
Total rules configured: 2
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
The counter name EgressAclDropCounter in the output of this show command signifies the aggregate counter value for the remaining egress IPv4 ACL. In this example, the deny rules, with per rule counters, are not allocated. The per-rule counters are not allocated when the user does not configure the counter per-entry parameter for the respective ACL.
switch(config)# show hardware counter drop
Summary:
Total Adverse (A) Drops: 0
Total Congestion (C) Drops: 0
Total Packet Processor (P) Drops: 250
Type Chip CounterName : Count : First Occurrence : Last Occurrence
-------------------------------------------------------------------------------
P Fap0 EgressAclDropCounter : 250 : 2015-11-11 22:39:02 : 2015-11-11 22:51:44
Configuring Per-Port Per-VLAN QoS
To configure per-port per-VLAN Quality of Service (QoS), first configure the ACL policing for QoS and then apply the policy map on a single Ethernet or port-channel interface on a per-port per-VLAN basis. The per port per VLAN QoS allows a class map to match traffic for a single VLAN or for a range of VLANs separated by commas. Per-port per-VLAN only works with QoS-based class maps.
To configure per-port per-VLAN QoS on DCS-7280(R) and DCS-7500(R), change the TCAM profile to QoS as shown in the following steps:
Access Control Lists (ACLs) are configured to permit or deny traffic between source and destination ports on Strata-based platforms. Mirror ACLs are used in mirroring traffic by matching VLAN ID of the configured ACLs. Mirror ACLs are applied for IPv4, IPv6, and MAC ACLs.
Note:Mirror ACLs work only in the receiving direction.
Examples
The following commands configure ACL to permit VLAN traffic between any source and destination host.
switch(config)# ip access-list acl1
switch(config-acl-acl1)# permit vlan 1234 0x0 ip any any
The following commands configure monitor session sess1 with Ethernet 1 as source port and Ethernet 2 as the destination port for an ingress ip acl_1.
Access Control Lists (ACLs) become active when assigned to an interface, subinterface, or control plane. This section describes the process of adding and removing ACL interface assignments.
Applying an ACL to an Interface
The switch must be in interface configuration mode to assign an ACL to an interface or subinterface.
The ip access-group command applies the specified IP or standard IP ACL to the configuration mode interface or subinterface.
The ip access-group command applies the specified IP or standard IP ACL to the control plane traffic.
The mac access-group command applies the specified MAC ACL to the configuration mode interface.
IPv4, IPv6, and MAC ACLs are separately applied for inbound and outbound packets. You can assign an interface or subinterface with multiple ACLs, with a limit of one ACL per packet direction per ACL type. A subset of all available switches support Egress ACLs. IPv6 egress ACLs have limited availability, and IPv6 egress ACLs applied to routed interfaces or subinterfaces across the same chip on the DCS-7500E and the DCS-7280E series can be shared. In addition to that, the DSCP value can match on IPv6 egress ACLs. This ability results in more efficient utilization of system resources and is particularly useful for environments with few, potentially large, IPv6 egress ACLs applied across multiple routed interfaces.
Examples
These commands assign test1 ACL to interface ethernet 3, and verify the assignment.
switch(config)# interface ethernet 3
switch(config-if-Et3)# ip access-group test1 in
switch(config-if-Et3)# show running-config interfaces ethernet 3
interface Ethernet3
ip access-group test1 in
switch(config-if-Et3)#
The following commands place the switch in control plane configuration mode and applies the ACL assignment to the control plane traffic.
switch(config)# control-plane
switch(config-cp)# ip access-group test_cp in
The following command enables shared ACLs.
switch(config)# hardware access-list resource sharing vlan ipv6 out
switch(config)#
The following command disables shared ACLs.
switch(config)# no hardware access-list resource sharing vlan ipv6 out
switch(config)#
The following commands apply an IPv4 ACL named test_ACL to ingress traffic on interface ethernet 5.1.
switch(config)# interface ethernet 5.1
switch(config-if-Et5.1)# ipv4 access-group test_ACL in
switch(config-if-Et5.1)#
Removing an ACL from an Interface
The no ip access-group command removes an IP ACL assignment statement from running-config for the configuration mode interface. After removing an ACL, the interface is no longer associated with an IP ACL.
The no mac ip access-group command removes a MAC ACL assignment statement from running-config for the configuration mode interface. After removing a MAC ACL is removed, the interface is no longer associated with an MAC ACL.
To remove an ACL from the control plane, enter the no ip access-group command in control plane configuration mode. Removing the control plane ACL command from running-config reinstates default-control-plane-acl as the control plane ACL.
Examples
The following commands remove the assigned IPv4 ACL from interface ethernet 3.
switch(config)# interface ethernet 3
switch(config-if-Et3)# no ip access-group test in
switch(config-if-Et3)#
The following commands place the switch in control plane configuration mode and remove the ACL assignment from running-config, restoring default-control-plane-acl as the control plane ACL.
switch(config)# control-plane
switch(config-cp)# no ip access-group test_cp in
switch(config-cp)#
Service ACL enforcement is a feature added to a control plane service (the SSH server, the SNMP server, routing protocols, etc.) that allows the switch administrator to restrict the processing of packets and connections by the control plane processes that implement that service. The control plane program run by the control plane process checks already received packets and connections against a user-configurable Access Control List (ACL), a Service ACL.
The Service ACL contains permit and deny rules matching any source address, destination address, and TCP or UDP ports of received packets or connections. After receiving a packet or connection, the control plane process evaluates the packet or connection against the rules of the Service ACL configured for the control plane process. If the received packet or connection matches a deny rule, the control plane process drops or closes it without further processing.
Control Plane Process Enforced Access Control enables the system administrator to restrict which systems on the network can access the services provided by the switch. Each service has its own access control list, giving the system administrator fine-grained control over access to the switch's control plane services. The CLI for this uses the familiar pattern of access control lists assigned for a specific purpose, in this case, for each control plane service.
Configuring Service ACLs and Displaying Status and Counters
switch(config)# management ssh
switch(config-mgmt-ssh)# ip access-group <acl_name> [vrf <vrf_name>] in
switch(config-mgmt-ssh)# ipv6 access-group <acl_name> [vrf <vrf_name>] in
In Release EOS-4.19.0, all VRFs are required to use the same SSH Server Service ACL. The Service ACL assigned without the vrf keyword is applied to all VRFs where the SSH Server is enabled.
Use the following commands to display the status and counters of the SSH Server Service ACLs:
switch# show management ssh ip access-list
switch# show management ssh ipv6 access-list
SNMP Server
Use the snmp-server community command to apply the SNMP Server Service ACLs to restrict which hosts can access SNMP services on the switch:
Use the following commands to display the status and counters of the BGP routing protocol Service ACLs:
switch# show bgp ipv4 access-list
switch# show bgp ipv6 access-list
UCMP Auto Adjust for BGP
Unequal Cost MultiPath (UCMP) for BGP forwards traffic based on weight assignments for next hops of Equal Cost MultiPath (ECMP) routes. The system programs the weights in the Forwarding Information Base (FIB).
Devices that receive BGP routes disseminate BGP link-bandwidth extended community attribute information. These devices then program the next hops in the FIB using the received link-bandwidth values. The system appends the percentage of interface speed to the received link bandwidth extended community value of the route. It adjusts the weight ratio of the traffic sent over egress ports to forward more traffic toward the peer with a higher interface speed.
Configuring UCMP Auto Adjust for BGP
The following command enables the weight adjustment and configures the adjust auto to 62.3 percent.
switch(config-router-bgp)# neighbor group1 link-bandwidth adjust auto percent 62.3
PERCENT is a float value between 0.0 and 100.0 and is optional.
Use the following command to display the status and counters of the PIM routing protocol Service ACLs.
switch# show ip pim access-list
IGMP
Use the ip igmp access-group command to apply Service ACLs for controlling packets processed by the IGMP management protocol agent:
switch(config)# router igmp
switch(config-router-igmp)# ip igmp access-group <acl_name>
switch(config-router-igmp)# vrf <vrf_name>
switch(config-router-igmp-vrf-<vrf>)# ip igmp access-group <acl_name>
Use the following command to display the status and counters of the IGMP management protocol Service ACLs.
switch# show ip igmp access-list
DHCP Relay
Use the ip dhcp relay access-group and ipv6 dhcp relay access-group commands to apply Service ACLs for controlling packets processed by the DHCP relay agent:
Use the following commands to display the status and counters of the DHCP relay agent Service ACLs:
switch# show ip dhcp relay access-list
switch# show ipv6 dhcp relay access-list
LDP
Use the ip access-group (Service ACLs) to apply Service ACLs for controlling packets and connections processed by the LDP MPLS label distribution protocol:
switch(config)# mpls ldp
switch(config-mpls-ldp)# ip access-group <acl_name>
Use the following command to display the status and counters of the LDP Service ACLs.
switch(config)# management telnet
switch(config-mgmt-telnet)# ip access-group <acl_name> [vrf <vrf_name>] in
switch(config-mgmt-telnet)# ipv6 access-group <ipv6_acl_name> [vrf <vrf_name>] in
In EOS 4.19.0, all VRFs are required to use the same Telnet server Service ACL. The Service ACL assigned without the vrf keyword is applied to all VRFs where the Telnet server is enabled.
Use the following commands to display the status and counters of the LDP Service ACLs:
switch# show management telnet ip access-list
switch# show management telnet ipv6 access-list
Sub-interface ACLs
This Sub-interface ACLs feature enables ACL functionality on subinterfaces.
Configuring Sub-interface ACLs
Configure the ACLs on subinterfaces using the following command.
ip|ipv6 access-groupacl-namein | out
Use the following command to unconfigure the ACLs on subinterfaces.
no ip|ipv6 access-groupin | out
Configuring ACL Mirroring on a Subinterface Source
Configure a mirror session using subinterface sources and apply explicit ACLs to each source in the session. EOS only supports ingress mirroring from the Rx direction.
Use the following commands to configure a session, ACLMirror1, on Ethernet5/1.1, Ethernet5/1.2, Ethernet6/1 as the source, acl1 as the ACL group, and Ethernet 14/1 as the destination:
switch(config)# show monitor session
Session ACLMirror1
------------------------
Programmed in HW: Yes
Source Ports:
Rx Only: Et5/1.2(IP ACL: acl1), Et5/1.1
Et6/1
Destination Ports:
Et14/1 : active
Sub-interface ACLs Limitations
The sub-interface ACLs feature contains the following limitations:
EOS does not support egress IPv4 ACLs on subinterfaces when sharing mode is disabled for Egress IPv4 RACLs.
EOS does not support egress IPv6 ACL deny logging on subinterfaces.
Blocking traffic while modifying ACLs is not supported on Egress IPv4 ACLs on subinterfaces.
Sub-interface ACLs Show Commands
The show ip access-lists and show ipv6 access-lists commands display the summary of a configured ACL including the subinterface on which the ACL is configured and active.
show ip|ipv6 access-listsacl-namesummary
Examples
switch(config)# show ip access-lists acl1 summary
IPV4 ACL acl1
Total rules configured: 1
Configured on Ingress: Et5.1
Active on Ingress: Et5.1
switch(config)# show ipv6 access-lists acl1 summary
IPV6 ACL acl1
Total rules configured: 1
Configured on Egress: Et5.1
Active on Egress: Et5.1
RACL Sharing on SVIs
IPv4 Ingress Sharing
IPv4 ingress sharing optimizes the utilization of hardware resources by sharing them between different VLAN interfaces when they have the same ACL attached.
Larger deployments benefit from this function, where IPv4 ingress sharing is applied on multiple SVIs with member interfaces on the same forwarding ASIC. For example, a trunk port carrying multiple VLANs and an ingress sharing is applied on all VLANs; it occupies lesser hardware resources irrespective of the number of VLANs. By default, IPv4 ingress sharing is disabled on the switches.
To enable IPv4 Ingress Sharing, use the no hardware access-list resource sharing vlan in command.
Note: Enabling or disabling the IPv4 ingress sharing requires the restart of software agents on the switches which is a disruptive process and will impact the traffic forwarding.
The no form of the command disables the IPv4 ingress sharing on the switch. To display the IPv4 ingress sharing information use show platform trident command on the switch.
IPv4 Egress Sharing
IPv4 Egress Sharing optimizes the utilization of hardware resources by sharing TCAM entries for a group of SVIs on which IPv4 ACLs are shared. The TCAM entries are shared for all the SVIs per chip, saving a lot of hardware resources and enabling ACLs to scale to larger configurations.
Larger deployments benefit from IPv4 Egress Sharing, which is applied on multiple SVIs with member interfaces on the same forwarding ASIC. For example, a trunk port carrying multiple VLANs, and when applying Egress Sharing on all VLANs, it occupies lesser hardware resources irrespective of the number of VLANs.
By default, the system enables IPv4 Egress Sharing on the switches. However, enabling both IPv4 Egress Sharing and uRPF cannot at the same time is not possible. Disabling IPv4 RACL sharing will allow uRPF configuration and ensure the simultaneous configuration of the RACL in non-shared mode.
To enable unicast Reverse Path Forwarding (uRPF) on the switch, the IPv4 Egress Sharing must be disabled using the no hardware access-list resource sharing vlan ipv4 out command.
Note: Enabling or disabling IPv4 Egress Sharing requires restarting software agents on the switches, which is a disruptive process and will impact the traffic forwarding.
Use the following show commands to verify the IPv4 Egress Sharing information on the switch.
The no form of the command disables the switch's IPv4 Egress Sharing, allowing you to configure the uRPF.
Displaying IPv4 Egress Sharing Information
Examples
The show ip access-lists command displays the list of all the configured IPv4 ACLs.
switch# show ip access-lists summary
IPV4 ACL default-control-plane-acl [readonly]
Total rules configured: 17
Configured on Ingress: control-plane(default VRF)
Active on Ingress: control-plane(default VRF)
IPV4 ACL ipAclLimitTest
Total rules configured: 0
Configured on Egress: Vl2148,2700
Active on Egress: Vl2148,2700
The show vlan command displays the list of all the member interfaces under each SVI.
switch# show vlan
VLAN Name Status Ports
----- -------------- --------- -----------------
1 default active
2148 VLAN2148 active Cpu, Et1, Et26
2700 VLAN2700 active Cpu, Et18
The show platform arad acl tcam command displays the number of TCAM entries (hardware resources) occupied by the ACL on each forwarding ASIC and the percentage of TCAM utilization per forwarding ASIC.
switch# show platform arad acl tcam detail
ip access-list ipAclLimitTest (Shared RACL, 0 rules, 1 entries, direction out,
state success, Acl Label 2)
Fap: Arad0, Shared: true, Interfaces: Vl2148, Vl2700
Bank Offset Entries
0 0 1
Fap: Arad1, Shared: true, Interfaces: Vl2148
Bank Offset Entries
0 0 1
switch# show platform arad acl tcam summary
The total number of TCAM lines per bank is 1024.
========================================================
Arad0:
========================================================
Bank Used Used % Used By
0 1 0 IP Egress PACLs/RACLs
Total Number of TCAM lines used is: 1
========================================================
Arad1:
========================================================
Bank Used Used % Used By
0 1 0 IP Egress PACLs/RACLs
Total Number of TCAM lines used is: 1
The show ip route command displays the unicast ip routes installed in the system.
switch# show ip route
VRF name: default
Codes: C - connected, S - static, K - kernel,
O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
R - RIP, I - ISIS, A B - BGP Aggregate, A O - OSPF Summary,
NG - Nexthop Group Static Route
Gateway of last resort is not set
C 10.1.0.0/16 is directly connected, Vlan2659
C 10.2.0.0/16 is directly connected, Vlan2148
C 10.3.0.0/16 is directly connected, Vlan2700
S 172.17.0.0/16 [1/0] via 172.24.0.1, Management1
S 172.18.0.0/16 [1/0] via 172.24.0.1, Management1
S 172.19.0.0/16 [1/0] via 172.24.0.1, Management1
S 172.20.0.0/16 [1/0] via 172.24.0.1, Management1
S 172.22.0.0/16 [1/0] via 172.24.0.1, Management1
C 172.24.0.0/18 is directly connected, Management1
The show platform arad ip route command displays the platform unicast forwarding routes.
A route map is an ordered set of rules that controls the redistribution of IP routes into a protocol domain based on criteria such as route metrics, access control lists, next-hop addresses, and route tags. Route maps can also alter route parameters as they are redistributed.
Route Map Description
Route maps are composed of route map statements, each consisting of a list of match and set commands.
Route Map Statements
Route map statements are categorized by the resolution of routes that the statement filters.
Permit statements facilitate the redistribution of matched routes.
Deny statements prevent the redistribution of matched routes.
Route map statement elements include name, sequence number, filter type, match commands, set commands, and continue commands.
The name identifies the route map to which the statement belongs.
The sequence number designates the statement’s placement within the route map.
A filter type specifies the route resolution. Valid types are permit and deny.
The match commands specify criteria that select the routes the statement evaluates for redistribution.
The set commands modify route parameters for redistributed routes.
The continue commands prolong the route map evaluation of routes that match a statement.
Statements filter routes for redistribution. Routes that statements pass are redistributed (permit statements) or rejected (deny statements). The next statement in the route map then filters routes that statements fail.
When a statement does not contain a match command, the statement passes all routes.
When a statement contains a single match command that lists a single object, the statement passes routes whose parameters match the object.
When a statement contains a single match command that lists multiple objects, the statement passes routes whose parameters match at least one object.
When a statement contains multiple match commands, the statement passes routes whose parameters match all match commands.
The Set commands modify parameters for redistributed routes and are valid in permit statements.
Example
The following route map statement is named MAP_1 with sequence number 10. The statement matches all routes from BGP Autonomous System 10 and redistributes them with a local preference set to 100. Routes that do not match the statement are evaluated against the next statement in the route map.
switch# route-map MAP_1 permit 10
match as 10
set local-preference 100
Route Maps with Multiple Statements
A route map consists of statements with the same name and different sequence numbers. Statements filter routes by ascending order based on their sequence numbers. When a statement passes a route, the redistribution action is performed as the filter type specifies, ignoring all subsequent statements. When the statement fails the route, the statement with the smallest sequence number larger than the current one filters the route.
All route maps contain an implied final statement containing a single deny statement without a match command. This statement denies the redistribution of any routes that no other statement passes.
Example
The following route map is named MAP_1 and has two permit statements. Routes that do not match either statement are denied redistribution into the target protocol domain.
switch# route-map MAP_1 permit 10
match as 10
set local-preference 100
!
switch# route-map MAP_1 permit 20
match metric-type type-1
match as 100
Route Maps with Multiple Statements and Continue Commands
Route map statements that contain a continue (route map) command support additional route map evaluation of routes whose parameters meet the statement’s match commands. Routes that match a statement containing a continue command are evaluated against the statement specified by the continue command.
When a route matches multiple route-map statements, the filter action (deny or permit) is determined by the last statement that the route matches. The set commands in all statements matching the route are applied to the route after the route map evaluation is complete. Multiple set commands are applied in the same order by which the route was evaluated against the statements containing them.
Example
The following route map is named MAP_2 with a permit and a deny statement. The permit statement contains a continue command. Routes that match statement 10 are evaluated against statement 20.
switch# route-map MAP_2 permit 10
match as 10
continue 20
set local-preference 100
!
switch# route-map MAP_2 deny 20
match metric-type type-1
match as 100
The route is redistributed if it passes statement 10 and is rejected by statement 20. The route is denied redistribution in all other instances. The continue command guarantees the evaluation of all routes against both statements.
Route Map Configuration
Route maps are created and modified in route-map configuration mode. These sections describe the configuration mode and its commands.
To create a route map, use the route-map command, including the map name and filter type (deny or permit). If the command does not specify a number, the system assigns a default sequence number to the statement.
Example
The following command places the switch in the route map configuration mode and creates a route map statement named map1 with a sequence number of 50.
To edit an existing route map statement, use the route-map, including the map’s name and the statement’s number. The switch enters the route map configuration mode for the statement. Subsequent match (route-map) and set (route-map) commands add the corresponding commands to the statement.
The show command displays the contents of the existing route map.
Example
The following command places the switch in the route map configuration mode to edit an existing route map statement. The show command displays the contents of all statements in the route map.
switch(config)# route-map MAP2
switch(config-route-map-MAP2)#show
Match clauses:
match as 10
match tag 333
Set clauses:
set local-preference 100
switch(config-route-map-MAP2)#
Saving Route Map Modifications
Route map configuration mode is a group-change mode. You can save changes by exiting the mode, either with an explicit exit command or by switching directly to another configuration mode. This includes switching to the configuration mode for a different route map.
Example
The first command creates the map1 statement with a sequence number of 10. The second command is not yet saved to the route map, as displayed by the show command.
switch(config)# route-map map1 permit
switch(config-route-map-map1)# match as 100
switch(config-route-map-map1)# show
switch(config-route-map-map1)#
The exit command saves the match command.
switch(config-route-map-map1)# exit
switch(config)# show route-map map1
route-map map1 permit 10
Match clauses:
match as 100
Set clauses:
switch(config)#
Discarding Route Map Modifications
The abort command discards all pending changes and exits route-map configuration mode.
Example
The abort command discards the pending match command and restores the original route map.
switch(config)# route-map map1 permit
switch(config-route-map-map1)# match as 100
switch(config-route-map-map1)# abort
switch(config)# show route-map map1
switch(config)#
Modifying Route Map Components
The following commands add rules to the configuration mode route map:
To insert a new statement into an existing route map, create a new statement with a sequence number that differs from any existing statement in the map.
