IPv4

Arista switches support Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) for routing packets across network boundaries. This section describes Arista’s implementation of IPv4 and includes these topics:

IPv4 Addressing

Each IPv4 network device is assigned a 32-bit IP address that identifies its network location. These sections describe IPv4 address formats, data structures, configuration tasks, and display options:

IPv4 Address Formats

IPv4 addresses are composed of 32 bits, expressed in dotted decimal notation by four decimal numbers, each ranging from 0 to 255. A subnet is identified by an IP address and an address space defined by a routing prefix. The switch supports the following subnet formats:

  • IP address and subnet mask: The subnet mask is a 32-bit number (dotted decimal notation) that specifies the subnet address space. The subnet address space is calculated by performing an AND operation between the IP address and subnet mask.
  • IP address and wildcard mask: The wildcard mask is a 32-bit number (dotted decimal notation) that specifies the subnet address space. Wildcard masks differ from subnet masks in that the bits are inverted. Some commands use wildcard masks instead of subnet masks.
  • CIDR notation: CIDR notation specifies the scope of the subnet space by using a decimal number to identify the number of leading ones in the routing prefix. When referring to wildcard notation, CIDR notation specifies the number of leading zeros in the routing prefix.
Examples:
  • These subnets (subnet mask and CIDR notation) are calculated identically:
    10.24.154.13 255.255.255.0
    10.24.154.13/24

    The defined space includes all addresses between 10.24.154.0 and 10.24.154.255.

  • These subnets (wildcard mask and CIDR notation) are calculated identically:
    124.17.3.142 0.0.0.15
    124.17.3.142/28

    The defined space includes all addresses between 124.17.3.128 and 124.17.3.143.

IPv4 Address Configuration

Assigning an IPv4 Address to an Interface

The ip address command specifies the IPv4 address of an interface and the mask for the subnet to which the interface is connected.

Example:
  • These commands configure an IPv4 address with subnet mask for vlan 200:
    switch(config)#interface vlan 200
    switch(config-if-Vl200)#ip address 10.0.0.1/24
    switch(config-if-Vl200)#

Assigning an IPv4 Class E Address to an Interface

The ipv4 routable 240.0.0.0/4 command assignes an class E addresses to an interface. When configured, the class E address traffic are routed through BGP, OSPF, ISIS, RIP, static routes and programmed to the FIB and kernel. By default, this command is disabled.

Example:
  • These commands configure an IPv4 Class E (240/4) address to an interface.
    switch(config)#router general
    switch(config-router-general)#ipv4 routable 240.0.0.0/4

Address Resolution Protocol (ARP)

Address Resolution Protocol (ARP) is a protocol that maps IP addresses to MAC addresses that local network devices recognize. The ARP cache is a table that stores the correlated addresses of the devices for which the router facilitates data transmissions.

After receiving a packet, routers use ARP to find the MAC address of the device assigned to the packet’s destination IP address. If the ARP cache contains both addresses, the router sends the packet to the specified port. If the ARP cache does not contain the addresses, ARP broadcasts a request packet to all devices in the subnet. The device at the requested IP address responds and provides its MAC address. ARP updates the ARP cache with a dynamic entry and forwards the packet to the responding device. Static ARP entries can also be added to the cache through the CLI.

Proxy ARP is an ARP variant. A network device (proxy) responds to ARP requests for network addresses on a different network with its MAC address. Traffic to the destination is directed to the proxy device which then routes the traffic toward the ultimate destination.

Configuring ARP

The switch uses ARP cache entries to correlate 32-bit IP addresses to 48-bit hardware addresses. The arp aging timeout command specifies the duration of dynamic address entries in the Address Resolution Protocol (ARP) cache for addresses learned through the Layer 3 interface. The default duration is 14400 seconds (four hours).

Entries are refreshed and expired at a random time that is in the range of 80%-100% of the cache expiry time. The refresh is tried 3 times at an interval of 2% of the configured timeout.

Static ARP entries never time out and must be removed from the table manually.

Example:
This command specifies an ARP cache duration of 7200 seconds (two hours) for dynamic addresses added to the ARP cache that were learned through vlan 200.
switch(config)#interface vlan 200
switch(config-if-Vl200)#arp aging timeout 7200
switch(config-if-Vl200)#show active
interface vlan200
 arp timeout 7200
switch(config-if-Vl200)#

The arp command adds a static entry to an Address Resolution Protocol (ARP) cache.

Example:
This command adds a static entry to the ARP cache in the default VRF.
switch(config)#arp 172.22.30.52 0025.900e.c63c arpa
switch(config)#

Gratuitous ARP

Gratuitous ARP packets are broadcast by a device in response to an internal change rather than as a response to an ARP request. The gratuitous ARP packet is a request packet (no reply expected) that supplies an unrequested update of ARP information. In a gratuitous ARP packet, both the source and destination IP addresses are the IP of the sender, and the destination MAC address is the broadcast address (ff:ff:ff:ff:ff:ff).

Gratuitous ARP packets are generated to update ARP tables after an IPv4 address or a MAC address change occurs.

Configuring Gratuitous ARP

By default, Arista switch interfaces reject gratuitous ARP request packets. The arp gratuitous accept command configures an L3 interface to accept the gratuitous ARP request packets sent from a different device in the network and add their mappings to the ARP table. Gratuitous ARP can be configured on Ethernet interfaces, vlans/SVI, or L3 port channels, but has no effect on L2 interfaces.

Example:
These commands enable gratuitous ARP packet acceptance on Ethernet interface 2/1.
switch (config)#interface ethernet 2/1
switch (config-if-Et2/1)#arp gratuitous accept

Displaying ARP Entries

The show ip arp command displays ARP cache entries that map an IP address to a corresponding MAC address. The table displays addresses by their host names when the command includes the resolve argument.

Examples:
  • This command displays ARP cache entries that map MAC addresses to IPv4 addresses.
    switch>show ip arp
    
    Address Age (min)Hardware Addr Interface
    172.25.0.20  004c.6211.021evlan101, Port-Channel2
    172.22.0.10  004c.6214.3699vlan1000, Port-Channel1
    172.22.0.20  004c.6219.a0f3vlan1000, Port-Channel1
    172.22.0.30  0045.4942.a32cvlan1000, Ethernet33
    172.22.0.50  f012.3118.c09dvlan1000, Port-Channel1
    172.22.0.60  00e1.d11a.a1ebvlan1000, Ethernet5
    172.22.0.70  004f.e320.cd23vlan1000, Ethernet6
    172.22.0.80  0032.48da.f9d9vlan1000, Ethernet37
    172.22.0.90  0018.910a.1fc5vlan1000, Ethernet29
    172.22.0.11 0  0056.cbe9.8510vlan1000, Ethernet26
    
    switch>
  • This command displays ARP cache entries that map MAC addresses to IPv4 addresses. Host names assigned to IP addresses are displayed in place of the address.
    switch>show ip arp resolve
    
    Address Age (min)Hardware Addr Interface
    green-vl101.new         0  004c.6211.021evlan101, Port-Channel2
    172.22.0.10  004c.6214.3699vlan1000, Port-Channel1
    orange-vl1000.n         0  004c.6219.a0f3vlan1000, Port-Channel1
    172.22