Example
The following commands add statement 50 to the Map1 route map and a match statement of 150. They save the configuration using exit then display the new route map using show route-map Map1.
switch(config)# route-map Map1 permit 50
switch(config-route-map-Map1)# match as 150
switch(config-route-map-Map1)# exit
switch(config)# show route-map Map1
route-map Map1 deny 10
Match clauses:
match as 10
match tag 333
Set clauses:
set local-preference 100
route-map Map1 permit 50
Match clauses:
match as 150
Set clauses:
switch(config)#
Deleting Route Map Components
To remove a component from a route map, perform one of the following:
To remove a command from a statement, enter no, followed by the command you want to remove.
To remove a statement, enter no, followed by the route map with the filter type and the sequence number of the statement you want to remove.
To remove a route map, enter no followed by the route map without a sequence number.
Using Route Maps
Protocol redistribution commands include a route map parameter determining the routes to be redistributed into the specified protocol domain.
Example
The following commands use the Map1 route map to select OSPFv2 routes for redistribution into BGP AS1.
A prefix list is an ordered set of rules that defines route redistribution access for a specified IP address space. It consists of a filter action (deny or permit), an address space identifier (IPv4 subnet
address or IPv6 prefix), and a sequence number.
Prefix lists are referenced by route map match commands when filtering routes for redistribution.
A prefix list is an ordered set of rules that defines route redistribution access for a specified IP address space. A prefix list rule consists of a filter action (deny or permit), a network address (IPv4 subnet or IPv6 prefix), and a sequence number. A rule may also include an alternate mask size.
The switch supports IPv4 and IPv6 prefix lists. The switch is placed in a Prefix-list configuration mode to create and edit IPv4 or IPv6 prefix lists.
IPv4 Prefix Lists
IPv4 prefix lists are created or modified by adding an IPv4 prefix list rule in the Prefix-list configuration mode. Each rule includes the name of a prefix list and the sequence number, network address, and filter action. A list consists of all rules that have the same prefix-list name.
The ip prefix-list command creates a prefix list or adds a rule to an existing list. Route map match commands use prefix lists to filter routes for redistribution into OSPF, RIP, or BGP domains.
Creating an IPv4 Prefix List
To create an IPv4 prefix list, enter the ip prefix-list command, followed by the list's name. The switch enters the IPv4 prefix-list configuration mode for the list. If the name of an existing ACL follows the command, subsequent commands edit that list.
Examples
The following command places the switch in IPv4 prefix list configuration mode to create an IPv4 prefix list named route-one.
switch(config)# ip prefix-list route-one
switch(config-ip-pfx)#
This series of commands creates four different rules for the prefix-list named route-one.
To view the list, save the rules by exiting the Prefix-list command mode using the exit command, then re-enter the configuration mode and use the show active command.
switch(config-ip-pfx)# exit
switch(config)# ip prefix-list route-one
switch(config-ip-pfx)# show active
ip prefix-list route-one
seq 10 deny 10.1.1.0/24
seq 20 deny 10.1.0.0/16
seq 30 permit 12.15.4.9/32
seq 40 deny 1.1.1.0/24
switch(config-ip-pfx)# ip prefix-list route-one
The switch provides an IPv6 prefix-list configuration mode for creating and modifying IPv6 prefix lists. A list can be edited only in the mode where it was created.
To create an IP ACL, enter the ipv6 prefix-list command and the list's name. The switch enters the list's IPv6 prefix-list configuration mode. If the name of an existing ACL follows the command, subsequent commands edit that list.
Example
This command places the switch in the IPv6 prefix list configuration mode to create an IPv6 prefix list named map1.
To append a rule to the end of a list, enter the rule without a sequence number while in Prefix-List configuration mode for the list. The system derives the new rule’s sequence number by adding 10 to the last rule’s sequence number.
Example
These commands enter the first two rules into a new prefix list.
To view the list, save the rules by exiting the prefix-list command mode using the exit command, then re-enter the configuration mode and use the show active command.
To insert a rule into a prefix list, use the seq (IPv6 Prefix Lists) command to enter a rule with a sequence number between the numbers of two existing rules.
Example
This command inserts a rule between the first two by assigning sequence number 15.
Route map match commands include an option that matches a specified prefix list.
Example
The MAP_1 route map uses a match command that references the PL_1 prefix list.
switch(config)# route-map MAP_1 permit
switch(config-route-map-MAP_1)# match ip address prefix-list PL_1
switch(config-route-map-MAP_1)# set community 500
switch(config-route-map-MAP_1)# exit
Static Routes Redistribution into IGPs
Use match ip next-hop to match against next-hops in a route-map. This can be used to redistribute matching static routes into an IGP (IS-IS, OSPF, etc.).
The following example applies the match ip next-hop clause for static routes redistributed into IGPs for multi-agent mode. The following configures a static route.
switch(config)# ip route 10.20.30.0/24 1.2.3.4
The following commands configure a prefix-list:
switch (config)# ip prefix-list prefixListName
switch(config-ip-pfx)# permit 1.2.3.4/32
1.2.3.4 is a configured next-hop for static route 10.20.30.0/24.
The following commands configure a route map:
switch(config)# route-map routeMapName
switch(config-route-map-routeMapName)# match ip next-hop prefix-list prefixListName
For example, based on the route-map mentioned in the preceding command, to redistribute matching static routes into an IGP, use the following command for IS-IS:
View redistributed routes using the following show commands.
The show ip route command displays the IP route.
switch# show ip route
VRF: default
Codes: C - connected, S - static, K - kernel,
O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP,
R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
NG - Nexthop Group Static Route, V - VXLAN Control Service,
DH - DHCP client installed default route, M - Martian,
DP - Dynamic Policy Route, L - VRF Leaked
Gateway of last resort is not set
...
I L2 10.20.30.0/24 [115/10] via 1.2.3.4, Ethernet1
Use the show isis database detail command to view routes redistributed into IS-IS.
switch# show isis database detail
IS-IS Instance: B VRF: default
IS-IS Level 1 Link State Database
LSPID Seq Num Cksum Life IS Flags
...
IS-IS Level 2 Link State Database
LSPID Seq Num Cksum Life IS Flags
0000.0000.0001.00-00 6 10364 840 L2 <>
...
Reachability : 10.20.30.0/24 Metric: 0 Type: 1 Up
...
While the preceding example applies to IS-IS, a similar approach may be taken for other IGPs, such as OSPF.
Port ACLs with User-Defined Fields
Describes the support for specifying User-Defined Fields (UDF) in Port ACLs, including IPv4, IPv6, and MAC ACLs. The purpose of the User-Defined Fields feature is to permit or deny packets based on custom offset pattern matching.
User-Defined Fields, or UDFs, are part of an access-list filter and comprise an offset, length, pattern match and mask. This describes a single portion of any incoming packet that matches the provided value.
UDFs may also be defined via aliases. Aliases can save a UDF configuration for reuse in multiple access lists or access list rules. An alias may substitute for a fully defined UDF, including the offset, pattern, and mask. The pattern or mask may be overridden when the alias is used in an access list rule.
The behavior, CLI syntax, and configuration of UDFs are identical to Traffic Steering UDF and Mirroring ACL UDF.
This section describes port ACLs with user-defined fields, including configuration instructions. Topics covered by this section include:
User-Defined Fields (UDFs) are specified as part of an access list. However, the type of access list dictates the base position of the UDF and the options available. In addition, you must configure a TCAM profile to include UDFs as part of the Port ACL feature’s key.
TCAM Profile
User-Defined Fields are defined as additional fields in the Port ACL feature’s key. By default, UDFs are not included in the keys for the Port ACL features. Adding a UDF to the key requires removing different key fields to fit within the TCAM width restrictions.
Note: Each UDF is either 16 bits wide or 32 bits wide.
The following are example configurations of the TCAM profile.
IPv4 Port ACL
The following configurations create a new profile based on the default profile. This new profile replaces the Layer 4 port key fields with one 16-bit UDF and one 32-bit UDF.
switch(config)# hardware tcam
switch(config-hw-tcam)# profile ipv4Udf copy default
switch(config-hw-tcam-profile-ipv4Udf)# feature acl port ip
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# no key field l4-ops
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# no key field l4-src-port
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# no key field l4-dst-port
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# key field udf-16b-1
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# key field udf-32b-1
switch(config-hw-tcam-profile-ipv4Udf-feature-acl-port-ip)# exit
switch(config-hw-tcam-profile-ipv4Udf)# exit
switch(config-hw-tcam)# system profile ipv4Udf
16-bit IPv4 Header Match
Example
The following configurations match IPv4 packets based on the Identification (ID) field.
Packets ingressing into interface ethernet 7 with an ID equal to 1000 (0x03E80000) are forwarded, while packets with an ID different from 1000 are dropped.
(config)# ip access-list udfAcl
(config-acl-udfAcl)# permit ip any any payload header start offset 1 pattern 0x03E80000 mask 0x0000FFFF
(config-acl-udfAcl)# deny ip any any
(config-acl-udfAcl)# exit
(config)# interface ethernet 7
(config-if-Et7)#
IPv6 Port ACL
The following configurations create a new profile based on the default profile. This new profile replaces the destination IPv6 address key field with two 32-bit UDFs.
switch(config)# hardware tcam
switch(config-hw-tcam)# profile ipv6Udf copy default
switch(config-hw-tcam-profile-ipv6Udf)# feature acl port ipv6
switch(config-hw-tcam-profile-ipv6Udf-feature-acl-port-ipv6)# no key field dst-ipv6
switch(config-hw-tcam-profile-ipv6Udf-feature-acl-port-ipv6)# key field udf-32b-1
switch(config-hw-tcam-profile-ipv6Udf-feature-acl-port-ipv6)# key field udf-32b-2
switch(config-hw-tcam-profile-ipv6Udf-feature-acl-port-ipv6)# exit
switch(config-hw-tcam-profile-ipv6Udf)# exit
switch(config-hw-tcam)# system profile ipv6Udf
32-bit IPv6 Payload Match
Example
The following configurations match IPv6 UDP packets based on the first 32 bits of the packet payload.
UDP packets ingressing into interface ethernet 7 that starts with 0x1234567X (where X can be any valid hexadecimal) in the payload are forwarded while dropping any other packets. The offset is set to 2 (2 x 4-byte words) to skip the UDP header.
(config)# ipv6 access-list udfAcl
(config-ipv6-acl-udfAcl)# permit udp any any payload offset 2 pattern 0x12345670 mask 0x0000000f
(config-ipv6-acl-udfAcl)# deny ipv6 any any
(config-ipv6-acl-udfAcl)# exit
(config)# interface ethernet 7
(config-if-Et7)# ipv6 access-group udfAcl in
Port ACLs with User-Defined Fields Limitations
User-defined fields consume a limited set of copy resources. For each unique offset, if a pattern is specified masked to be > 16 bits wide, then a 32-bit resource is used. If no 32-bit resource is available, then two 16-bit resources are used if available. Copy resources depend on the number of UDF key fields added to the feature key. Each UDF key field maps to one copy resource. Using the above TCAM profile configurations:
IPv4: 1 × 16-bit pattern + 1 × 32-bit pattern.
IPv6: 2 × 32-bit pattern.
MAC: 1 × 16-bit pattern + 1 × 32-bit pattern.
Other limitations include:
The maximum offset value is 31, which is 31 4-byte words, or 124 bytes.
UDFs only work on ingress Port ACLs.
ACL, Route Map, and Prefix List Commands
This section describes CLI commands that this chapter references.
The clear ip access-lists counters command sets ACL counters to zero for the specified IPv4 Access Control List (ACL). The session parameter limits ACL counter clearing to the current CLI session.
Command Mode
Privileged EXEC
Command Syntax
clear ip access-lists countersacl_namescope
Parameters
acl_name - Specify the name of ACL list. Options include the following:
no parameter - Specifies all ACLs.
access_list - Specifies the name of ACL.
scope - Specify the session affected by command. Options include the following:
no parameter - Clears all counters on all CLI sessions.
session - Clears counters only on the current CLI session.
Example
This command resets all IPv4 ACL counters.
switch(config)# clear ip access-lists counters
switch(config)#
clear ipv6 access-lists counters
The clear ipv6 access-lists counters command sets ACL counters to zero for the specified IPv6 Access Control List (ACL). The session parameter limits ACL counter clearing to the current CLI session.
The continue command creates a route map statement entry that enables additional route map evaluation of routes with parameters meeting the statement matching criteria.
A statement typically contains a match (route-map) and a set (route-map) command. The evaluation of routes with settings the same as match command parameters normally ends and the statement's set commands apply to the route. Routes that match a statement containing a continue command evaluate against the statement specified by the continue command.
When a route matches multiple route map commands, the last statement that the route matches determines the filter action (deny or permit) . The set commands in all statements matching the route apply to the route after completing the route map evaluation. Multiple set commands apply in the same order by the route evaluation against the statement containing them.
The no continue and default continue commands remove the corresponding continue command from the configuration mode route map statement by deleting the corresponding command from running-config.
Command Mode
Route-Map Configuration
Command Syntax
continuenext_seq
no continuenext_seq
default continuenext_seq
Parameters
next_seq - Specifies next statement for evaluating matching routes. Options include the following:
no parameter - The next statement in the route map, as determined by sequence number.
seq_number - Specifies the number of the next statement. Values range from 1 to 16777215.
Restrictions
A continue command cannot specify a sequence number smaller than the sequence number of the route map statement.
Related Command
route-map command enters the Route-Map Configuration Mode.
Example
This command creates route map map1, statement 40 with a match command, a set command, and a continue command. Routes that match the statement subsequently evaluate against statement 100. The set local-preference command applies to matching routes regardless of subsequent matching operations.
switch(config)# route-map map1 deny 40
switch(config-route-map-map1)# match as 15
switch(config-route-map-map1)# continue 100
switch(config-route-map-map1)# set local-preference 50
switch(config-route-map-map1)#
counters per-entry
The counters per-entry command places the ACL in counting mode. In counting mode, the feature generally displays the number of instances in which each rule in the list matches an inbound packet and the elapsed time since the last match. However, for certain select platforms, in addition to the packet counter, ACL counters can also be enabled for byte counts when applied to data plane ACLs. Review the complete list of platforms that support byte count for data plan ACLslisted below:
Note: Only dataplane ACLs support byte counting on the switch.
The following platforms support ACL byte counting:
On the FM6000 platform, this command has no effect when used in an ACL for a PBR class map.
The no counters per-entry and default counters per-entry commands place the ACL in non-counting mode.
Command Mode
ACL Configuration
IPv6-ACL Configuration
Std-ACL Configuration
Std-IPv6-ACL Configuration
MAC-ACL Configuration
Command Syntax
counters per-entry
no counters per-entry
default counters per-entry
Examples
This command places the test1 ACL in counting mode.
switch(config)# ip access-list test1
switch(config-acl-test1)# counters per-entry
switch(config-acl-test1)#
This command displays the ACL, with counter information, for an ACL in counting mode.
switch# show ip access-lists
IP Access List default-control-plane-acl [readonly]
counters per-entry
10 permit icmp any any
20 permit ip any any tracked [match 12041 packets, 0:00:00 ago]
30 permit ospf any any
40 permit tcp any any eq ssh telnet www snmp bgp https [match 11 packets, 1:41:07 ago]
50 permit udp any any eq bootps bootpc snmp rip [match 78 packets, 0:00:27 ago]
60 permit tcp any any eq mlag ttl eq 255
70 permit udp any any eq mlag ttl eq 255
80 permit vrrp any any
90 permit ahp any any
100 permit pim any any
110 permit igmp any any [match 14 packets, 0:23:27 ago]
120 permit tcp any any range 5900 5910
130 permit tcp any any range 50000 50100
140 permit udp any any range 51000 51100
Total rules configured: 14
Configured on Ingress: control-plane(default VRF)
Active on Ingress: control-plane(default VRF)
On platforms that support byte counting, Counter information displays as shown below:
switch# show ip access-lists
IP Access List default-control-plane-acl [readonly]
counters per-entry
10 permit icmp any any [match 30 packets, 0:02:08 ago]
20 permit ip any any tracked [match 97777 packets, 0:00:00 ago]
30 permit udp any any eq bfd ttl eq 255
40 permit udp any any eq bfd-echo ttl eq 254
50 permit udp any any eq multihop-bfd micro-bfd sbfd
60 permit udp any eq sbfd any eq sbfd-initiator
70 permit ospf any any
80 permit tcp any any eq ssh telnet www snmp bgp https msdp ldp netconf-ssh gnmi [match 72 packets, 0:00:00 ago]
90 permit udp any any eq bootps bootpc snmp rip ntp ldp ptp-event ptp-general
100 permit tcp any any eq mlag ttl eq 255
110 permit udp any any eq mlag ttl eq 255
120 permit vrrp any any
130 permit ahp any any
140 permit pim any any
Total rules configured: 14
Configured on Ingress: control-plane(default VRF)
Active on Ingress: control-plane(default VRF)
IP Access List ipCountersTest:The ipCountersTest ACL is applied to the data plane. Hence, it displays the byte count information as shown below:
counters per-entry
10 permit tcp host 10.1.1.1 range 2000 4000 host 10.2.1.1 [match 486 bytes in 3 packets, 0:00:26 ago]
20 permit tcp host 10.1.1.1 range 14000 16000 host 10.2.1.1 [match 486 bytes in 3 packets, 0:00:18 ago]
30 permit udp host 10.1.1.1 range 62000 64000 host 10.2.1.1 [match 450 bytes in 3 packets, 0:00:00 ago]
40 permit tcp host 10.1.1.1 range 50000 52000 host 10.2.1.1 [match 486 bytes in 3 packets, 0:00:02 ago]
50 permit tcp host 10.1.1.1 range 38000 40000 host 10.2.1.1 [match 486 bytes in 3 packets, 0:00:10 ago]
60 permit tcp host 10.1.1.1 range 26000 28000 host 10.2.1.1 [match 486 bytes in 3 packets, 0:00:18 ago]
Total rules configured: 6
ipCountersTest ACL applies to the data plane and displays the byte count information.
deny (IPv4 ACL)
The denycommand adds a deny rule to the configuration mode IPv4 Access Control List (ACL). Interfaces with the ACL drop packets filtered by a deny rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL's last rule.
The no deny and default deny commands remove the specified rule from the configuration mode ACL. The no sequence number (ACLs) command also removes the specified rule from the ACL.
Note: Commands use a subset of the listed fields. Available parameters depend on specified protocol.
Parameters
seq_num - The sequence number assigned to the rule. Options include the following:
no parameter The number derive from adding 10 to the number of the ACL last rule.
14294967295 - The number assigned to the entry.
protocol Specify the protocol field filter. Values include the following:
ahp - Authentication Header Protocol (51
icmp - Internet Control Message Protocol (1)
igmp - Internet Group Management Protocol (2)
ip - Internet Protocol v4 (4)
ospf - Open Shortest Path First (89)
pim - Protocol Independent Multicast (103)
tcp - Transmission Control Protocol (6)
udp - User datagram protocol (17)
vrrp - Virtual Router Redundancy Protocol (112)
protocol_num - An integer corresponding to an IP protocol. Values range from 0 to 255.
source_addr and dest_addr - Specify the source and destination address filters. Values include the following:
network_addr - Specify the subnet address as a CIDR or address-mask.
any - Filter packets from all addresses.
hostip_addr - Specify an IP address in dotted decimal notation.
Subnet addresses support discontiguous masks.
source_port and dest_port - Specify the source and destination port filters. Values include the following:
any - Specify all ports.
eqport-1port-2 ... port-n - Specify a list of ports. Maximum list size is 10 ports.
neqport-1port-2 ... port-n - Specify the set of all ports not listed. Maximum list size is 10 ports.
gtport - Specify the set of ports with larger numbers than the listed port.
ltport - Specify the set of ports with smaller numbers than the listed port.
rangeport_1port_2 - Specify a range of ports.
fragments Filters packets with FO bit set that indicates a non-initial fragment packet.
flags Flag bit filters (TCP packets).
message Message type filters (ICMP packets).
tracked Rule filters packets in existing ICMP, UDP, or TCP connections.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
dscp_filter - Filters a packet by the DSCP value. Values include the following:
no parameter -Specify that the rule does not use DSCP to filter packets.
dscpdscp_value - Specify to match packets match if the DSCP field in packet equals the dscp_value.
TTL_FILTER - Filters a packet by the TTL (time-to-live) value. Values include the following:
ttl eqttl_value - Match packets if ttl in packet is equal to ttl_value.
ttl gtttl_value - Match packets if ttl in packet is greater than ttl_value.
ttl ltttl_value - Match packets if ttl in packet is less than ttl_value.
ttl neqttl_value - Match packets if ttl in packet is not equal to ttl_value.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
log - Triggers an informational log message to the console about the matching packet.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
Examples
This command appends a deny statement at the end of the ACL. The deny statement drops OSPF packets from 10.10.1.1/24 to any host.
switch(config)# ip access-list text1
switch(config-acl-text1)# deny ospf 10.1.1.0/24 any
switch(config-acl-text1)#
This command inserts a deny statement with the sequence number 65. The deny statement drops all PIM packets.
switch(config-acl-text1)# 65 deny pim any any
switch(config-acl-text1)#
deny (IPv6 ACL)
The denycommand adds a deny rule to the an IPv6 Access Control List (ACL). Interfaces with the ACL drop packets filtered by a deny rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL's last rule.
The no deny and default deny commands remove the specified rule from the configuration mode ACL. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.
Note: Commands use a subset of the listed fields. Available parameters depend on specified protocol. Use CLI syntax assistance to view parameters for specific protocols when creating a deny rule.
Parameters
seq_num - The sequence number assigned to the rule. Optionsinclude the following:
no parameter - The number derived from adding 10 to the number of the ACL last rule.
1 - 4294967295 - A number assigned to an entry.
prot - Specify the protocol field filter. Values include the following:
icmpv6 - Internet Control Message Protocol for version 6 (58)
ipv6 - Internet Protocol IPv6 (41)
ospf - Open Shortest Path First (89)
tcp - Transmission Control Protocol (6)
udp - User Datagram Protocol (17)
protocol_num - An integer corresponding to an IP protocol. Values range from 0 to 255.
SRC_ADDR and DEST_ADDR - Specify source and destination address filters. Options include the following:
ipv6_prefix - Specify an IPv6 address with prefix length (CIDR notation).
any - Filter packets from all addresses.
hostipv6_addr - Specify an IPv6 host address.
SRC_PT and DEST_PT - Specify the source and destination port filters. Options include the following:
any - Specify all ports.
eqport-1port-2 ... port-n - Specify a list of ports. Maximum list size is 10 ports.
neqport-1port-2 ... port-n - Specify the set of all ports not listed. Maximum list size is 10 ports.
gt port - Specify the set of ports with larger numbers than the listed port.
ltport - Specify the set of ports with smaller numbers than the listed port.
rangeport_1port_2 - Specify a range of ports.
HOP - Filters by packet hop-limit value. Options include the following:
no parameter - The rule does not use hop limit to filter packets.
hop-limit eqhop_value - Match packetsif hop-limit value in packet equals hop_value.
hop-limit gthop_value - Match packets if hop-limit in packet is greater than hop_value.
hop-limit lthop_value - Match packets if hop-limit in packet is less than hop_value.
hop-limit neqhop_value - Match packets if hop-limit in packet is not equal to hop_value.
FLAG - Specify flag bit filters (TCP packets).
MSG - Specify message type filters (ICMPv6 packets).
tracked - Specify rule filters packets in existing ICMP, UDP, or TCP connections.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
DSCP_FILTER- Filters packet by theDSCP value. Values include the following:
no parameter - The rule does not use DSCP to filter packets.
dscpdscp_value - Match packets if DSCP field in packet equals the dscp_value.
log - Triggers an informational log message to the console about the matching packet.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
Example
This command appends a deny statement at the end of the ACL. The deny statement drops IPv6 packets from 3710:249a:c643:ef11::/64 to any host.
switch(config)# ipv6 access-list text1
switch(config-acl-text1)# deny ipv6 3710:249a:c643:ef11::/64 any
switch(config-acl-text1)#
deny (IPv6 Prefix List)
The deny command adds a deny rule in the IPv6 Prefix List Configuration Mode . Route map match commands use prefix lists to filter routes for redistribution into OSPF, RIP, or BGP domains. Routes are denied access when they match the prefix in a deny statement.
The no deny and default deny commands remove the specified rule from theIPv6 prefix list. The no deny command also removes the specified rule from the prefix list.
Command Mode
IPv6-pfx Configuration
Command Syntax
sequencedenyipv6_prefixmask
Parameters
sequence - A sequence number assigned to the rule. Options include the following:
no parameter - A number derived by adding 10 to the number of the list last rule.
seqseq_num - A number specified by seq_num. Value ranges from 0 to 65535.
ipv6_prefix - Specify the IPv6 prefix to filter routes (CIDR notation).
mask - Specify the range of the prefix to match.
no parameter - Requires an exact match with the subnet mask.
eqmask_e - Specify a prefix length equal to mask_e.
gemask_g Specify a range from mask_g to 128.
lemask_l - Specify a range from subnet mask length to mask_l.
gemask_lle mask_g - Specify a range from mask_g to mask_l.
mask_e, mask_land, and mask_g -from 1 to 128.
Example
This command appends a deny statement at the end of the text1 prefix list. The deny statement denies redistribution of routes with the specified prefix.
The deny command adds a deny rule to the MAC Access Control List (ACL) Configuration Mode.
Interfaces with an applied ACL drop packets filtered by a deny rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL last rule.
The no deny and default deny commands remove the specified rule from the MAC Access Control List (ACL) Configuration Mode. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.
Command Mode
MAC-ACL Configuration Mode
Command Syntax
seq_numdenysource_addrdest_addr [protocol][log]
no denysource_addrdest_addr [protocol][log]
default denysource_addrdest_addr [protocol][log]
Parameters
seq_num Sequence number assigned to the rule. Options include the following:
no parameter - A number derived by adding 10 to the number of the ACL's last rule.
1 - 4294967295 - A number assigned to entry.
source_addr and dest_addr - Configure source and destination address filters. Options includethe following:
mac_address mac_mask - Specify the MAC address and mask.
any - Filters all Packets from all addresses.
mac_address - Specifies a MAC address in 3x4 dotted hexadecimal notation (hhhh.hhhh.hhhh).
mac_mask - Specifies a MAC address mask in 3x4 dotted hexadecimal notation (hhhh.hhhh.hhhh).
0 - Requires an exact match to filter.
1 - Filters on any value.
protocol - Configure a protocol field filter. Values include the following:
protocol_num An integer corresponding to a MAC protocol. Values range from 0 to 65535.
log Triggers an informational log message to the console about the matching packet.
Examples
This command appends a permit statement at the end of the ACL. The deny statement drops all aarp packets from 10.1000.0000 through 10.1000.FFFF to any host.
switch(config)# mac access-list text1
switch(config-mac-acl-text1)# deny 10.1000.0000 0.0.FFFF any aarp
This command inserts a permit statement with the sequence number 25. The deny statement drops all packets through the interface.
switch(config-mac-acl-text1)# 25 deny any any
deny (Standard IPv4 ACL)
The deny command adds a deny rule to the Standard IPv4 Access Control List (ACL) Configuration Mode. Standard ACL rules filter on the source field.
Interfaces with an applied ACL drop packets filtered by a deny rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL last rule.
The no deny and default deny commands remove the specified rule from the Standard IPv4 Access Control List (ACL) Configuration Mode. The no sequence number (ACLs) command also removes the specified rule from the ACL.
Command Mode
Std-ACL Configuration
Command Syntax
[seq_num] denysource_addrlog
no denysource_addrlog
default denysource_addrlog
Parameters
seq_num - Specify the sequence number assigned to the rule. Options include the following:
no parameter - A number derived by adding 10 to the number of the ACL last rule.
1 - 4294967295 - A number assigned to entry.
source_addr- Specify a source address filter. Options include the following:
network_addr - Specify a subnet address as a CIDR or address-mask.
any Filter packets from all addresses.
hostip_addr - Specify an IP address in dotted decimal notation.
Subnet addresses support noncontinuous masks.
log - Triggers an informational log message to the console about the matching packet.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
Example
This command appends a deny statement at the end of the ACL. The deny statement drops packets from 10.10.1.1/24.
switch(config)# ip access-list standard text1
switch(config-std-acl-text1)# deny 10.1.1.1/24
switch(config-std-acl-text1)#
deny (Standard IPv6 ACL)
The denycommand adds a deny rule to the Standard IPv6 Access Control List (ACL) Configuration Mode. Standard ACL rules filter on the source field.
Interfaces with an applied ACL drop packets filtered by a deny rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL's last rule.
The no deny and default deny commands remove the specified rule from the Standard IPv6 Access Control List (ACL) Configuration Mode. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.
Command Mode
Std-IPv6-ACL Configuration
Command Syntax
seq_numdenysource_addr
no denysource_addr
default denysource_addr
Parameters
seq_num Sequence number assigned to the rule. Options include:
no parameter - A Number derived by adding 10 to the number of the ACL's last rule.
1 - 4294967295 - The number assigned to entry.
source_addr- The Source address filter configured for the ACL. Options include:
ipv6_prefix - IPv6 address with prefix length (CIDR notation).
any - Filter all packets from all addresses.
hostipv6_addr - Specify the IPv6 host address.
Example
This command appends a deny statement at the end of the ACL. The deny statement drops packets from 2103::/64.
switch(config)# ipv6 access-list standard text1
switch(config-std-acl-ipv6-text1)# deny 2103::/64
switch(config-std-acl-ipv6-text1)#
description (route map)
The description command adds a text string to the configuration mode route map. The string has no functional impact on the route map.
The no description and default description commands remove the text string from the configuration mode route map by deleting the corresponding description command from running-config.
Command Mode
Route-Map Configuration
Command Syntax
descriptionlabel_text
no description
default description
Parameter
label_text Character string assigned to the route map configuration.
These commands add description text to the XYZ-1 route map.
switch(config)# route-map XYZ-1
switch(config-route-map-XYZ-1)# description This is the first map.
switch(config-route-map-XYZ-1)# exit
switch(config)# show route-map XYZ-1
route-map XYZ-1 permit 10
Description:
description This is the first map.
Match clauses:
Set clauses:
switch(config)#
hardware access-list resource sharing vlan in
The hardware access-list resource sharing vlan in command enables the IPv4 Ingress Sharing of hardware resources on the switch when the same ACL applies to different VLANs.
The no hardware access-list resource sharing vlan in command disables the IPv4 Ingress Sharing of hardware resources on the switch.
Command Mode
Global Configuration
Command Syntax
hardware access-list resource sharing vlan [ipv4 | ipv6] in
no hardware access-list resource sharing vlan in
Guidelines
Ccompatible only with the DCS-7010 and DCS-7050x series switches.
Enabling IPv4 Ingress Sharing requires the restart of software agents on the platform. This is a disruptive process and impacts traffic forwarding.
Use the show platform trident command to verify the Ingress IPv4 Sharing information.
hardware access-list resource sharing vlan ipv4 out
The hardware access-list resource sharing vlan ipv4 out command enables IPv4 Egress RACL TCAM sharing on the switch.
The no hardware access-list resource sharing vlan ipv4 out command disables the IPv4 Egress RACL TCAM sharing on the switch. By default, the switch enables IPv4 Egress RACL sharing.
Command Mode
Global Configuration
Command Syntax
hardware access-list resource sharing vlan ipv4 out
no hardware access-list resource sharing vlan ipv4 out
Guidelines
Compatible only with the DCS-7280E and DCS-7500E series switches.
Disabling IPv4 RACL sharing requires the restart of software agents on the platform. This is a disruptive process and impacts traffic forwarding.
Enabling IPv4 RACL sharing, if previously disabled from the default configuration, requires the restart of software agents on the platform. This is a disruptive process and impacts traffic forwarding. Enabling IPv4 RACL sharing if uRPF is configured disables uRPF.
Use the show running-config all | include sharing command to verify whether or not sharing for egress IPv4 RACLs is enabled.
Example
This command verifies if IPv4 RACL sharing is enabled or disabled.
switch# show running-config all | include sharing
hardware access-list resource sharing vlan ipv4 out
---->It returns the following output if IPv4 RACL sharing is enabled.
hardware access-list update default-result permit
The hardware access-list update default-result permit command configures the switch to permit all traffic on Ethernet and VLAN interfaces with ACLs applied to them while modifying the ACLs. Permits traffic when modifying the ACL using one of the ip access-list commands, and ends when exiting the ACL Configuration Mode and rules populated in hardware. EOS disables this by default.
The no hardware access-list update default-result permit and default hardware access-list update default-result permit commands restore the switch to the default state and blocks traffic during ACL modifications by removing the corresponding hardware access-list update default-result permit command from the running-config.
Command Mode
Global Configuration
Command Syntax
hardware access-list update default-result permit
no hardware access-list update default-result permit
The hardware counter feature acl out command enables egress ACL hardware counters for IPv4 or IPv6 and count the number of packets matching rules associated with egress ACLs applied to various interfaces on a switch.
The no hardware counter feature acl out and default hardware counter feature acl out commands disable or return the egress ACL hardware counters to the default state.
Command Mode
Global Configuration
Command Syntax
hardware counter feature acl out [options [ipv4 | ipv6]
no hardware counter feature acl out [options [ipv4 | ipv6]
default hardware counter feature acl out [options [ipv4 | ipv6]
Parameters
options - ACL hardware counter options include the following:
ipv4 - Specify an IPv4 address.
ipv6 - Specify an IPv4 address.
Examples
This command enables IPv4 egress ACL hardware counters.
switch(config)# hardware counter feature acl out ipv4
switch(config)#
This command disables IPv4 egress ACL hardware counters.
switch(config)# no hardware counter feature acl out ipv4
switch(config)#
ip access-group (Service ACLs)
The ip access-group (Service ACLs) command configures a Service ACL to apply to a control-plane service. Specify the service by the command mode used to apply the Service ACL.
The no ip access-group and default ip access-group commands remove the corresponding ip access-group (Service ACLs) command from running-config.
Command Mode
Mgmt-SSH Configuration
Mgmt-API Configuration
Router-BGP Configuration
Router-OSPF Configuration
Router-IGMP Configuration
MPLS-LDP Configuration
Queue-Monitor-Streaming Configuration
MPLS-Ping Configuration
Mgmt-Telnet Configuration
Command Syntax
ip access-group acl_name [vrfvrf_name][in]
no ip access-groupacl_name [vrfvrf_name][in]
default ip access-groupacl_name [vrfvrf_name][in]
Parameters
Parameters vary by process.
acl_name - Specify the name of the Service ACL assigned to control-plane service.
vrfvrf_name - Specifies the VRF to apply the Service ACL.
in - Specifies inbound connections or packets only. Requires a keyword for SSH and Telnet services.
Example
These commands apply the Service ACL bgpacl to the BGP routing protocol in VRF purple.
The ip access-group command applies an IPv4 or standard IPv4 Access Control List (ACL) to an interface or subinterface in the Interface Configuration Mode.
The no ip access-group and default ip access-group commands remove the corresponding ip access-group command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
ip access-grouplist_name[direction [in | out]]
no ip access-grouplist_name[direction [in | out]]
default ip access-grouplist_name [direction [in | out]]
Parameters
list_name - Specify the name of ACL assigned to interface.
direction Transmission direction of packets, relative to interface. Valid options include the following:
in - Inbound packets.
out - Outbound packets.
Considerations
Filtering of outbound packets by ACLs not supported on Petra platform switches.
Filtering of outbound packets by ACLs on FM6000 switches supported on physical interfaces only (Ethernet and port channels).
ACLs on sub-interfaces are supported on DCS-7280E, DCS-7500E, DCS-7280R, and DCS-7500R.
Example
These commands apply the IPv4 ACL named test2 to interface ethernet 3.
switch(config)# interface ethernet 3
switch(config-if-Et3)# ip access-group test2 in
switch(config-if-Et3)#
ip access-list
The ip access-list command places the switch in ACL Configuration Mode, a group change mode that modifies an IPv4 access control list. The command specifies the name of the IPv4 ACL that subsequent commands modify and creates an ACL if it references a nonexistent list. All changes in a group change mode edit session are pending until the end of the session.
The exit command saves pending ACL changes to running-config, then returns the switch to Global Configuration Mode. ACL changes are also saved by entering a different configuration mode.
The abort command discards pending ACL changes, returning the switch to Global Configuration Mode.
The no ip access-list and default ip access-list commands delete the specified IPv4 ACL.
Command Mode
Global Configuration
Command Syntax
ip access-listlist_name
no ip access-listlist_name
default ip access-listlist_name
Parameter
list_name - Specify the name of the ACL. Must begin with an alphabetic character. Cannot contain spaces or quotation marks.
This command places the switch in ACL configuration mode to modify the filter1 IPv4 ACL.
switch(config)# ip access-list filter1
switch(config-acl-filter1)#
This command saves changes to filter1 ACL, then returns the switch to Global Configuration Modee.
switch(config-acl-filter1)# exit
switch(config)#
This command discards changes to filter1, then returns the switch to Global Configuration Mode.
switch(config-acl-filter1)# abort
switch(config)#
ip access-list standard
The ip access-list standard command places the switch in STD-ACL Configuration Mode, a group change mode that modifies a standard IPv4 access control list. The command specifies the name of the standard IPv4 ACL that subsequent commands modify, and creates an ACL if it references a nonexistent list. All group change mode edit session changes are pending until the session ends.
The exit command saves pending ACL changes to running-config, then returns the switch to Global Configuration Mode. Pending changes are also saved by entering a different configuration mode.
The abort command discards pending ACL changes, returning the switch to global configuration mode.
The no ip access-list standard and default ip access-list standard commands delete the specified ACL.
Command Mode
Global Configuration
Command Syntax
ip access-list standardlist_name
no ip access-list standardlist_name
default ip access-list standardlist_name
Parameter
list_name - Specify the name of standard ACL. Must begin with an alphabetic character. Cannot contain spaces or quotation marks.
The ip prefix-list command creates a prefix list or adds an entry to an existing list. Route map match commands use prefix lists to filter routes for redistribution into OSPF, RIP, or BGP domains.
A prefix list comprises all prefix list entries with the same label. The sequence numbers of the rules in a prefix list specify the order for applying rules to a route evaluated by the match command.
The no ip prefix-list and default ip prefix-listcommands delete the specified prefix list entry by removing the corresponding ip prefix-list statement from running-config. If the no or default ip prefix-list command does not list a sequence number, the command deletes all entries of the prefix list.
Command Mode
Global Configuration
Command Syntax
ip prefix-listlist_name[deny | permit] [seqindex] network_addr [mask] resequenceseq_numberremarkcomment
no ip prefix-listlist_nameseq [index]
default ip prefix-listlist_nameseq [index]
Parameters
list_name - Specify a name for the prefix list.
seqseq_num- Specify the sequence number for the prefix list entry Value ranges from 0 to 65535.
permit | deny - Specifies route access when a route matches IP prefix list. Options include:
permit - Allows access when matching the specified subnet.
deny - Denies access when matching the specified subnet.
network_addr - Specify the subnet to filter routes. Use either a CIDR or address-mask format.
MASK - Specifies the range of the prefix to be matched.
no parameter Exact match with the subnet mask is required.
eqmask_e Prefix length is equal to mask_e.
gemask_g Range is from 1 to 32.
le mask_l Range is from subnet mask length to mask_l.
ge mask_llemask_g Range is from mask_g to mask_l.
mask_e, mask_l, and mask_g range from 1 to 32. When le and ge are specified, subnetmaskmask_g>mask_l.
remarkcomment - Add a comment to the prefix list configuration.
Example
This command places the switch in IPv4 prefix list configuration mode to create an IPv4 prefix list named route-one.
switch(config)# ip prefix-list route-one
switch(config-ip-pfx)#
These commands create four different rules for the prefix-list named route-one.
The ipv6 access-groupcommand applies an IPv6 or standard IPv6 Access Control List (ACL) to the configuration mode interface.
The no ipv6 access-group and default ipv6 access-group commands remove the corresponding ipv6 access-group command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Interface-VLAN Configuration
Command Syntax
ipv6 access-grouplist_name[in | out]
no ipv6 access-grouplist_name[in | out]
default ipv6 access-grouplist_name[in | out]
Parameters
list_name - Specify the name of the ACL assigned to interface.
[in | out] - Specify the transmission direction of packets, relative to interface. Valid options include the following:
in Inbound packets.
out Outbound packets.
Examples
These commands assign the IPv6 ACL named test2 to the interface ethernet 3.
switch(config)# interface ethernet 3
switch(config-if-Et3)# ipv6 access-group test2 in
switch(config-if-Et3)#
ipv6 access-group (Service ACLs)
The ipv6 access-group (Service ACLs) command configures an IPv6 or standard IPv6 Service ACL to be applied by a control-plane service. Specify the service with the command mode to apply the Service ACL.
The no ipv6 access-group (Service ACLs) and default ipv6 access-group (Service ACLs) commands remove the corresponding ipv6 access-group (Service ACLs) command from running-config.
Command Mode
Mgmt-SSH Configuration
Mgmt-API Configuration
Router-BGP Configuration
Router-OSPF Configuration
MPLS-LDP Configuration
Queue-Monitor-Streaming Configuration
MPLS-Ping Configuration
Mgmt-Telnet Configuration
Command Syntax
ipv6 access-groupipv6_acl_name [vrfvrf_name][in]
no ipv6 access-group [ipv6_acl_name][vrfvrf_name][in]
The ipv6 access-list command places the switch in IPv6-ACL Configuration Mode, a group change mode that modifies an IPv6 access control list. The command specifies the name of the IPv6 ACL that subsequent commands modify and creates an ACL if it references a nonexistent list. All changes in a group change mode edit session pend until the end of the session.
The exit command saves pending ACL changes to running-config, then returns the switch to global configuration mode. ACL changes are also saved by entering a different configuration mode.
The abort command discards pending ACL changes, returning the switch to Global Configuration Mode.
The no ipv6 access-list and default ipv6 access-list commands delete the specified IPv6 ACL.
Command Mode
Global Configuration
Command Syntax
ipv6 access-listlist_name
no ipv6 access-listlist_name
default ipv6 access-listlist_name
Parameters
list_name - Specify a name for the ACL. Must begin with an alphabetic character and cannot contain spaces or quotation marks.
Commands Available in IPv6-ACL configuration mode:
The ipv6 access-list standard command places the switch in std-IPv6-ACL-configuration mode, a group change mode that modifies a standard IPv6 access control list. The command specifies the name of the standard IPv6 ACL that subsequent commands modify and creates an ACL if it references a nonexistent list. All group change mode edit session changes are pending until the session ends.
The exit command saves pending ACL changes to running-config, then returns the switch to Global Configuration Mode. Pending changes are also saved by entering a different configuration mode.
The abort command discards pending ACL changes, returning the switch to global configuration mode.
The no ipv6 access-list standard and default ipv6 access-list standard commands delete the specified ACL.
Command Mode
Global Configuration
Command Syntax
ipv6 access-list standardlist_name
no ipv6 access-list standardlist_name
default ipv6 access-list standardlist_name
Parameters
list_name - Specify a name for the ACL. Must begin with an alphabetic character and cannot contain spaces or quotation marks.
Commands Available in std-IPv6-ACL configuration mode:
The ip prefix-list command places the switch in IPv6 prefix-list configuration mode, which is a group change mode that modifies an IPv6 prefix list. The command specifies the name of the IPv6 prefix list that subsequent commands modify and creates a prefix list if it references a nonexistent list. All changes in a group change mode edit session are pending until the end of the session.
The exit command saves pending prefix list changes to running-config, then returns the switch to global configuration mode. ACL changes are also saved by entering a different configuration mode.
The abort command discards pending changes, returning the switch to global configuration mode.
The no ipv6 prefix-list and default ipv6 prefix-list commands delete the specified IPv6 prefix list.
Command Mode
Global Configuration
Command Syntax
ipv6 prefix-listlist_name
no ipv6 prefix-listlist_name
default ipv6 prefix-listlist_name
Parameter
list_name Name of prefix list. Must begin with an alphabetic character. Cannot contain spaces or quotation marks.
Commands Available in IPv6-pfx configuration mode:
This command discards changes to the prefix list, then returns the switch to global configuration mode.
switch(config-ipv6-pfx)# abort
switch(config)#
mac access-group
The mac access-group command applies a MAC Access Control List (MAC ACL) when in the Interface Configuration Mode.
The no mac access-group and default mac access-group commands remove the specified mac access-group command from running-config.
Command Mode
Interface-Ethernet Configuration
Interface-Port-Channel Configuration
Command Syntax
mac access-grouplist_name [direction [in | out]]
no mac access-grouplist_name[direction [in | out]]
default mac access-grouplist_name [direction [in | out]]
Parameters
list_name - Specify the name of MAC ACL.
direction - Specify the transmission direction of packets, relative to interface. Valid options include:
in Inbound packets.
out Outbound packets.
Restrictions
Only Helix, Trident, and Trident II platform switches support filtering of outbound packets by MAC ACLs.
Example
These commands assign the MAC ACL named mtest2 to interface ethernet 3 to filter inbound packets.
switch(config)# interface ethernet 3
switch(config-if-Et3)# mac access-group mtest2 in
switch(config-if-Et3)#
mac access-list
The mac access-list command places the switch in MAC-ACL Configuration Mode, a group change mode that modifies a MAC access control list. The command specifies the name of the MAC ACL that subsequent commands modify and creates an ACL if it references a nonexistent list. All changes in a group change mode edit session are pending until the end of the session.
The exit command saves pending ACL changes to running-config, then returns the switch to Global Configuration Mode. ACL changes are also saved by entering a different configuration mode.
The abort command discards pending ACL changes, returning the switch to Global Configuration Mode.
The no mac access-list and default mac access-listcommands delete the specified list.
Command Mode
Global Configuration
Command Syntax
mac access-listlist_name
no mac access-listlist_name
default mac access-listlist_name
Parameter
list_name - Specify the name of the MAC ACL. Names must begin with an alphabetic character and cannot contain a space or quotation mark.
The match command creates a route map statement entry that specifies one route filtering command. When a statement contains multiple match commands, the permit or deny filter applies to a route only if the properties equal the corresponding parameters in each match command. When a route properties do not equal the command parameters, the route is evaluated against the next statement in the route map, as determined by sequence number. If all statements fail to permit or deny the route, the route is denied.
The no match and default match commands remove the matchcommand from the configuration mode route map statement by deleting the corresponding command from running-config.
Note: The route map configuration supports only standard ACL.
Command Mode
Route-Map Configuration
Command Syntax
matchcondition
no matchcondition
default matchcondition
Parameters
condition - Specifies criteria for evaluating a route. Options include the following:
aggregate-role - Specify the role in BGP contributor-aggregate relation. Options include the following:
contributor - Specify BGP aggregate contributor.
aggregate-attributes - Specify the Route map to apply against the aggregate route.
as1 to 4294967295 - Specify the BGP Autonomous System number.
as-pathpath_name - Specify the BGP Autonomous System path access list.
as-path length { <= | = | => } length
<= - Length of AS path must be less than or equal to specified value.
= - Length of AS path must be equal to specified value.
=> Length of AS path must be equal to or greater than specified value.
length - Value for AS path length comparison (0-4000).
communityname BGP community. Options include the following:
listname - Specify the BGP community.
listname - Specify the exact-match BGP community. The list must match the present set.
extcommunitylistname - Specify the BGP extended community. Options include the following:
listname - Specify the BGP community.
listname - Specify the exact-match BGP community. The list must match the present set.
interfaceintf_name - Specifies an interface. Options include the following::
ethernete_num - Specify the Ethernet interface.
loopbackl_num - Specify the Loopback interface.
port-channelp_num - Specify the Port channel interface.
vlanv_num - Specify the VLAN interface.
invert-result - Specify the Invert sub route map result.
ip addressLIST - Specify the IPv4 address filtered by an ACL or prefix list. Options include the following:
access-listacl_name - Specify the IPv4 address filtered by access control list (ACL).
prefix-listplv4_name- Specify the IPv4 address filtered by IP prefix list.
ip next-hop prefix-list plv4_name - Specify the IPv4 next-hop filtered by IP prefix list.
ip resolved-next-hop prefix-listplv4_name - Specify the IPv4 resolved next-hop filtered by IP prefix list.
ipv6 address prefix-list plv6_name - Specify the IPv6 address filtered by IPv6 prefix list.
ipv6 next-hop prefix-list plv6_name - Specify the IPv6 next-hop filtered by IPv6 prefix list.
ipv6 resolved-next-hop prefix-list plv6_name - Specify the IPv6 resolved nexthop filtered by IPv6 prefix list.
local-preference 1 to 4294967295 - Specify the BGP local preference metric.
metric 1 to 4294967295 - Specify the route metric.
metric-typeOSPF_TYPE - Specify the OSPF metric type. Options include the following:
type-1 OSPF type 1 metric.
type-2 OSPF type 2 metric.
source-protocol protocol_type - Specify the Routing protocol of route source. Options include the following:
This command creates a route map match rule that filters routes from BGP as 15.
switch(config)# route-map map1
switch(config-route-map-map1)# match as 15
switch(config-route-map-map1)#
This command adds a route-map match rule that the AS path be less than or equal to 300.
switch(config-route-map-map1)# match as-path length <= 300
switch(config-route-map-map1)#
no sequence number
The nosequence number command removes the rule with the specified sequence number from the ACL. The defaultsequence number command also removes the specified rule.
Command Mode
ACL Configuration
IPv6-ACL Configuration
Std-ACL Configuration
Std-IPv6-ACL Configuration
MAC-ACL Configuration
Command Syntax
noline_num
defaultline_num
Parameter
line_num - Specify the sequence number of rule to delete. Values range from 1 - 4294967295.
Example
This command removes statement 30 from the list.
switch(config-acl-test1)# show IP Access Lists test1
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
50 remark end of list
Total rules configured: 5
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
switch(config-acl-test1)# no 30
switch(config-acl-test1)# show IP Access Lists
20 permit ip any host 10.20.10.1
40 permit ip any any
50 remark end of list
Total rules configured: 4
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
permit (IPv4 ACL)
The permit command adds a permit rule to the configuration mode IPv4 Access Control List (ACL). Interfaces with the applied ACL accept packets filtered by a permit rule the ACL is applied. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL last rule.
The no permit and default permit commands remove the specified rule from the configuration mode ACL. The no <sequence number> (ACLs) command also removes a specified rule from the ACL.
Commands use a subset of the listed fields and available parameters depend on specified protocol.
Parameters
seq_num- Specify the sequence number assigned to the rule. Options include the following:
no parameter - A number derived from adding 10 to the number of the ACL's last rule.
1 - 4294967295 - Specify the number assigned to entry.
protocol - Specify the protocol field filter. Options include the following:
ahp- Authentication Header Protocol (51)
gre - Generic Routing Encapsulation
gtp - GPRS Tunneling Protocol
icmp - Internet Control Message Protocol (1)
igmp -Internet Group Management Protocol (2)
ip -Any Internet Protocol v4 (4)
ospf -Open Shortest Path First (89)
pim -Protocol Independent Multicast (103)
tcp -Transmission Control Protocol (6)
udp -User datagram protocol (17)
vlan - Enter VLAN number and mask. VLAN value range from 1 to 4094, and mask value range from 0x000-0xFFF .
vrrp - Virtual Router Redundancy Protocol (112).
protocol_num - An integer corresponding to an IP protocol. Values range from 0 to 255.
src_addr and dest_addr - Specify the source and destination address filters. Options include the following:
network_addr - Specify the subnet address (CIDR or address-mask).
any - Filter packets from all addresses.
hostip_addr - Specify the IP address in dotted decimal notation.
Source and destination subnet addresses support discontiguous masks.
source_port and dest_port Source and destination port filters. varnames include:
any - Specify all ports.
eqport-1port-2 ... port-n - Specify a list of ports. Maximum list size is 10 ports.
neqport-1port-2 ... port-n - Specify the set of all ports not listed. Maximum list size is 10 ports.
gtport - Specify the set of ports with larger numbers than the listed port.
ltport - Specify the set of ports with smaller numbers than the listed port.
rangeport_1port_2 - Specify the set of ports within a range.
fragments -Filters packets with FO bit set (indicates a non-initial fragment packet).
flags -Specify the flags bit filters (TCP packets). Use CLI syntax assistance (?) to display varnames.
msg - Specify the message type filters (ICMP packets). Use CLI syntax assistance (?) to display varnames.
tracked - Specify the rule filters packets in existing ICMP, UDP, or TCP connections.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
dscp_filter -Specify the rule filters packet by its DSCP value. Values include:
no parameter - The rule does not use DSCP to filter packets.
dscpdscp_value - Packets match if DSCP field in packet is equal to dscp_value.
ttl_filter - Rule filters packet by its TTL (time-to-live) value. Values include:
ttl eqttl_value - Match packets if ttl in packet is equal to ttl_value.
ttl gtttl_value - Match packets if ttl in packet is greater than ttl_value.
ttl ltttl_value - Match packets if ttl in packet is less than ttl_value.
ttl neqttl_value - Match packets if ttl in packet is not equal to ttl_value.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
log-Specify to trigger an informational log message to the console about the matching packet.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
Examples
This command appends a permit statement at the end of the ACL. The permit statement passes all OSPF packets from 10.10.1.1/24 to any host.
switch(config)# ip access-list text1
switch(config-acl-text1)# permit ospf 10.1.1.0/24 any
switch(config-acl-text1)#
This command inserts a permit statement with the sequence number 25. The permit statement passes all PIM packets through the interface.
switch(config-acl-text1)# 25 permit pim any any
switch(config-acl-text1)#
These commands configure ACL to permit VLAN traffic between any source and destination host.
switch(config)# ip access-list acl1
switch(config-acl-acl1)# permit vlan 1234 0x0 ip any any
permit (IPv6 ACL)
The permit command adds a permit rule to the configuration mode IPv6 Access Control List (ACL). Interfaces with the applied ACL accept packets filtered by a permit rule the ACL is applied. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL last rule.
The no permit and default permit commands remove the specified rule from the configuration mode ACL. The no <sequence number> (ACLs) command also removes a specified rule from the ACL.
Note: Commands use a subset of the listed fields and available parameters depend on specified protocol.
Parameters
seq_num - The sequence number assigned to the rule. Options include the following:
no parameter.Number is derived by adding 10 to the number of the ACL’s last rule.
1 - 4294967295 Number assigned to entry.
protocol Specify the protocol field filter. Options include the following:
icmpv6 - Internet Control Message Protocol for IPv6 (58).
ipv6 - Internet Protocol IPv6 (41).
ospf - Open Shortest Path First (89).
tcp - Transmission Control Protocol (6).
udp - User Datagram Protocol (17).
vlan - Enter VLAN number. Value ranges from 1 to 4094.
protocol_num - Integer corresponding to an IP protocol. Values range from 0 to 255.
src_addr and dest_addr - Specify the source and destination address filters. Options include the following:
ipv6_prefix - Specify the IPv6 address with prefix length (CIDR notation).
any - Specify the Packets from all addresses are filtered.
hostipv6_addr - Specify the IPv6 host address.
source_pt and DEST_PT - Specify the source and destination port filters. Options include the following:
any All ports.
eqport-1port-2 ... port-n - Specify the list of ports. Maximum list size is 10 ports.
neqport-1port-2 ... port-n Specify the set of all ports not listed. Maximum list size is 10 ports.
gtport - Specify theset of ports with larger numbers than the listed port.
ltport - Specify the set of ports with smaller numbers than the listed port.
rangeport_1port_2 - Specify the set of ports whose numbers are in the range.
hop - Filter using the packet’s hop-limit value. Options include the following:
no parameter - The rule does not use hop limit to filter packets.
hop-limit eqhop_value - Match packets if hop-limit value in packet equals hop_value.
hop-limit gthop_value - Match packets if hop-limit in packet is greater than hop_value.
hop-limit lthop_value - Match packets if hop-limit in packet is less than hop_value.
hop-limit neqhop_value - Match packets if hop-limit in packet is not equal to hop_value.
flag - Flag bit filters (TCP packets).
msg - Message type filters (ICMPv6 packets).
tracked The rule filters packets in existing ICMP, UDP, or TCP connections.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
dscp_filter The rule filters packet by its DSCP value. Options include the following:
no parameter - The rule does not use DSCP to filter packets.
dscpdscp_value - Match packets if DSCP field in packet is equal to dscp_value.
flow_label - The rule permits packets with IPv6 flow labels matching an exact value or a pattern based on a mask. varnames include:
no parameter - The rule does not use IPv6 flow labels to filter packets.
flow-label eqipv6_flow_label - The IPv6 flow label must exactly match ipv6_flow_label. Flow labels can range from 0 to 1048575.
flow-labelipv6_flow_labelflow_label_mask The IPv6 flow label must match a pattern defined by ipv6_flow_label and flow_label_mask. The mask is an inverse mask. Where the mask has a 0 bit, the flow label must match the ipv6_flow_label value, and where the mask has a 1 bit, the corresponding bit in the flow label is ignored. For example, if ipv6_flow_label is 10 (0b01010 in binary) and flow_label_mask is 0x14 (0b10100 in binary), the rule matches flow labels described by 0b.1.10 where “.” is a wildcard and can be either 0 or 1. The flow labels that match include 10 (0b01010), 14 (0b0110), 26 (0b11010), and 30 (0b1110). Flow labels can range from 0 to 1048575 and flow label masks can range from 0x00000 to 0xfffff.
log - Send an informational log message to the console when a packet matches.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
Examples
This command appends a permit statement at the end of the ACL. The permit statement passes all IPv6 packets with the source address 3710:249a:c643:ef11::/64 and with any destination address.
These commands configure ACL to permit VLAN traffic between any source and destination host.
switch(config)# ip access-list acl2
switch(config-acl-acl2)# permit ipv6 vlan 1234 0x0 ip any any
switch(config-acl-acl2)# exit
switch(config)#
These commands add a rule to permit all IPv6 packets with flow label 23.
switch(config)# ipv6 access-list acl3
switch(config-acl-acl3)# permit ipv6 any any flow-label eq 23
switch(config-acl-acl3)# exit
switch(config)#
These commands create a rule to permit all IPv6 packets matched by the flow label 23 and the mask 0x5678.
switch(config)# ipv6 access-list acl4
switch(config-acl-acl4)# permit ipv6 any any flow-label 23 0x5678
switch(config-acl-acl4)# exit
switch(config)#
permit (IPv6 Prefix List)
The permitcommand adds a rule to the configuration mode IPv6 prefix list. Route map match commands use prefix lists to filter routes for redistribution into OSPF, RIP, or BGP domains. Routes are redistributed into the specified domain when they match the prefix that a permit statement specifies.
The no permit and default permit commands remove the specified rule from the prefix list. The noseq (IPv6 Prefix Lists) command also removes the specified rule from the prefix list.
Command Mode
IPv6-pfx Configuration
Command Syntax
seq_numpermitipv6_prefixmask
Parameters
seq_num - Specify the sequence number assigned to the rule. Options include the following:
no parameter - Number derived from adding 10 to the number of the list's last rule.
seqseq_num - Specify the number from the seq_num. Value ranges from 0 to 65535.
ipv6_prefix - Specify the IPv6 prefix that filters the routes in CIDR notation.
mask - Specify the range of the prefix to match.
no parameter - Requires an exact match with the subnet mask.
eqmask_e - Specify the prefix length equal to mask_e.
gemask_g - Specify the range from the mask_g to 128.
le mask_l - Specify the range from the subnet mask length to mask_l.
gemask_llemask_g Range is from mask_g to mask_l.
mask_e, mask_l and mask_g range from 1 to 128.
When le and ge are specified, the prefix list size mask_gmask_l.
Example
This command appends a permit statement at the end of the text1 prefix list. The permit statement allows redistribution of routes with the specified prefix.
The permit command adds a permit rule to the configuration mode MAC access control list packets through the interface to which the list is applied. Rule filters include protocol, source, and destination.
The no permit and default permit commands remove the specified rule from the configuration mode ACL. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.
Command Mode
MAC-ACL Configuration
Command Syntax
seq_numpermitsource_addrdest_addrprotocollog
no permit source_addrdest_addrprotocollog
default permit source_addrdest_addrprotocollog
Parameters
seq_num - Specify the sequence number assigned to the rule. Options include the following:
no parameter - Specify the number derived by adding 10 to the number of the ACL's last rule.
1 - 4294967295 - Specify the number assigned to entry.
source_addr and dest_addr- Specify the source and destination address filters. Options include the following:
mac_addressmac_mask - Specify the MAC address and mask.
any - Filter packets from all addresses.
mac_address - Specifies a MAC address in 3x4 dotted hexadecimal notation (hhhh.hhhh.hhhh).
mac_mask - Specifies a MAC address mask in 3x4 dotted hexadecimal notation (hhhh.hhhh.hhhh).
0 - Require an exact match to filter.
1 - Filter on any value.
protocol - Specify the protocol field filter. Options include the following:
protocol_num Integer corresponding to a MAC protocol. Values range from 0 to 65535.
log - Specify to trigger an informational log message to the console about the matching packet.
Examples
This command appends a permit statement at the end of the ACL. The permit statement passes all aarp packets from 10.1000.0000 through 10.1000.FFFF to any host.
switch(config)# mac access-list text1
switch(config-mac-acl-text1)# permit 10.1000.0000 0.0.FFFF any aarp
switch(config-mac-acl-text1)#
This command inserts a permit statement with the sequence number 25. The permit statement passes all packets through the interface.
switch(config-mac-acl-text1)# 25 permit any any
switch(config-mac-acl-text1)#
permit (Standard IPv4 ACL)
The permit command adds a permit rule to a standard IPv4 Access Control List (ACL). Standard ACL rules filter on the source field.
Interfaces with the applied ACL accept packets filtered by a permit rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL's last rule..
The no permit and default permit commands remove the specified rule from the ACL. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.
seq_num - Specify the sequence number assigned to the rule. Options include the following:
no parameter - A number derived from adding 10 to the number of the ACL's last rule.
1 - 4294967295 Number assigned to entry.
source_addr - Specify the source address filter. Options include the following:
network_addr - Specify the subnet address in CIDR or as an address-mask.
any - Filter packets from all addresses.
hostip_addr - Specify the IP address in dotted decimal notation.
Subnet addresses support discontiguous masks.
log - Specify to trigger an informational log message to the console about the matching packet.
Valid in ACLs applied to the control plane.
Validity in ACLs applied to data plane varies by switch platform.
Example
This command appends a permit statement at the end of the ACL. The permit statement passes all packets with a source address of 10.10.1.1/24.
switch(config)# ip access-list standard text1
switch(config-std-acl-text1)# permit 10.1.1.1/24
switch(config-std-acl-text1)#
permit (Standard IPv6 ACL)
The permit command adds a permit rule to the standard IPv6 access control list. Standard ACL rules filter on the source field.
Interfaces with the applied ACL accept packets filtered by a permit rule. Sequence numbers determine rule placement in the ACL. Sequence numbers for commands without numbers derive from adding 10 to the number of the ACL's last rule.
The no permit and default permit commands remove the specified rule from the configuration mode ACL. The no <sequence number> (ACLs) command also removes the specified rule from the ACL.
Command Mode
Std-IPv6-ACL Configuration
Command Syntax
[seq_num] permitsource_addr
no permitsource_addr
default permitsource_addr
Parameters
seq_num - Specify the sequence number assigned to the rule. Options include the following:
no parameter - The number derived by adding 10 to the number of the ACL's last rule.
1 - 4294967295 - The number assigned to entry.
source_addr - Specify the source address filter. Options include the following:
ipv6_prefix - Specify the IPv6 address with prefix length (CIDR notation).
any - Filter packets from all addresses.
hostipv6_addr - Specify the IPv6 host address.
Example
This command appends a permit statement at the end of the ACL. The permit statement drops packets with a source address of 2103::/64.
switch(config)# ipv6 access-list standard text1
switch(config-std-acl-ipv6-text1)# permit 2103::/64
switch(config-std-acl-ipv6-text1)#
remark
The remark command adds a non-executable comment statement into the pending ACL. Remarks entered without a sequence number are appended to the end of the list. Remarks with a sequence number insert into the list as specified by the sequence number.
The default remark command removes the comment statement from the ACL.
The no remark command removes the comment statement from the ACL. The command can specify the remark by content or by sequence number.
Command Mode
ACL Configuration
IPv6-ACL Configuration
Std-ACL Configuration
Std-IPv6-ACL Configuration
MAC-ACL Configuration
Command Syntax
remarktext
line_numremark [text]
no remarktext
default remarktext
Parameters
text The comment text.
line_num Sequence number assigned to the remark statement. Value ranges from 1 - 4294967295.
Example
This command appends a comment to the list.
switch(config-acl-test1)# remark end of list
switch(config-acl-test1)# show
IP Access List test1
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
50 remark end of list
resequence (ACLs)
The resequence command assigns sequence numbers to rules in the configuration mode ACL. Command parameters specify the number of the first rule and the numeric interval between consecutive rules.
Maximum rule sequence number is 4294967295.
Command Mode
ACL Configuration
IPv6-ACL Configuration
Std-ACL Configuration
Std-IPv6-ACL Configuration
MAC-ACL Configuration
Command Syntax
resequence [start_num [inc_num]]
Parameters
start_num Sequence number assigned to the first rule. Default is 10.
inc_num Numeric interval between consecutive rules. Default is 10.
Example
The resequence command re-numbers the list, starting the first command at number 100 and incrementing subsequent lines by 20.
switch(config-acl-test1)# show
IP Access List test1
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
50 remark end of list
switch(config-acl-test1)# resequence 100 20
switch(config-acl-test1)# show
IP Access List test1
100 permit ip 10.10.10.0/24 any
120 permit ip any host 10.20.10.1
140 deny ip host 10.10.10.1 host 10.20.10.1
160 permit ip any any
180 remark end of list
route-map
The route-map command places the switch in Route-Map Configuration Mode, a group change mode that modifies a route map statement. The command specifies the name and number of the route map statement that subsequent commands modify and creates a route map statement if it references a nonexistent statement. All changes in a group change mode edit session pend until the end of the session.
Route maps define commands for redistributing routes between routing protocols. Use names, filter type (permit or deny), and sequence number to identify a route map statement. Statements with the same name are components of a single route map, and the sequence number determines the order in which the statements compare to a route.
The exit command saves pending route map statement changes to running-config, then returns the switch to global configuration mode. Also, save ACL changes by entering a different configuration mode.
The abort command discards pending changes, returning the switch to global configuration mode.
The no route-map and default route-map commands delete the specified route map statement from running-config.
Note: The route map configuration supports only standard ACL.
map_name - Assign a label to the route map. Protocols reference this label to access the route map.
filter_type - Specify the disposition of routes matching commands specified by route map statement.
permit - Redistribute routes when they match route map statement.
deny - Do not redistribute routes when they match route map statement.
no parameter Assigns permit as the filter_type.
When a route does not match the route map criteria, EOS evaluates the next statement within the route map to determine the redistribution action for the route.
sequence_number - Specify the route map position relative to other statements with the same name.
no parameter - Assign the sequence number of 10 (default) to the route map.
1-16777215 - Specifies sequence number assigned to route map.
Commands Available in Route-Map Configuration Mode:
The set command specifies modifications to routes selected for redistribution by the Route-Map Configuration Mode.
The no set and default set commands remove the specified set command from the Route-Map Configuration Mode statement by deleting the corresponding set command from running-config.
This command creates a route map entry that sets the local preference metric to 100 on redistributed routes.
switch(config)# route-map map1
switch(config-route-map-map1)# set local-preference 100
switch(config-route-map-map1)#
set as-path match
The set as-path match command configures the as_path attribute for prefixes either received from a BGP neighbor or advertised to a BGP neighbor in the Route-Map Configuration Mode.
The no set as-path match command removes the AS path specified for the BGP prefix.
Command Mode
Route-Map Configuration
Command Syntax
set as-path match [all replacement [none| auto]] as_path
set as-path match[all replacement [none| auto]] as_path
Parameters
none - Replaces the as_path of the matching routes with a null or an empty as_path.
auto - Applying the specific route map as an inbound policy to a corresponding BGP neighbor statement, then replace the as_path of the prefixes received from this neighbor with the neighbor AS number. If applying this route map as an outbound policy to a corresponding neighbor statement, then replace the as_path of the prefixes advertised to this neighbor with the locally configured AS number.
as_path - Replaces the AS-Path of the matching routes with an arbitrary as_path.
Examples
This command replaces the AS-Path with the none option.
switch# show ip bgp neighbors 80.80.1.2 advertised-routes
BGP routing table information for VRF default
Router identifier 202.202.1.1, local AS number 200
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E
- ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued
for advertisement
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop -
Link Local Nexthop
Network Next Hop Metric LocPref Weight Path
* > 101.101.1.0/24 80.80.1.1 - - - 200 i
* > 102.102.1.0/24 80.80.1.1 - - - 200 i
* > 103.103.1.0/24 80.80.1.1 - - - 200 302 i
* > 202.202.1.0/24 80.80.1.1 - - - 200 i
switch# configure terminal
switch(config)# route-map foo permit 10
switch(config-route-map-foo)# set as-path match all replacement none
switch(config-route-map-foo)# exit
switch(config)# router bgp 200
switch(config-router-bgp)# neighbor 80.80.1.2 route-map foo out
switch(config-router-bgp)# end
switch# show ip bgp neighbors 80.80.1.2 advertised-routes
BGP routing table information for VRF default
Router identifier 202.202.1.1, local AS number 200
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E
- ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued
for advertisement
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop -
Link Local Nexthop
Network Next Hop Metric LocPref Weight Path
* > 101.101.1.0/24 80.80.1.1 - - - 200 i
* > 102.102.1.0/24 80.80.1.1 - - - 200 i
* > 103.103.1.0/24 80.80.1.1 - - - 200 i
* > 202.202.1.0/24 80.80.1.1 - - - 200 i
Replace the AS-Path of matching prefixes with an empty or a null AS-Path. Remove AS 302 from prefix 103.103.1.0/24 as shown in the above output.
This command replaces the AS-Path with the auto option.
switch(config)# route-map foo permit 10
switch(config-route-map-foo)# set as-path match all replacement auto
switch(config-route-map-foo)# end
switch# show ip bgp neighbors 80.80.1.2 advertised-routes
BGP routing table information for VRF default
Router identifier 202.202.1.1, local AS number 200
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E
- ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued
for advertisement
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop -
Link Local Nexthop
Network Next Hop Metric LocPref Weight Path
* > 101.101.1.0/24 80.80.1.1 - - - 200 200 i
* > 102.102.1.0/24 80.80.1.1 - - - 200 200 i
* > 103.103.1.0/24 80.80.1.1 - - - 200 200 i
* > 202.202.1.0/24 80.80.1.1 - - - 200 200 i
Replaces the AS-Path of matching prefixes with the locally configured AS 200.
This command replaces the AS-Path with another AS-Path.
switch(config)# route-map foo permit 10
switch(config-route-map-foo)# set as-path match all replacement 500 600
switch(config-route-map-foo)# end
switch# show ip bgp neighbors 80.80.1.2 advertised-routes
BGP routing table information for VRF default
Router identifier 202.202.1.1, local AS number 200
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E
- ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued
for advertisement
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop -
Link Local Nexthop
Network Next Hop Metric LocPref Weight Path
* > 101.101.1.0/24 80.80.1.1 - - - 200 500 600 i
* > 102.102.1.0/24 80.80.1.1 - - - 200 500 600 i
* > 103.103.1.0/24 80.80.1.1 - - - 200 500 600 i
* > 202.202.1.0/24 80.80.1.1 - - - 200 500 600 i
Replaces the AS-Path of matching prefixes with 500 600 as configured.
Replaces the AS-Path with a combination of auto and an AS-Path.
switch(config)# route-map foo permit 10
switch(config-route-map-foo)# set as-path match all replacement auto 500 600
switch(config-route-map-foo)# end
switch# show ip bgp neighbors 80.80.1.2 advertised-routes
BGP routing table information for VRF default
Router identifier 202.202.1.1, local AS number 200
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E
- ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued
for advertisement
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop -
Link Local Nexthop
Network Next Hop Metric LocPref Weight Path
* > 101.101.1.0/24 80.80.1.1 - - - 200 200 500 600 i
* > 102.102.1.0/24 80.80.1.1 - - - 200 200 500 600 i
* > 103.103.1.0/24 80.80.1.1 - - - 200 200 500 600 i
* > 202.202.1.0/24 80.80.1.1 - - - 200 200 500 600 i
Replaces the AS-Path of matching prefixes with the locally configured AS 200 and 500 600.
set as-path prepend
The set as-path prepend command adds a set statement to a route map to prepend one or more Autonomous System (AS) numbers to the as_path attribute of a BGP route.
The no set as-path prepend and default set as-path prepend commands remove the specified set statements from the route map and update all corresponding routes.
Command Mode
Route-Map Configuration
Command Syntax
set as-path prependauto | as_number [auto | as_number | last-ascount]
no set as-path prependauto | as_number [auto | as_number | last-ascount]
auto - Prepends the peer AS number for peer inbound route maps and the local AS number for peer outbound route maps.
as_number - Prepends the specified AS number. Enter in plain notation (values range from 1-4294967295) or in asdot notation as described in RFC 5396. In asdot notation, enter AS numbers from 1-65535 in plain notation, and enter AS numbers from 65536 to 4294967295 as two values separated by a dot. The first value is high-order and represents a multiple of 65536, and the second value is low-order and represents a decimal integer. For example, AS number 65552 can be entered as either 65552 or 1.16 (i.e., 1*65536+16). However entered, EOS stores the AS numbers internally in plain decimal notation and appear that way in show outputs.
last-ascount - Prepends the last AS number in the AS path count times. Values range from 1 to 15. Mutually exclusive with the use of the auto cmdname or the entry of one or more specified AS numbers, and not supported in multi-agent mode.
Examples
These commands create a route-map entry that prepends AS number 64496 and prepends either the peer or local AS number twice.
switch(config)# route-map map1
switch(config-route-map-map1)# set as-path prepend 64496 auto auto
switch(config-route-map-map1)# exit
switch(config)# show route-map map1
route-map map1 permit 10
Description:
Match clauses:
SubRouteMap:
Set clauses:
set as-path prepend 64496 auto auto
switch(config)#
The commands create a route-map entry that prepends AS numbers 64496, 64498, and 65552.
switch(config)# route-map map2
switch(config-route-map-map2)# set as-path prepend 64496 64498 1.16
switch(config-route-map-map2)# exit
switch(config)# show route-map map2
route-map map2 permit 10
Description:
Match clauses:
SubRouteMap:
Set clauses:
set as-path prepend 64496 64498 65552
switch(config)#
These commands create a route map entry that prepends the last AS number 12 times.
switch(config)# route-map map3
switch(config-route-map-map3)# set as-path prepend last-as 12
switch(config-route-map-map3)# exit
switch(config)# show route-map map3
route-map map3 permit 10
Description:
Match clauses:
SubRouteMap:
Set clauses:
set as-path prepend last-as 12
switch(config)#
set community (route-map)
The set community command specifies community attribute modifications to routes selected for redistribution. The set community none command removes community attributes from the route.
The no set community and default set community commands remove the specified community from the Route-Map Configuration Modestatement by deleting the corresponding statement from the running config.
Command Mode
Route-Map Configuration
Command Syntax
set community [gshut | aa:nn | community-list | internet | local-as | no-advertise | no-export | none | number]
no set community [gshut | aa:nn | additive | community-list | delete | internet | local-as | no-advertise | no-export | none | number]
default set community [gshut | aa:nn | additive | community-list | delete | internet | local-as | no-advertise | no-export | none | number]
Parameters
gshut - Configures a graceful shutdown in BGP.
aa:nn - Configures the community AS and network number, separated by colon. Value ranges from 0:0 to 65535:65535.
community-list - A label for community list.
internet - Advertises route to the Internet community.
local-as - Advertises route only to local peers.
no-advertise - Does not advertise route to any peer.
no-export - Advertises route only within BGP AS boundary.
none - Does not provide any community attributes.
number - Configures the community number. Value ranges from 1 to 4294967040.
additive - Adds specified attributes to the current community.
delete - Removes specified attributes from the current community.
EOS does not support disabling the process of graceful shutdown community.
Example
This command advertises routes only to local peers.
switch(config-route-map-map1)# show active
route-map map1 permit 10
match community instances <= 50
set community 0:456 0:2345
switch(config-route-map-map1)# set community local-as
switch(config-route-map-map1)# ip community-list 345 permit 23
switch(config)# route-map map1
switch(config-route-map-map1)# show active
route-map map1 permit 10
match community instances <= 50
set community 0:456 0:2345 local-as
switch(config-route-map-map1)#
set extcommunity (route-map)
The set extcommunity command specifies extended community attribute modifications to routes selected for redistribution. The set extcommunity none command removes extended community attributes from the route.
The no set extcommunity and default set extcommunity commands remove the specified set extcommunity command from the Route-Map Configuration Mode statement by deleting the corresponding statement from running-config.
Command Mode
Route-Map Configuration Mode
Command Syntax
set extcommunitycond_x [cond_2][cond_n][mod_type]
set extcommunity none
no set extcommunitycond_x [cond_2][cond_n][mod_type]
default set extcommunity cond_x [cond_2][cond_n][mod_type]
default set extcommunity none
Parameters
cond_x - Specifies extended community route map modification. Command may contain multiple attributes. Options include the following:
rtasn:nn - Specifies the route target attribute (AS:network number).
set (route-map) specifies attribute modifications for the redistributed routes.
Example
This command creates a route map entry in map1 that sets the route target extended community attribute.
switch(config)# route-map map1
switch(config-route-map-map1)# set extcommunity rt 10.13.2.4:100
switch(config-route-map-map1)#
show (ACL configuration modes)
The show command displays the contents of an Access Control List (ACL).
show or show pending displays the list as modified in ACL configuration mode.
show active displays the list as stored in running-config.
show comment displays the comment stored with the list.
show diff displays the modified and stored lists, with flags denoting the modified rules.
Exiting the ACL configuration mode stores all pending ACL changes to running-config.
Command Mode
ACL Configuration
IPv6-ACL Configuration
Std-ACL Configuration
Std-IPv6-ACL Configuration
MAC-ACL Configuration
Command Syntax
show
show active
show comment
show diff
show pending
Examples
The examples in this section assume these ACL commands are entered as specified.
These commands are stored in none:
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.21.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
50 remark end of list
The current edit session removed this command. This change is not yet stored to none:
20 permit ip any host 10.21.10.1
The current edit session added these commands ACL. They are not yet stored to none:
20 permit ip 10.10.0.0/16 any
25 permit tcp 10.10.20.0/24 any
45 deny pim 239.24.124.0/24 10.5.8.4/30
This command displays the ACL, as stored in the configuration.
switch(config-acl-test_1)# show active
IP Access List test_1
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.21.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
50 remark end of list
This command displays the pending ACL, as modified in ACL configuration mode.
switch(config-acl-test_1)# show pending
IP Access List test_1
10 permit ip 10.10.10.0/24 any
20 permit ip 10.10.0.0/16 any
25 permit tcp 10.10.20.0/24 any
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
45 deny pim 239.24.124.0/24 10.5.8.4/30
50 remark end of list
This command displays the difference between the saved and modified ACLs.
Rules added to the pending list are denoted with a plus sign (+).
Rules removed from the saved list are denoted with a minus sign (-)
switch(config-acl-test_1)# show diff
---
+++
@@ -1,7 +1,9 @@
IP Access List test_1
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.21.10.1
20 permit ip 10.10.0.0/16 any
25 permit tcp 10.10.20.0/24 any
30 deny ip host 10.10.10.1 host 10.20.10.1
40 permit ip any any
45 deny pim 239.24.124.0/24 10.5.8.4/30
show hardware tcam profile
The show hardware tcam profile command displays the hardware specific information for the current operational TCAM profile in the running configuration.
This command is applicable to DCS-7280(E/R) and DCS-7500(E/R) series switches only.
Command Mode
EXEC
Command Syntax
show hardware tcam profile [[profileName [[featurefeatureName] detail]]|[detail]
Parameters
profileName Selects the named profile.
featurefeatureNameSelects the specific feature by name.
detail Displays the content of the TCAM profile.
Guidelines
If the profile cannot be programmed, the Status column will print ‘ERROR‘. Any features that use TCAM functionality will not work properly. Do not expect any features to work if the profile is in the ‘ERROR’ state. If there are warnings or errors, a summary message will display warnings or errors found in programming the profile in addition to the system log messages.
Examples
The show hardware tcam profile lists the TCAM profile status on each line card. In case of successful programming it is as shown below.
switch(config)# show hardware tcam profile
Configuration Status
FixedSystem testprofile testprofile
If the profile cannot be programmed, the Status column prints ‘ERROR‘.
(config)# show hardware tcam profile
Configuration Status
Linecard3 newprofile1 ERROR
Linecard4 newprofile1 ERROR Linecard5 newprofile1 ERROR
Linecard6 newprofile1 ERROR
Linecard7 newprofile1 WARNING
Detailed Programming Status
Linecard3, Linecard4, Linecard5
[Error] feature flow is not supported on this hardware platform
Linecard7
[Warning] the key size of feature flow exceeds the configured key size limit
The show hardware tcam profileprofiledetail command displays further info about the TCAM profile features.
Note: The profile contains all the features that are untouched after copying from the base profile.
You can use the show hardware tcam profile command without the detail keyword to see all of the features configured in a profile without seeing how the features are defined.
(config-hw-tcam-profile-newfeature)# show hardware tcam profile default
Features enabled in TCAM profile default: [ Linecard3, Linecard4, Linecard6, Linecard
7, Linecard8, Linecard9, Linecard10 ]
mpls
acl vlan ipv6
acl subintf ipv6
acl vlan ipv6 egress
acl port ipv6
pbr ipv6
acl vlan ip
acl subintf ip
acl port ip
tunnel vxlan
acl port mac
pbr ip
pbr mpls
qos ipv6
qos ip
mirror ip
counter lfib
mpls pop ingress
show access-lists
The show access-lists command displays the contents of all IPv4, IPv6, and MAC Access Control Lists (ACLs) on the switch in addition to the configuration and status. Use the summary option to display only the configuration and status, which contains details such as the name of the ACL, total rules configured, configured and active status containing interface information, and supplicant information as in the case of dynamic ACLs from dot1x sessions.
Command Mode
Privileged EXEC
Command Syntax
show access-lists[interfaceinterface_acl] | [acl_nameacl_name] acl_name | [scopesummary]
Parameters
interface - Filter by interfaces such as Ethernet, VLANs, and Port Channels. Selection options include the following:
no parameter - Display all ACLs.
interface_acl - Display ACLs attached to the interface if present.
acl_name - Display the list name. Selection options include the following:
no parameter - Display all ACLs.
acl_name - Display a specific ACL.
scope - Display detailed or summarized information. Selection options include the following:
no parameter - Display all rules in the specified lists including the configuration and status.
summary - Display only the configuration and status of the ACL.
Examples
This command displays all rules in all the ACLs including IPv4, IPv6, and MAC and the configuration and status.
switch# show access-lists
Phone ACL bypass: disabled
IP Access List default-control-plane-acl [readonly]
counters per-entry
10 permit icmp any any
20 permit ip any any tracked [match 149061 bytes in 1721 packets, 0:00:00 ago]
30 permit udp any any eq bfd ttl eq 255
40 permit udp any any eq bfd-echo ttl eq 254
50 permit udp any any eq multihop-bfd micro-bfd sbfd
60 permit udp any eq sbfd any eq sbfd-initiator
70 permit ospf any any
80 permit tcp any any eq ssh telnet www snmp bgp https msdp ldp netconf-ssh gnmi [match 180 bytes in 3 packets, 0:03:08 ago]
90 permit udp any any eq bootps bootpc snmp rip ntp ldp ptp-event ptp-general [match 984 bytes in 3 packets, 1 day, 9:02:21 ago]
100 permit tcp any any eq mlag ttl eq 255
110 permit udp any any eq mlag ttl eq 255
120 permit vrrp any any
130 permit ahp any any
140 permit pim any any
150 permit igmp any any
160 permit tcp any any range 5900 5910
170 permit tcp any any range 50000 50100
180 permit udp any any range 51000 51100
190 permit tcp any any eq 3333
200 permit tcp any any eq nat ttl eq 255
210 permit tcp any eq bgp any
220 permit rsvp any any
230 permit tcp any any eq 9340
240 permit tcp any any eq 9559
250 permit udp any any eq 8503
260 permit udp any any eq lsp-ping
270 permit udp any eq lsp-ping any
Total rules configured: 27
Configured on Ingress: control-plane(default VRF)
Active on Ingress: control-plane(default VRF)
IP Access List v4Acl
10 permit ip any any
Total rules configured: 1
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
Standard IP Access List stAcl
10 permit any
Total rules configured: 1
IP Access List noRulesAcl
Total rules configured: 0
Configured on Ingress: Et2/1
Active on Ingress: Et2/1
IPV6 Access List default-control-plane-acl [readonly]
counters per-entry
10 permit icmpv6 any any [match 335448 bytes in 4424 packets, 0:01:13 ago]
20 permit ipv6 any any tracked
30 permit udp any any eq bfd hop-limit eq 255
40 permit udp any any eq bfd-echo hop-limit eq 254
50 permit udp any any eq multihop-bfd micro-bfd sbfd
60 permit udp any eq sbfd any eq sbfd-initiator
70 permit ospf any any
80 permit 51 any any
90 permit 50 any any
100 permit tcp any any eq ssh telnet www snmp bgp https netconf-ssh gnmi
110 permit udp any any eq bootps bootpc snmp ntp ptp-event ptp-general
120 permit tcp any any eq mlag hop-limit eq 255
130 permit udp any any eq mlag hop-limit eq 255
140 permit tcp any any range 5900 5910
150 permit tcp any any range 50000 50100
160 permit udp any any range 51000 51100
170 permit udp any any eq dhcpv6-client dhcpv6-server
180 permit tcp any eq bgp any
190 permit tcp any any eq nat hop-limit eq 255
200 permit udp any any eq nat hop-limit eq 255
210 permit rsvp any any
220 permit pim any any
230 permit tcp any any eq 9340
240 permit tcp any any eq 9559
250 permit udp any any eq 8503
260 permit udp any any eq lsp-ping
270 permit udp any eq lsp-ping any
Total rules configured: 27
Configured on Ingress: control-plane(default VRF)
Active on Ingress: control-plane(default VRF)
IPV6 Access List v6Acl
10 permit ipv6 3891:3c58:6300::/64 any
20 permit ipv6 any host 2fe1:b468:24a::
30 deny ipv6 host 3411:91c1:: host 4210:cc23:d2de::
Total rules configured: 3
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
MAC Access List mlist
10 deny any any
Total rules configured: 1
Configured on Ingress: Et11/1
Configured on Egress: Et11/1
Active on Ingress: Et11/1
Active on Egress: Et11/1
This command displays only the configuration and status of each ACL on the switch.
switch# show access-lists summary
Phone ACL bypass: disabled
IPV4 ACL default-control-plane-acl [readonly]
Total rules configured: 27
Configured on Ingress: control-plane(default VRF)
Active on Ingress: control-plane(default VRF)
IPV4 ACL v4Acl
Total rules configured: 1
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
Standard IPV4 ACL stAcl
Total rules configured: 1
IPV4 ACL noRulesAcl
Total rules configured: 0
Configured on Ingress: Et2/1
Active on Ingress: Et2/1
IPV6 ACL default-control-plane-acl [readonly]
Total rules configured: 27
Configured on Ingress: control-plane(default VRF)
Active on Ingress: control-plane(default VRF)
IPV6 ACL v6Acl
Total rules configured: 3
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
MAC ACL mlist
Total rules configured: 1
Configured on Ingress: Et11/1
Configured on Egress: Et11/1
Active on Ingress: Et11/1
Active on Egress: Et11/1
This command displays all rules in list2 ACL and the configuration and status.
switch# show access-list list2
IP Access List list2
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
Total rules configured: 3
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
IPV6 Access List list2
10 permit ipv6 3891:3c58:6300::/64 any
20 permit ipv6 any host 2fe1:b468:24a::
30 deny ipv6 host 3411:91c1:: host 4210:cc23:d2de::
Total rules configured: 3
Configured on Ingress: Et2/1
Active on Ingress: Et2/1
switch#
The above output displayed two ACLs as the switch had an IPv4 ACL and an IPv6 ACL with the same name.
This command displays all rules in list2 ACL on Ethernet 1/1 with the configuration and status.
switch# show access-list list2 interface Ethernet 1/1
IP Access List list2
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
Total rules configured: 3
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
switch#
show ip access-lists
The show ip access-lists command displays the contents of IPv4 and standard IPv4 Access Control List (ACLs) on the switch with the configuration and status. Use the summary option to display only the configuration and status with details such the name of the ACL, total rules configured, configured and active status containing interface information, and supplicant information as in the case of dynamic ACLs from dot1x sessions.
Command Mode
Privileged EXEC
Command Syntax
show ip access-lists [interfaceinterface_ipv4]|[acl_nameacl_name] | [scopesummary]
Parameters
interface Filter on interfaces such as Ethernet, VLANs, and Port Channels. Selection options include the following:
no parameter - Displays all IPv4 ACLs.
interface_ipv4 - Display the ACLs on a specified interface.
acl_name - Specify the name of a list to display. Selection options include the following:
no parameter - Displays all IPv4 ACLs.
acl_name - Specify an IPv4 ACL to display.
scope - Displays detailed or summarized information. Selection options include the following:
no parameter - Display all rules in the specified lists with the configuration and status.
summary - Display only the configuration and status.
Examples
This command displays all rules in list2 IPv4 ACL, configuration, and status.
switch# show ip access-lists list2
IP Access List list2
10 permit ip 10.10.10.0/24 any
20 permit ip any host 10.20.10.1
30 deny ip host 10.10.10.1 host 10.20.10.1
Total rules configured: 3
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
switch#
The above output can also be displayed with the help of the show ip access-lists interface Ethernet 1/1 command since the ACL list2 applies to the Ethernet 1/1 interface.
This command displays the name and number of rules in each list on the switch.
switch# show ip access-lists summary
IPV4 ACL default-control-plane-acl
Total rules configured: 12
Configured on: control-plane
Active on : control-plane
IPV4 ACL list2
Total rules configured: 3
IPV4 ACL test1
Total rules configured: 6
Standard IPV4 ACL test_1
Total rules configured: 1
IPV4 ACL test_3
Total rules configured: 0
switch#
This command displays the summary and lists all the configured IPv4 ACLs.
switch # show ip access-lists summary
IPV4 ACL default-control-plane-acl [readonly]
Total rules configured: 17
Configured on Ingress: control-plane(default VRF)
Active on Ingress: control-plane(default VRF)
IPV4 ACL ipAclLimitTest
Total rules configured: 0
Configured on Egress: Vl2148,2700
Active on Egress: Vl2148,2700
show ip prefix-list
The show ip prefix-list command displays all rules for the specified IPv4 prefix list. The command displays all IPv4 prefix list rules if a prefix list name is not specified.
Command Mode
EXEC
Command Syntax
show ip prefix-list [display_itemslist_name]
Parameters
display_items - Specifies the name of prefix lists to display rules. Options include:
no parameter - Display all IPv4 prefix list rules.
list_name Specifies the IPv4 prefix list to display rules.
Example
This command displays all rules in the route-one IPv4 prefix list.
switch(config-ip-pfx)# show ip prefix-list
ip prefix-list route-one
seq 10 deny 10.1.1.0/24
seq 20 deny 10.1.0.0/16
seq 30 permit 12.15.4.9/32
seq 40 deny 1.1.1.0/24
switch(config-ip-pfx)#
show ipv6 access-lists
The show ipv6 access-lists command displays the contents of all IPv6 Access Control Lists (ACLs) on the switch with the configuration and status. Use the summary option to display only the configuration and status with contains details such as the name of the ACL, total rules configured, configured and active on status with interface information, and supplicant information in case of dynamic ACLs from dot1x sessions.
Command Mode
Privileged EXEC
Command Syntax
show ipv6 access-lists [ interfaceinterface_ipv6] [supplicantsupplicant][acl_nameacl_name][scopesummary]
Parameters
interface Filter on interfaces such as Ethernet, VLANs, and Port Channels. Selection options include the following:
no parameter - Displays all IPv6 ACLs.
interface_ipv6 - Display the ACLs on a specified interface.
acl_name - Specify the name of a list to display. Selection options include the following:
no parameter - Displays all IPv6 ACLs.
acl_name - Specify an IPv6 ACL to display.
scope - Displays detailed or summarized information. Selection options include the following:
no parameter - Display all rules in the specified lists with the configuration and status.
summary Display only the configuration and status.
Examples
This command displays all rules in test1 IPv6 ACL.
switch# show ipv6 access-lists list2
IP Access List list2
10 permit ipv6 3891:3c58:6300::/64 any
20 permit ipv6 any host 2fe1:b468:024a::
30 deny ipv6 host 3411:91c1:: host 4210:cc23:d2de:::
Total rules configured: 3
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
switch#
The above output can also be displayed using the show ipv6 access-lists interface Ethernet 1/1 command since the ACL list2 applies to the Ethernet 1/1 interface.
This command displays the name and number of rules in each list on the switch.
switch# show ipv6 access-lists summary
IPV6 ACL list2
Total rules configured: 3
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
IPV6 ACL test1
Total rules configured: 6
IPV6 ACL test_1
Total rules configured: 1
Standard IPV6 ACL test_3
Total rules configured: 0
switch#
show ipv6 prefix-list
The show ipv6 prefix-list command displays all rules for the specified IPv6 prefix list. The command displays all IPv6 prefix lists if a prefix list name is not specified.
Command Mode
EXEC
Command Syntax
show ipv6 prefix-list [display_itemslist_name]
Parameters
display_items Specifies the name of prefix lists for which rules are displayed. Options include:
no parameter All IPv6 prefix lists are displayed.
list_name Specifies the IPv6 prefix list for which rules are displayed.
Examples
This command displays all rules in the map1 IPv6 prefix list:
The show mac access-lists command displays the contents of all MAC Access Control Lists (ACLs) on the switch, along with their configuration and status. Use the summary option to display only the configuration and status, which contain details such as the name of the ACL, the total rules configured, and where the ACL is configured/active with a status containing specific interface information.
Command Mode
Privileged EXEC
Command Syntax
show mac access-lists [interfaceinterface_acl] [acl_nameacl_name] [scopesummary]
Parameters
interface - Filter by interfaces such as Ethernet, VLANs, and Port Channels. Selection options include the following:
no parameter - Display all MAC ACLs.
interface_acl - Display MAC ACLs attached to the interface if present.
acl_name Display the list name. Selection options include the following:
no parameter - Display all MAC ACLs.
acl_name - Display a specific MAC ACL.
scope - Display detailed or summarized information. Selection options include the following:
no parameter - Display all rules in the specified lists including the configuration and status.
summary - Display only the configuration and status of the MAC ACL.
Examples
This command displays all rules in mtest2 MAC ACL.
switch# show mac access-list mlist2
MAC Access List mlist2
10 permit 1024.4510.F125 0.0.0 any aarp
20 permit any 4100.4500.0000 0.FF.FFFF novell
30 deny any any
Total rules configured: 3
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
The above output can also be displayed with the help of show mac access-lists interface Ethernet 1/1 command since the ACL mlist2 applies to the Ethernet 1/1 interface.
This command displays the number of rules in each MAC ACL on the switch.
switch# show mac access-list summary
MAC ACL mlist1
Total rules configured: 6
MAC ACL mlist2
Total rules configured: 3
Configured on Ingress: Et1/1
Active on Ingress: Et1/1
MAC ACL mlist3
Total rules configured: 1
MAC ACL mlist4
Total rules configured: 0
show platform arad acl tcam summary
The show platform arad tcam summary command displays the percentage of TCAM utilization per forwarding ASIC.
Command Mode
EXEC
Command Syntax
show platform arad acl tcamsummary
Parameter
summary - Displays the ACL TCAM summary.
Example
This command displays the percentage of TCAM utilization per forwarding ASIC.
switch# show platform arad acl tcam summary
The total number of TCAM lines per bank is 1024.
========================================================
Arad3/0:
========================================================
Bank Used Used % Used By
1 4 0 IP RACLs
Total Number of TCAM lines used is: 4
========================================================
Arad3/4:
========================================================
Bank Used Used % Used By
1 2 0 IP RACLs
Total Number of TCAM lines used is: 2
show platform arad acl tcam
The show platform arad acl tcam command displays the number of TCAM entries (hardware resources) occupied by the ACL on each forwarding ASIC.
This command applies only to DCS-7500E, DCS-7280E series switches.
scope Specifies the information displayed. Options include:
detail - Displays the ACL TCAM details.
diff - Displays the difference between hardware and shadow.
hw - Displays the ACL entries from hardware.
shadow - Displays the ACL entries from shadow.
summary - Displays the ACL TCAM summary.
Examples
This command displays the number of TCAM entries used by Arad0 ASIC. In this example, apply the ACL on two VLANs (Vl2148 and Vl2700) but number of TCAM entries occupied is only one.
switch# show platform arad acl tcam detail
ip access-list ipAclLimitTest (Shared RACL, 0 rules, 1 entries, direction out,
state success, Acl Label 2)
Fap: Arad0, Shared: true, Interfaces: Vl2148, Vl2700
Bank Offset Entries
0 0 1
Fap: Arad1, Shared: true, Interfaces: Vl2148
Bank Offset Entries
0 0 1
This command displays the percentage of TCAM utilization per forwarding ASIC.
switch# show platform arad acl tcam summary
The total number of TCAM lines per bank is 1024.
========================================================
Arad0:
========================================================
Bank Used Used % Used By
0 1 0 IP Egress PACLs/RACLs
Total Number of TCAM lines used is: 1
========================================================
Arad1:
========================================================
Bank Used Used % Used By
0 1 0 IP Egress PACLs/RACLs
Total Number of TCAM lines used is: 1
show platform arad mapping
The show platform arad mapping command displays the mapping between the interfaces and the forwarding ASICs.
Command Mode
EXEC
Command Syntax
show platform aradchip_namemapping
Parameter
chip_name Specifies the Arad chip name.
Example
This command displays the mapping between the interfaces and the forwarding ASICs on the Arad3/0 chip.
The show platform fap tcam command displays the number of TCAM entries (hardware resources) occupied by the ACL on each forwarding ASIC of Sand platform devices.
detail - Displays the number of TCAM entries (hardware resources) occupied by the ACL on each forwarding ASIC.
diff - Displays the difference between hardware and shadow.
hw - Displays ACL entries from hardware.
shadow - Displays ACL entries from shadow.
summary - Displays the percentage of TCAM utilization per forwarding ASIC.
Example
This command displays the number of TCAM entries and other ACL TCAM detail.
switch# show platform fap acl tcam detail
ip access-list ipAcl0000 (RACL, 1 rules, 2 entries, direction in, state success)
Shared: false
Interface: Vlan0002
-------------------
Fap: Arad3/0
Bank Offset Entries
1 0 2
Interface: Vlan0003
-------------------
Fap: Arad3/0
Bank Offset Entries
1 2 2
Fap: Arad3/4
Bank Offset Entries
1 0 2
show platform fap acl tcam hw
The show platform fap acl tcam hw command displays the TCAM entries configured for each TCAM bank including policy-maps and corresponding traffic match.
This command applies only to DCS-7280(E/R), DCS-7500(E/R) series switches.
Command Mode
EXEC
Command Syntax
show platform fapfap_nameacl tcam hw
Parameters
fap_name - Specifies the switch chip-set name.
Example
This command displays the TCAM entries configured for each TCAM bank including policy maps and corresponding traffic matches.
The show platform fap acl tcam summary command displays for each forwarding ASIC, the number of TCAM entries consumed per ACL type, and in which TCAM bank the entries are installed. A mirroring ACL does not consume TCAM resources unless attached to a mirroring source interface, and a mirroring destination is configured. If the mirroring destination is a GRE tunnel, at least one nexthop entry for the tunnel destination must be resolved before a TCAM entry is installed.
Command Mode
EXEC
Command Syntax
show platform fap acl tcam summary
Example
This command displays the number of TCAM entries consumed per ACL type, the bank installed, and ASIC. Three TCAM entries are consumed across two forwarding ASICs, two for IP ACLs, and one for MAC ACLs.
switch# show platform fap acl tcam summary
========================================================
Arad0:
========================================================
Bank Used Used % Used By
0, 1 2 0 IP Mirroring
Total Number of TCAM lines used is: 4
========================================================
Arad1:
========================================================
Bank Used Used % Used By
2 1 0 Mac Mirroring
show platform trident tcam
The show platform trident tcam command displays the TCAM entries configured for each TCAM group including policy maps and corresponding hits.
This command displays detailed information for the TCAM group.
switch# show platform trident tcam detail
=== TCAM detail for switch Linecard0/0 ===
TCAM group 9 uses 42 entries and can use up to 1238 more.
Mlag control traffic uses 4 entries.
589826 0 hits - MLAG - SrcPort UDP Entry
589827 0 hits - MLAG - DstPort UDP Entry
589828 0 hits - MLAG - SrcPort TCP Entry
589829 0 hits - MLAG - DstPort TCP Entry
CVX traffic reserves 6 entries (0 used).
L3 Control Priority uses 23 entries.
589836 0 hits - URM - SelfIp UDP Entry
589837 0 hits - URM - SelfIp TCP Entry
589848 0 hits - OSPF - unicast
589849 71196 hits - OSPFv2 - Multicast
589850 0 hits - OSPFv3 - Multicast
589851 0 hits - OSPF Auth ESP - Multicast
589852 0 hits - OSPF Auth ESP - Unicast
589853 0 hits - IP packets with GRE type and ISIS protocol
589854 0 hits - RouterL3 Vlan Priority 6,7 Elevator
589855 0 hits - RouterL3 DSCP 48-63 Elevator
589856 0 hits - RouterL3 Priority Elevator
589857 0 hits - NextHopToCpu, Glean
589858 0 hits - L3MC Cpu OIF
IGMP Snooping Flooding reserves 8 entries (6 used).
589864 0 hits - IGMP Snooping Restricted Flooding L3 from local
mlag peer
589865 0 hits - IGMP Snooping Restricted Flooding L3
L4 MicroBfd traffic reserves 1 entries (0 used).
TCAM group 13 uses 99 entries and can use up to 1181 more.
Dot1x MAB traffic uses 1 entries.
851968 0 hits - Dot1xMab Rule
<-------OUTPUT OMITTED FROM EXAMPLE-------->
ck338.22:14:38(config-pmap-qos-policy1)#
show route-map
The show route-map command displays the contents of configured route maps.
Command Mode
EXEC
Command Syntax
show route-map [map_name]
Parameters
no parameter Displays the content of all configured route maps.
map_name Displays the content of the specified route map.
Examples
This command displays the map1 route map.
switch(config)# show route-map map1
route-map map1 permit 10
Description:
Match clauses:
SubRouteMap:
Set clauses:
set as-path prepend last-as 12
set as-path prepend auto auto
This command displays the map route map.
switch> show route-map map
route-map map permit 5
Match clauses:
match as 456
Set clauses:
route-map map permit 10
Match clauses:
match ip next-hop 2.3.4.5
match as-path path_2
Set clauses:
set local-preference 100
system profile
The system profile command creates a new Ternary Content-Addressable Memory (TCAM) profile in the running configuration.
The default system profile and no system profile commands delete non-default TCAM profiles from the running configuration.
DirectFlow allows you to define flows consisting of conditions to match, and actions to
perform, that are a superset of the OpenFlow 1.0 specification. DirectFlow runs
alongside the existing L2/L3 forwarding plane, enabling a network architecture that
incorporates new capabilities such as TAP aggregation and custom traffic engineering,
alongside traditional forwarding models. DirectFlow does not require a controller or any
third party integration, as flows can be installed via the CLI.
DirectFlow exposes the underlying forwarding ASIC's capabilities through a programmable
interface like EAPI or the standard CLI.
DirectFlow works in conjunction with all other aspects of standard Layer 2 or Layer 3
bridging or forwarding, and DirectFlow traffic is subject to the standard packet
processing pipeline within the ASIC. You can think of DirectFlow as a stage in packet
processing that processes traffic after ingress checks and before any egress
actions.
DirectFlow enables you to configure flows that consist of matching criteria and actions, and
to modify how traffic is processed, by overriding the L2 lookup decision or rewriting a
MAC address or VLAN for example.
Features like MAC learning, STP state checks, ingress or egress VLAN membership checks on
ports, ACLs, QoS, and others are all respected by DirectFlow. Traffic that does not
match any programmed flow is processed normally, while traffic that matches programmed
flows is now subject to the actions specified in the flows.
DirectFlow Flows
You can define a relative priority between flows and define idle or hard timeouts for the flow.
DirectFlow also enables you to insert a flow entry that matches on specified criteria,
and define actions to be taken on traffic that matches the specified matching
conditions. You can define flows to match on TCP flags, IPv6 source and destination
addresses, input ports, and more.
DirectFlow enables you to configure flows that are not visible in the startup or running
configurations and do not persist over a reboot. This feature is designed to be used for
flows that are configured by a custom agent using the EOS SDK or eAPI and age out
(expire) after a specified time period.
For example, if you are using a custom agent that reacts to traffic sent to the CPU (the redirect
to CPU action), and you want to use a flow that will drop all matching traffic for
5 minutes, the agent can program a non-persistent flow
that expires after a hard timeout of 300 seconds.
Using a non-persistent flow for this purpose ensures that other administrator actions (for
example, saving the configuration) do not result in the flow being resurrected on
startup or reverting to the saved configuration. It also removes the need for the agent
to delete the expired flow.
Note: By default, all DirectFlow flows are persistent. You must use the nopersistent command to configure a non-persistent flow.
Supported Matches
DirectFlow supports all matches on VLAN, ether type, source or destination MAC address, COS,
source or destination IP address, IP protocol, IP TOS, L4 source, destination ports,
ICMP type, and code.
In addition, DirectFlow also allows matching on:
TCP flags
IPv6 source address
IPv6 destination address
Traffic injected from the CPU
Input port
DirectFlow also permits re-using the same
flow on multiple input ports, saving valuable TCAM space.
Supported Actions
DirectFlow supports the following actions:
Setting the source or destination MAC address
VLAN
COS
IP TOS
Transmit queue
Output port list and mirroring traffic pre-modification (ingress mirror) and
post-modification (egress mirror)
Redirect to CPU
The redirect to CPU action is useful in cases in which a custom agent is running on EOS and you
want to trap specific traffic (matching traffic) and send the trapped traffic to the
agent.
DirectFlow Configuration
Consider the following when using DirectFlow.
DirectFlow takes effect ONLY after exiting the
individual flow configuration sub-mode.
Match criteria are connected with Boolean AND
operators. Therefore they must all match for the condition to be true and
action to be taken.
CLI is automatically set to match the
ethertype to IP if IP fields (such as source or
destination address or L4 ports) are chosen as
part of other match/ action commands.
In a single flow, only the following fields
can be matched along with IPv4 or IPv6 source and destination addresses:
VLAN priority
VLAN ID
EtherType
Source interface
Class of Service (CoS)
Commands Used to Enable DirectFlow, Configure
and Display Flows
A number of different commands
are provided for the DirectFlow feature. The different commands enable
you to enter the DirectFlow configuration mode, enable DirectFlow, configure
flows, and display configured flows.
Note: ALL match criteria specified in a flow definition must match in the packet for the actions
specified to be applied to the traffic.
Enter the DirectFlow Configuration Mode
The directflow command places the switch in DirectFlow
configuration
mode.
The match (DirectFlow-flow mode) command allows you to
configure a rule or a flow which match on L2, L3, L4 fields of a packet and specify
a certain action to either modify, drop or redirect the
packet.
switch(config-directflow-Test-1)# match ethertype ip
switch(config-directflow-Test-1)# match source ip 10.10.10.10
Action Set
The action set (DirectFlow-flow mode) command allows you to
configure a packet to be routed out a layer three interface using a DirectFlow
entry.
switch(config-directflow-Test-1)# action egress mirror ethernet 7
switch(config-directflow-Test-1)# action set destination mac 0000.aaaa.bbbb
Finalize the Flow
DirectFlow flows do not take effect until you exit the configuration sub-mode for the
specified flow. Use the exit command to finalize the flow
and put it into
effect.
switch(config)# directflow
switch(config-directflow)# flow redirect-http-cpu
switch(config-directflow-redirect-http=cpu)# match ip protocol tcp
switch(config-directflow-redirect-http-cpu)# match destination port 80
switch(config-directflow-redirect-http-cpu)# action output interface cpu
Configuring a Non-persistent Flow
DirectFlow flows are persistent by default. Use the nopersistent command to configure non-persistent flows.
switch config)# directflow
switch(config-directflow)# flow example-non-persistent
switch(config-directflow-example-non-persistent)# match input interface ethernet 25
switch(config-directflow-example-non-persistent)# action drop
switch(config-directflow-example-non-persistent)# no persistent
switch(config-directflow-example-non-persistent)# timeout hard 300
Display Details for Configured Flows
The detail option of the show directflow flows command enables you to display the
details of configured flows. You can use this command to verify that a
non-persistent flow is deleted after the timeout period configured for the flow has
elapsed.
The following example shows the use of
this command to view the configuration of a non-persistent flow before
the timeout period has elapsed, and a second time, after the timeout
period has expired.
The initial use of the command displays the flow configuration (before the timeout
expires).
The second use of the command displays the flow details (after the timeout expires).
The output shows that the flow is no longer programmed.
switch(config-directflow)# show directflow flows example-non-persistent detail
Flow example-non-persistent: (Flow not programmed)
persistent: False
priority: 0
hard timeout: 300
idle timeout: 0
match:
ingress interface:
Et25
actions:
drop
matched: 0 packets, 0 bytes
DirectFlow Feature Interactions
DirectFlow flow entries can have one of the following actions:
A set of egress ports for sending a matched packet
Copy to CPU
Redirect to CPU
Drop
No specified action (in this case, the traffic is output normally).
The only exception is the ingress or egress
mirroring action, where the DirectFlow entry causes the packet to be
mirrored.
When the ingress or egress packets are
mirrored, the original traffic is sent out normally.
Bridging Features
DirectFlow entries have precedence over all entries in the MAC table, including
static MAC entries and static MAC drop entries. Packets that do not match
DirectFlow entries are forwarded based on the MAC address table.
VLANs: DirectFlow entries can modify the VLAN of a packet. MAC learning takes
place in the original VLAN for DirectFlow entries that modify the VLAN. The
modified packet will be subject to VLAN membership checks on the egress port. If
a packet has no VLAN tag, DirectFlow assumes it came in on the native VLAN for
the ingress interface. A VLAN override causes the packet to obey the VLAN rules
on the egress port.
Q-in-Q: Q-in-Q is supported as DirectFlow entries match only on the outer
tag.
Counters: All packets that match DirectFlow entries cause interface
counters to increment as usual.
Spanning Tree
DirectFlow runs alongside MSTP, RSTP,
and PVST. DirectFlow entries do not match on packets that ingress an
STP discarding port. DirectFlow entries that cause a packet to be forwarded
out an STP discarding port will result in the packets being dropped on
egress.
When STP is enabled, BPDUs will always
be trapped to the CPU. When STP is disabled, BPDUs will be subject to
DirectFlow entries and not be copied to the CPU by default.
LLDP, LAGs, and LACP
LLDP packets are always trapped to the CPU. DirectFlow entries can never match
LLDP packets.
LAGs are fully supported, and can be part of a match criteria and part of an
output action to an interface.
LACP packets are always trapped to CPU. DirectFlow entries can never match LACP
packets.
sFlow
sFlow is unaffected by DirectFlow.
IGMP Snooping
IGMP control packets are trapped to the
CPU when IGMP Snooping is enabled. DirectFlow entries can match IGMP
Snooping control traffic and override the trap to CPU.
Link-local-multicast packets are flooded
in hardware in the VLAN via a TCAM entry. DirectFlow entries can match
link-local-multicast packets and change the flooding behavior. As DirectFlow
entries have to specify output interfaces or drop, the action will conflict
and so matching DirectFlow entries will get precedence.
When IGMP snooping is enabled, unknown IPV4 multicast packets are flooded to the multicast-router
ports in the VLAN. If DirectFlow entries match unknown IPV4 multicast packets, they
will override the flooding behavior.
Data packets in groups under IGMP snooping
control are sent to the group members through a MAC table entry. Matching
DirectFlow entries override the MAC table entries.
ACLs
DirectFlow entries are lower priority than any configured Port ACLs (ingress). Packets coming in
on a port that match DirectFlow entries obey any configured ACL on that port, and
will only apply to packets that have a permit action.
DirectFlow entries are higher priority
than any configured RACLs. Packets coming in on an L3 interface that
match DirectFlow entries ignore any RACLs configured on that interface.
DirectFlow entries are lower priority
than any configured Egress ACLs.
Layer Three Features and DirectFlow
DirectFlow runs alongside IP
routing. If a packet is routed out a layer three interface using a DirectFlow
entry, the actions associated with the entry will have to specify the
new source MAC and destination MAC for the packet, as well as the physical
port or LAG. If there are no output ports specified in an entry, packets
that match that entry will be dropped.
Unicast Routing
When unicast routing is enabled, DirectFlow
entries that match take precedence for all packets that would have been
otherwise been routed. The three exceptions are the ingress mirror, egress
mirror and copy-to-CPU actions where the packets will be routed normally
in addition to the action being performed. Routed packets that do not
match DirectFlow entries are forwarding based on the L3 lookup.
Multicast Routing
When multicast routing is enabled, DirectFlow
entries that match take precedence for all packets that would have otherwise
been multicast routed. The packets are not replicated based on the hardware
multicast tables, but are forwarded strictly according to the actions
specified by the DirectFlow entry. The entry can specify a set of output
interfaces, which will result in the packet being replicated based on
the DirectFlow entry.
Displaying DirectFlow Configurations
The show directflow flows command displays the contents of the flow table,
showing each entry with its match rules, actions, and packet counters.
This example shows the status of a default (persistent) flow.
switch(config-directflow)# show directflow flows
Flow Test1:
priority: 0
match:
ingress interface: Ethernet1
ethertype ip
source ip address: 10.10.10.10
actions:
output mirror: Ethernet2
matched: 0 packets, 0 bytes
switch(config-directflow)#
This example shows the status of a non-persistent flow. The flow will be deleted once
5 minutes have elapsed.
switch(config-directflow)# show directflow flows example-non-persistent
Flow example-non-persistent:
persistent: False
priority: 0
hard timeout: 300
idle timeout: 0
match:
ingress interface:
Et25
actions:
drop
matched: 0 packets, 0 bytes
The action drop command configures packets that match an
entry to be dropped.
The no action drop and default action
drop commands remove the statement from the DirectFlow
configuration mode.
Command Mode
Directflow-flow Configuration
Command Syntax
action drop
no action drop
default action drop
Example
This command sets the action for packets from Test-1 to be
dropped.
switch(config-directflow-Test-1)# action drop
switch#
action mirror (DirectFlow-flow
mode)
The action mirror command can be used to ingress or egress
mirror traffic to a mirror destination. This requires a mirror destination to be
setup on the switch. If a packet comes in or goes out an interface that is part of
another mirror session, then the destination for that destination as well as the
DirectFlow destination will receive a copy of the packet.
The no action mirror and default action
mirror commands remove the statement from DirectFlow
configuration mode.
Command Mode
Directflow-flow Configuration
Command Syntax
actionDIRECTIONmirrorINT_NAME
no actionDIRECTIONmirrorINT_NAME
default actionDIRECTIONmirrorINT_NAME
Parameters
DIRECTION transmission direction of traffic to be
mirrored.
ingress mirrors before any rewrites.
egress mirrors after rewrites.
INT_NAME Source interface for the mirroring
session.
ethernete_range Ethernet interfaces specified by
e_range.
port-channel p_range Port channel interfaces specified
by p_range.
Example
This command configures mirror traffic to ethernet
2.
switch(config-directflow)# flow Test1
switch(config-directflow-Test1)# match ethertype ip
switch(config-directflow-Test1)# match source ip 10.10.10.10
switch(config-directflow-Test1)# action egress mirror ethernet 2
switch(config-directflow-Test1)#
action output (DirectFlow-flow
mode)
The action output command configures an Ethernet or port
channel interface as the output of a specified port mirroring session.
The no action output and default action
outputcommands remove the statement from
DirectFlow configuration mode.
Command Mode
Directflow-flow Configuration
Command Syntax
action outputDESTINATION
no action outputDESTINATION
default action outputDESTINATION
Parameters
DESTINATION transmission direction of traffic to be
mirrored.
all mirrors transmitted and received traffic.
flood mirrors received traffic only.
interface ethernete_range Ethernet interfaces specified by
e_range.
interface port-channel p_range Port channel interfaces specified by
p_range.
nexthop vrfvrf_nameip_addr. If the next hop is reachable in the
default VRF, the default VRF does not need to be specified.
Examples
This command configures interface ethernet 7 as
the output for the mirroring
session.
The following commands configure a flow redirecting all traffic from
10.10.1.2 to
e_range next hop assuming an appropriately
configured TCAM
profile.
switch(config-directflow)# flow flow-sip-10_10_1_2-redirect-to-10_30_1_2
switch(config-directflow-Test1)# match ethertype ip
switch(config-directflow-Test1)# match source ip 10.10.1.2
switch(config-directflow-Test1)# action output nexthop 10.30.1.2
switch(config-directflow-Test1)#
action output interface
cpu (DirectFlow-flow mode)
The action output interface cpu command configures the
action (other commands are used to define the traffic matching conditions).
The no action output interface cpu and default
action output commands remove the statement from
DirectFlow configuration mode.
Command Mode
Directflow-flow Configuration
Command Syntax
action outputDESTINATION
no action outputDESTINATION
default action outputDESTINATION
Parameters
DESTINATION transmission direction of traffic to be
mirrored.
all mirrors transmitted and received traffic.
flood mirrors received traffic only.
interface cpu Ethernet interfaces specified by
e_range.
Examples
This command configures interface ethernet 7 as
the output for the mirroring
session.
These commands configure the action to redirect traffic matching the flow to
the CPU and the matching conditions for the flow.
switch (config)# directflow
switch(config-directflow)# flow redirect-http-cpu
switch(config-directflow-redirect-http=cpu)# match ip protocol tcp
switch{config-directflow-redirect-http-cpu)# match destination p cpuort 80
switch(config-directflow-redirect-http-cpu)# action output interface
action set (DirectFlow-flow
mode)
The action set command allows you to configure a packet to
be routed out a layer three interface using a DirectFlow entry. The actions
associated with the entry will have to specify the new source MAC and destination
MAC for the packet, as well as the physical port or LAG. If there are no output
ports specified in an entry, packets that match that entry will be dropped.
The no action set and default action
setcommands remove action set statement from DirectFlow
configuration mode.
Command Mode
Directflow-flow Configuration
Command Syntax
action setCONDITION
no action setCONDITION
default action setCONDITION
Parameters
CONDITION specifies parameter and value. Options include:
cos0 to 7 Cost of service.
destination macmac_addr Dotted hex notation.
ip tos0 to 255 Type of service.
source macmac_addr Dotted hex notation.
traffic-class0 to 7 Dotted hex notation.
vlan0 to 4094 Number of VLAN.
The no action set and default action
set commands require only the CONDITION type without a
specific condition value.
Example
These commands change the destination MAC of the
frame.
switch(config-directflow)# flow Test1
switch(config-directflow-Test1)# action egress mirror ethernet 7
switch(config-directflow-Test1)# action set destination mac 0000.aaaa.bbbb
directflow
The directflow command places the switch in DirectFlow
configuration mode.
The no directflow and default
directflow commands delete the DirectFlow configuration mode
statements from running-config.
DirectFlow configuration mode is not a group change mode;
running-config is changed immediately upon entering commands. The
exit command returns the switch to global
configuration mode.
Command Mode
Global Configuration
Command Syntax
directflow
no directflow
default directflow
Commands Available in DirectFlow-Flow configuration mode:
This command returns the switch to global management
mode.
switch(config-directflow)# exit
switch(config)#
flow (DirectFlow)
The flow command places the switch in flow
configuration mode.
The flow command specifies the name of the flow that
subsequent commands modify and creates a newflow definition if it references a
nonexistent flow. All changes in a flow configuration mode edit
session are pending until the session ends:
The exit command saves pending changes to
running-config and returns the switch to
DirectFlow configuration mode. Changes are also saved
by entering a different configuration mode.
The abort command discards pending changes,
returning the switch to DirectFlow configuration mode.
The no flow and default flow
commands delete the specified role by removing the role and its statements from
running-config.
Command Mode
DirectFlow Configuration
Command Syntax
flowflow_name
no flowflow_name
default flowflow_name
Parameter
flow_name Name of flow.
Commands Available in DirectFlow-Flow configuration mode:
The match command allows you to configure a rule or a flow
which could match on L2, L3, L4 fields of a packet and specify a certain action to
modify, drop or redirect the packet.
All traffic ingressing on the switch will be matched against the flows installed. In
cases where none of the packets match, normal switching or routing behavior will
take over. When multiple entries match a packet, precedence is given to the entry
that was installed first.
The no match and default match
commands remove the match statement from the configuration
mode.
Command Mode
Directflow-flow Configuration
Command Syntax
matchCONDITION
no matchCONDITION
default matchCONDITION
Parameters
CONDITION specifies criteria for evaluating a route. Options
include:
cos0 to 7 cost of service.
destination ipipv4_sub destination IPv4 subnet. L3 fields valid
only if ethertype is IP (0x0800).
destination mac mac_addr Add to the existing community. Dotted
hex notation.
destination mac mac_addr mask mac_mask Add to the sting community. Dotted hex
notation.
destination port0 to 65535 Fields accepted only if protocol is
TCP|UDP.
ethertype0 to 65535 Layer 4 destination port.
ethertype ARP Layer 4 destination port.
ethertype IP Layer 4 destination port.
icmp code0 to 255 Fields accepted only if protocol is
ICMP.
icmp type0 to 255 Fields accepted only if protocol is
ICMP.
input interface ethernete_num Ethernet interface specified by
e_num.
input interface port-channelp_num Port channel interface specified by
p_num.
ip protocol0 to 255 Type of service.
ip protocol icmp L3 fields valid only if ethertype
is IP (0x0800).
ip protocol tcp L3 fields valid only if ethertype is IP (0x0800).
ip protocol udp L3 fields valid only if ethertype
is IP (0x0800).
ip tos0 to 255 L3 fields valid only if ethertype is IP
(0x0800).
source ipipv4_subnet L3 fields valid only if ethertype is
IP (0x0800).
source macmac_addr Add to the existing community. Dotted
hex notation.
source macmac_addr maskmac_mask Add to the sting community. Dotted hex
notation.
source port0 to 65535 Fields accepted only if protocol is
TCP| UDP.
tcp flag ack Layer 4 destination port.
tcp flag fin Layer 4 destination port.
tcp flag psh Layer 4 destination port.
tcp flag rst Layer 4 destination port.
tcp flag syn Layer 4 destination port.
tcp flag urg Layer 4 destination port.
tcp flag urg Layer 4 destination port.
vlan1 to 4094mask1 to 4095 Number of VLAN.
The no match and default match
commands require only the CONDITION type without a specific
condition value.
Example
This command creates the rules to match on Ethertype IP and Source IP
10.10.10.10.
switch(config-directflow)# flow Test1
switch(config-directflow-Test1)# persistent
switch(config-directflow-Test1)# match ethertype ip
switch(config-directflow-Test1)# match source ip 10.10.10.10
persistent
DirectFlow flows are persistent by default. Once finalized, they appear in the
running configuration, and if saved to startup config they will
persist over a reboot. The no form of the
persistent command prevents the flow from showing up
in running config, ensuring that it will not persist over a
reboot.
Command Mode
Directflow-flow Configuration
Command Syntax
persistent
no persistent
Example
These commands create and enable a non-persistent DirectFlow
flow.
switch(config)# directflow
switch(config-directflow)# flow example-non-persistent
switch(config-directflow-example-non-persistent)# match input interface ethernet 25
switch(config-directflow-example-non-persistent)# action drop
switch(config-directflow-example-non-persistent)# no persistent
switch(config-directflow-example-non-persistent)# timeout hard 300
switch(config-directflow-example-non-persistent)# exit
switch(config-directflow)#
priority (DirectFlow-flow
mode)
The priority command sets the priority for the flow match
rules. Each flow-table entry has an optional priority field, with a higher number
indicating a higher priority. Flows with the same priority may be loaded in any
order, and the order may be changed at any time. If multiple entries match a packet,
precedence is given to the entry that was installed first.
Priority numbers range from 0 to 65535. The default is
0. The higher priority rules match first.
The no priority and default
priority commands remove priority statement from the
DirectFlow configuration mode.
Command Mode
Directflow-flow Configuration
Command Syntax
prioritypriority_value
no priority
default priority
Parameter
priority_value priority xxx.
Value ranges from 0 to 65535. Default is
0.
Example
These commands assign the priority of 150 to flow
Test-1.
The show directflow command displays summary information
for DirectFlow. With the counters or
details options, it displays counters or details for all flows
configured on the switch.
Command Mode
EXEC
Command Syntax
show directflow [counters |
details]
Examples
This command displays summary information for
DirectFlow.
switch# show directflow
DirectFlow configuration: Enabled
Total matched: 0 packets
Total programmed flows: 3 flows
switch#
This command displays counters for all DirectFlow flows configured on the
switch.
The show directflow flows command displays the contents of
the flow table, showing each entry with its match rules, actions, and packet counters.
Including the name of a specific flow limits the output to information about the specified
flow.
Command Mode
EXEC
Command Syntax
show directflow flows [flow_name
[counters | detail]]
Parameters
flow_name name of flow for which to display information. If
no flow name is entered, command displays information for all flows.
counters displays DirectFlow counters for the specified
flow.
detail displays detailed information for the specified
flow.
Examples
This command displays the contents of the flow
table.
switch# show directflow counters
Flow Name Source Matched packets Matched bytes
--------- ------ --------------- -------------
test1 config 0 146
Total matched packets: 1
shutdown (DirectFlow)
The shutdown command, in DirectFlow mode, disables
DirectFlow on the switch. DirectFlow is disabled by default.
The no shutdown command re-enables DirectFlow.
Command Mode
Directflow Configuration
Command Syntax
shutdown
no shutdown
default shutdown
Examples
These commands enable DirectFlow on the
switch.
switch(config)# directflow
switch(config-directflow)# no shutdown
switch(config-directflow)#
This command disables DirectFlow
Flow.
switch(config-directflow-Test1)# shutdown
timeout (DirectFlow-flow
mode)
The timeout command, in DirectFlow mode,
command configures the connection timeout period for connection sessions. The
connection timeout period defines the interval between a users most recently entered
command and an automatic connection shutdown. Automatic connection timeout is
disabled by setting the idle-timeout to zero, which is the default setting.
Command Mode
Directflow-flow Configuration
Command Syntax
timeout [hard | idle]
no timeout
Parameters
idle session idle timeout length.
0 Automatic connection timeout is
disabled.
1-4294967295 Automatic timeout period
(seconds).
hard session hard timeout length.
0 Automatic connection timeout is
disabled.
1-4294967295
Example
These commands enable a hard timeout period of 5
seconds on the
switch.
switch(config)# directflow
switch(config-directflow-Test1)# timeout hard 5
switch(config-directflow-Test1)#
These commands enable DirectFlow on the
switch.
switch(config)# directflow
switch(config-directflow-Test1)# no timeout hard
switch(config-directflow-Test1)#
EOS provides IP Address Locking capabilities when configured on an Ethernet Layer 2
port.
After enabling IP Address Locking on a Layer 2 (L2) port, the port only permits IP and
ARP packets with authorized IP source addresses. Configure IP Address Locking in one of
two modes:
IPv4
IPv6
IP Address Locking prevents a host on a different interface from claiming ownership of an
IP address through ARP spoofing. IPv6 Locking extends this behavior to IPv6 packets,
including ICMPv6 Neighbor Discovery Router Advertisement and Redirect and DHCP
server-to-client packets.
On an IPv4 Locked Port, the ARP protocol performs the following actions on the network:
Probing with the IPv4 address 0.0.0.0 as the Sender Protocol Address
(SPA).
Permit Duplicate Address Detection (DAD).
Drop incoming DHCP server response packets to avoid any rogue devices acting as DHCP servers.
Permit incoming DHCP client request packets on devices to complete the DHCP
handshake and obtain a DHCP lease.
On an IPv6 Locked Port, the ARP protocol performs the following actions on the
network:
Drop incoming DHCPv6 server response packets.
Permit incoming DHCPv6 client request packets.
On an incoming ICMPv6 network device, perform the following actions:
Drop Router Advertisement packets since only routers should send these
packets.
Permit Router Solicitation packets.
Drop redirect packets as only routers should send these packets.
Figure 1. IP Address Locking
IP Address Locking determines port authorization for IP addresses by untilizing DHCP
LeaseQuery and MAC address. Ensure that DHCP servers used in the network allow
LeaseQuery messages.
Alternatively, IP locking can be configured to monitor incoming DHCPACK packets on
designated ports to verify IP address authorization. This specific configuration method
operates independently and eliminates the need for DHCP LeaseQuery.
This section describes IP Address Locking configuration tasks and associated commands.
Before enabling IPv4 Address Locking, you must configure a DHCP Server and a Local
Layer 3 interface.
Enabling a DHCP Server for IPv4 Address Locking
Add the DHCP servers used by hosts to acquire leases. IPv4 Address Locking
communicates with the DHCP servers to learn the authorized IP addresses on the
switch.
Example
The following commands enable DHCP servers with an IPv4 address of 10.1.1.1,
and another DHCP server with the IP address,
10.30.1.3:
switch(config-address-locking)# dhcp server ipv4 10.1.1.1
switch(config-address-locking)# dhcp server ipv4 10.30.1.3
Adding a Local Layer 3 Interface
Add a local L3 interface to communicate with the DHCP server. This could be the
management interface, a routed interface, or a Switch Virtual Interface (SVI). This
interface requires an assigned valid IP address, routable to the configured DHCP
server, and can reside in a non-default VRF. The switch packets sent to the DHCP
Server use the interface IP address as the source IP address.
Examples
The following commands configure an interface with a valid IP address,
10.10.1.2/16, on
VLAN2160:
switch# configure
switch(config)# interface Vlan2160
switch(config-if-Vl2160)# ip address 10.10.1.2/16
The following commands add the interface to the IP Address Locking
configuration:
Configure IP Address Locking for either IPv4 or IPv6 addresses, and both types of IP addresses can be enabled for IP Address Locking. IPv6 Address Locking
requires a different approach outlined in this section.
Enabling IP Address Locking
Configure IPv4 Address Locking commands in the configuration mode.
Example
Use the following commands to enter IP Address Locking configuration mode and add
IPv4 Address
Locking:
Disable IP Address Locking using the disabled command in address-locking mode. This turns
off the feature and allows a host to use any IP address, authorized or unauthorized, on
any port.
To enable IPv4 Address Locking on ports connected to clients, IP Address Locking must be
enabled in the Interface Configuration Mode. Running this command only enables IPv4
Locking and overrides the previous configuration for the interface.
Example
Use the following commands to enable IP Address Locking for the interface,
Ethernet27/1:
Use the denyip_address on IPv4 Address Locking ports to block
all IPv4 and ARP packets with a specific source IPv4 address. The port denies the packet
and affects only IPv4 enforcement modes. This action deauthorizes the addresses on the
port and can be configured with multiple IPv4 addresses. You must configure this on an
interface already configured with IPv4 Address Locking.
Note: Use only IPv4 addresses with this configuration.
The lease mac
command within address locking configuration mode installs a lease into hardware for the
configured IP address on the interface with the configured associated MAC address. If
the MAC address does not appear in the MAC table or the MAC address on an interface
without a configured IP Locking feature, the lease does not install until the interface
adds the MAC address to an interface configured with IP Locking.
Note: IP Locking removes from the switch any lease from the DHCP server that matches
either the same IP or MAC as a statically configured lease.
Example
Use the following commands to configure an IP address, 172.21.13.11, and MAC
Address, a0:ce:c8:b1:78:d3, with a static
lease:
switch# configure
switch(config)# address locking
switch(config-address-locking)# lease 172.21.13.11 mac a0:ce:c8:b1:78:d3
Clearing Leases
The clear address locking
lease command removes the lease from hardware. The command
removes lease bindings at different granularities.
The clear address locking lease ipv4 V4ADDR command
removes a single lease associated with an IPv4 address.
The clear address locking lease ipv6 V6ADDR command
removes a single lease associated with an IPv6 address.
The clear address locking lease intf ethernet slot
command removes all leases associated with the specified interface.
The clear address locking lease all removes all leases
on the switch.
Configuring IP Address Locking Lease Query Timeout
IP Address Locking sends out DHCP LeaseQuery requests to all configured DHCP servers in
the following cases:
When an IP Address Locking enabled port learns a MAC address, IP Address Locking
sends out a LeaseQuery request for the learned MAC address. After learning the
MAC address, IP Address Locking waits one (1) second for the DHCP.
When an IP Address Locking enabled port removes a MAC address after enabling the
locked-address expiration mac disabled feature, IP Address Locking sends a
LeaseQuery request for the removed MAC address.
When the IP Address Locking agent restarts, EOS sends LeaseQuery requests for
all MAC addresses on all IP Address Locking interfaces and for all MAC addresses
in the IP Address Locking table.
When you add a new DHCP configuration, EOS sends new LeaseQuery requests to the
new DHCP for all MAC addresses learned on all IP Address Locking interfaces and
for all MAC addresses in the IP Address Locking leases table.
When you configure an interface with IP Address Locking, IP Address Locking
sends LeaseQuery requests for all MAC addresses learned on that interface.
When an IP or ARP packet with a source IP address that does not exist in the IP
Address Locking table arrives at an interface, EOS sends LeaseQuery requests for
all MAC addresses on that interface. If the host already has a valid DHCP lease
and the DHCP server sends a LeaseActive reply, IP Address Locking sends at least
one (1) request every 50 seconds for that host as a result of dropped ARP or IP
packets.
When the DHCP Lease reaches the last known expiration time, IP Address Locking
sends out a LeaseQuery request for the MAC address associated with the lease.
Note that this may be different from the actual expiration time. For example, if
the host renewed the lease before the actual lease expires and received no
LeaseQuery requests sent for the MAC address, IP Address Locking sends out a
query at the original expiration time.
After a LeaseActive reply receives a matching MAC address of a previously
received lease, IP Address Locking sends out a LeaseQuery request for the
previous IP address associated with the updated MAC address.
After a LeaseActive reply receives a matching MAC address of a previously
received lease, IP Address Locking sends out a LeaseQuery request for the
previous MAC address associated with the updated IP address.
When IP Address Locking sends out a LeaseQuery request, and does not receive a LeaseActive reply, IP Address
Locking sends six (6) additional retries over 64 seconds using an exponential backoff algorithm. A 0-25% delay sending
requests which may take up to 80 seconds to send out all seven (7) requests.
Every LeaseQuery request includes a transaction ID. After sending the last request, and
for an additional 10 seconds, IP Address Locking accepts any LeaseActive reply
matching the transaction ID and then queries for the MAC address of a sent
LeaseQuery request.
If a LeaseActive reply contains multiple IP addresses, IP Address Locking begins a query
process for the additional IP addresses using the same retry mechanisms. However, if you
configure the LeaseQuery retry interval and timeout but do not receive LeaseActive
replies, IP Address Locking sends continuous lease query requests at the configured
retry interval until reaching the specified timeout period.
Note: Alternatively, IP Locking can be configured to verify IP authorization by
monitoring incoming DHCPACK packets on specified ports. This method eliminates the
need for DHCP LeaseQuery by operating independently. However, it is only applicable
when IP Address Locking uses DHCP LeaseQuery and MAC address learning to determine
port authorization for IP addresses.
Configuring Locked Address Expiration
The IP addresses remain authorized and installed after the corresponding MAC addresses
age out. IP Address Locking, by default, removes authorized leases after the
corresponding MAC addresses age out. The locked-address
expiration mac disabled command configures IP Address Locking
to keep leases installed, after the corresponding MAC addresses age out.
Example
The following commands keep leases installed on the IP
address:
switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address expiration mac disabled
Configuring IP Locking DHCP Server Interface
Address-locking mode can be enabled using the command dhcp server interfaceinterface. In this mode, the IP Locking agent monitors the server
interface for DHCP ACK packets and tracks release packets on protected interfaces.
Configuration Priorities and DHCP Lease Management
When both a local interface and a DHCP server interface are specified, the system
prioritizes the local-interfaceinterface setting. In this
scenario, IP Locking disregards the DHCP server interface and utilizes the local
interface for outgoing DHCP LeaseQuery messages.
Furthermore, specifying DHCP server IP addresses within the dhcp server
interfaceinterface configuration is optional. If specific IP
addresses are provided, IP Locking strictly learns leases from those identified
servers. However, if no addresses are defined, the agent learns leases from all
DHCP server traffic detected on the configured interfaces.
Example
Use the following command to configure the DHCP server interface Ethernet
28/1:
switch# config
switch(config)# address locking
switch(config-address-locking)# dhcp server interface Ethernet28/1
Enforcing Locked IP Addresses
The locked-address ipv4 enforcement disabled command disables
address filtering for all ports with IPv4 Address Locking enabled. This permits IPv4
packets while still keeping all other drop rules. When configured, IP Address Locking
does not drop IP or ARP packets, and does not send out lease queries to configured DHCP
servers.
Examples
The following commands disable IPv4 Address Locking
globally:
The locked-address ipv6 enforcement disabled command
disables address filtering for all ports with IPv6 Locking enabled. This permits
IPv6 packets while still keeping all other drop
rules.
Use the show address
locking command to display the status of IPv4 and IPv6
locking.
Example
switch# show address locking
IP Locking is active
Interface IPv4 IPv6
--------------- ------------------- ---------------------------
Ethernet27/1 yes no (not configured)
Ethernet31/1 no (not configured) no (not a layer 2 interface)
The show address locking command also displays interfaces with
the reason IP Address Locking may not be enabled. For an interface without IP Address
Locking enabled, the following priority (highest at top) imposes on the output:
Unconfigured.
Not a Layer 2 interface.
No local interface configured.
No DHCP server configured.
The show address locking table ipv4 command displays all the
DHCP leases that IP Address Locking knows about, current status of installed leases, and
the authorized interfaces for these IP addresses.
Example
switch# show address locking table ipv4
IP Address MAC Address Interface Installed Expiration Time
-------------- ---------------- ---------- ------------ ---------------
10.30.4.4 ba76.a467.7ff8 Et27/1 installed in 0:01:57
Use the address locking command to block IPv4 and ARP packets with specific IPv4
addresses on the switch. You must perform this command from an interface configured for
IP Address Locking on the switch.
Command Mode
Interface Configuration
Address Locking Configuration
Command Syntax
address locking denyip_address
Parameter
ip_address - Specify the IPv4 address to block packets.
Example
Use the following command to deny IPv4 and ARP packets from IPv4 address,
172.16.21.131, from Ethernet interface,
Ethernet53/4:
Use the address locking command to enter the IPv4 and IPv6
locking mode and then on the switch, use the lease to
configure DHCP leases.
The lease mac command within the address locking configuration
mode installs a lease onto hardware for the configured IP address on the interface with
the associated configured MAC address. If the MAC address does not exist in the MAC
table or the MAC address appears on an interface with an IP Locking configuration feature, the lease does not install until you add the MAC address to an
interface configured with IP Locking.
Command Mode
Address Locking Configuration
Command Syntax
leaseip_addressmacip_address
Parameters
lease
V4ADDR - Specify the IPv4 address to assign
the lease.
macMACADDR - Configure the MAC address for a
static lease.
no leaseV4ADDRmacMACADDR - Removes the retry and timeout configuration.
default leaseV4ADDRmacMACADDR - Configures the lease with the default IPv4
address and MAC address.
Example
To configure a lease with the IPv4 address, 1.1.1.1, and the MAC address,
a.b.c, use the following
command:
switch(config)# address locking
switch(config-address-locking)# lease 1.1.1.1 mac a.b.c
address locking lease query
Use the address locking command to enter the IPv4 and IPv6
locking mode and then use the lease query retry interval to configure DHCP leases.
The no lease query retry command removes the retry interval and
timeout configuration.
Command Mode
Address Locking Configuration
Command Syntax
leasequeryretryintervalinterval-time
Parameters
intervalinterval-time - Configure the query retry interval and
timeout. The interval can be from 1 - 4294967295 seconds.
Example
To configure a lease with the retry interval, 5 seconds, and a timeout, 100, use the
following
command:
Use the following command to clear all IP Address Locking leases from the
switch:
switch(config-address-locking)# clear address locking lease all
dhcp server interface
Use the dhcp server interface command to monitor the server
interface for DHCP ACK packets and handle release packets on the designated locked
interfaces by the IP Locking agent. You must perform this command from an interface
configured for IP Address Locking on the switch.
Note: That when
both "dhcp server interface <INTF>" and "local-interface <INTF>" are active,
IP Locking prioritizes the local interface for transmitting DHCP LeaseQuery packets
and disregards the "dhcp server interface <INTF>" setting.
Command Mode
Address Locking Configuration
Command Syntax
dhcp server interface<INTF>
Parameter
<INTF> - Specify the DHCP server interface.
Example
Use the following command to configure the dhcp server interface Ethernet
28/1:
switch# conf
switch(config)# address locking
switch(config-address-locking)# dhcp server interface Ethernet28/1
locked-address expiration mac disabled
IP Address Locking, by default, removes authorization from leases after the
corresponding MAC addresses age out. Use the locked-address expiration mac
disabled command to configure IP Address Locking to keep the
leases installed, even after the corresponding MAC addresses age out.
Command Mode
Address Locking Configuration
Command Syntax
locked-address expiration mac disabled
no locked-address expiration mac disabled
default locked-address expiration mac disabled
Parameters
expiration - Configures expiration mode for locked addresses.
mac - Configures deauthorizing locked addresses when MAC addresses age out.
disabled - Disables deauthorizing locked address when MAC addresses age out.
Example
Use this command to disable locked address
expiration:
switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address expiration mac disabled
locked-address ipv4 enforcement disabled
The locked-address ipv4 enforcement disabled command disables
address filtering for all ports with IPv4 Locking enabled. This permits IPv4 packets
while still keeping all other drop rules.
Command Mode
Address Locking Configuration
Command Syntax
locked-addressipv4enforcementdisabled
no locked-addressipv4enforcementdisabled
default locked-addressipv4enforcementdisabled
Parameters
ipv4 - Configure the IP address family.
enforcement - Configure enforcement for locked addresses.
disabled - Disable enforcement for locked addresses.
Example
Use the following command to disable locking address enforcement for IPv4
addresses:
The locked-address ipv6 enforcement disabled command disables
address filtering for all ports with IPv6 Locking enabled. This permits IPv6 packets
while retaining all other drop rules.
Command Mode
Address Locking Configuration
Command Syntax
locked-address IPv6 enforcement disabled
no locked-address IPv6 enforcement disabled
default locked-address IPv6 enforcement disabled
Parameters
ipv6 - IPv6 address configuration.
enforcement - Configure enforcement for locked addresses.
disabled - Disable enforcement for locked addresses.
Example
Use the following command to disable locking address enforcement for IPv6
addresses:
Use the show address locking command to display the status of IP and IPv6 locking.
The show address locking command also displays the reason as to
why IP Locking is not enabled for an interface. For an interface without IP Locking
enabled, the following priority (highest at top) apply to the output:
Interface not configured.
Interface is not a Layer 2 interface.
No local interface configured.
No DHCP server configured.
Command Mode
EXEC
Command Syntax
show address locking
Example
To display information about IP locking, use the show address locking
command:
switch# show address locking
IP Locking is active
Interface IPv4 IPv6
--------------- ------------------- ---------------------------
Ethernet27/1 yes no (not configured)
Ethernet31/1 no (not configured) no (not a layer 2 interface)
show address locking counters
The show address locking counters command displays DHCP lease
query messages sent, received, and dropped. Two sets of counters display in the output:
Number of packets sent and received from each DHCP server.
Number of packets sent and received for each locked interface.
IP Locking uses separate counters for different kinds of messages communicated
between the switch and the DHCP server.
Command Mode
EXEC
Command Syntax
show address locking counters
Related Commands
The clear address locking counters command resets all the
counters associated with IP Locking to zero.
Examples
The following command displays IP Address Locking
Counters:
switch# show address locking counters
Lease Active Lease Unknown Lease Unassigned
DHCP Server Query Rcvd Drop Rcvd Drop Rcvd Drop Unknown
----------- ----- ----- ------ ------ ------ -------- ------- -------
80.80.80.80 32860 8002 34 8001 32 13423 134 3234
Interface Query Lease Active Lease Unknown Lease Unassigned
--------- ----- ------------ ------------- ----------------
Ethernet2 1747 1234 189 324
Add the detail parameter to display additional
details about
counters:
switch# show address locking counters detail
Action Count
-------------------------------- --------
DHCP from client to server PERMIT 0
DHCP from server DROP 0
ARP (0.0.0.0) PERMIT 3
DHCP6 to client DROP 2
DHCP6 to server PERMIT 2
NDP Router Solicitation PERMIT 1
NDP Router Advertisement DROP 1
NDP Router Redirect DROP 0
DHCP from server on VLAN DROP 2
DHCP from client to server on VLAN PERMIT 2
ARP (0.0.0.0) on VLAN PERMIT 1
DHCP6 to client on VLAN DROP 2
DHCP6 to server on VLAN PERMIT 2
NDP Router Solicitation on VLAN PERMIT 2
NDP Router Advertisement on VLAN DROP 1
NDP Router Redirect on VLAN DROP 2
Interface Action IP MAC Count
----------- ----------------------- ------- ---------------- -----
Ethernet46 unknown ARP on VLAN DROP any any 5
Ethernet46 unknown IP on VLAN DROP any any 5
Ethernet46 unknown ARP DROP any any 0
Ethernet46 unknown IP DROP any any 0
Ethernet49/1 ARP DROP 10.0.0.1 any 0
Ethernet49/1 IP DROP 10.0.0.1 any 5
Ethernet49/1 ARP PERMIT 10.0.0.2 c4:01:32:58:00:00 0
Ethernet49/1 IP PERMIT 10.0.0.2 c4:01:32:58:00:00 0
Add the ipv4 or ipv6
parameter to display only information for IPv4 or IPv6
counters:
switch# show address locking counters detail ipv4
Action Count
-------------------------------- --------
DHCP from client to server PERMIT 0
DHCP from server DROP 0
ARP (0.0.0.0) PERMIT 3
DHCP from server on VLAN DROP 2
DHCP from client to server on VLAN PERMIT 2
ARP (0.0.0.0) on VLAN PERMIT 1
Interface Action IP MAC Count
------------ ------------------------ -------- ----------------- -----
Ethernet46 unknown ARP on VLAN DROP any any 5
Ethernet46 unknown IP on VLAN DROP any any 5
Ethernet46 unknown ARP DROP any any 0
Ethernet46 unknown IP DROP any any 0
Ethernet49/1 ARP DROP 10.0.0.1 any 0
Ethernet49/1 IP DROP 10.0.0.1 any 5
Ethernet49/1 ARP PERMIT 10.0.0.2 c4:01:32:58:00:00 0
Ethernet49/1 IP PERMIT 10.0.0.2 c4:01:32:58:00:00 0
switch# show address locking counters detail ipv6
Action Count
-------------------------------- --------
DHCP6 to client DROP 2
DHCP6 to server PERMIT 2
NDP Router Solicitation PERMIT 1
NDP Router Advertisement DROP 1
NDP Router Redirect DROP 0
DHCP6 to client on VLAN DROP 2
DHCP6 to server on VLAN PERMIT 2
NDP Router Solicitation on VLAN PERMIT 2
NDP Router Advertisement on VLAN DROP 1
NDP Router Redirect on VLAN DROP 2
Add the interface parameter to display counters for
a specific interface,
Et49/1:
switch# show address locking counters detail ipv4 interface Et49/1
Interface Action IP MAC Count
------------ ------------------------ -------- ----------------- -----
Ethernet49/1 ARP DROP 10.0.0.1 any 0
Ethernet49/1 IP DROP 10.0.0.1 any 5
Ethernet49/1 ARP PERMIT 10.0.0.2 c4:01:32:58:00:00 0
Ethernet49/1 IP PERMIT 10.0.0.2 c4:01:32:58:00:00 0
show address locking table ipv4
Use the show address locking table ipv4 command to display all
DHCP leases with IP Locking, and the interfaces with authorized the IP addresses.
installed-Display the leases installed on
the hardware.
interface - Display the leases on a specified
interface.
installed - Display installed leases.
interface - Display the leases on a specified
interface.
Ethernetslot - Specified Ethernet sub-interface.
static - Display static leases.
installed - Display the leases on the
hardware.
interface - Display the leases on a specified
interface.
Ethernetslot
- Specified Ethernet sub-interface.
Example
switch# show address locking table ipv4
IP Address MAC Address Interface Installed Expiration Time
-------------- ---------------- ---------- ------------ ---------------
AC 10.30.4.4 ba76.a467.7ff8 Et27/1 installed in 0:01:57
IP Address Action
--------------- --------
10.30.4.4 permit
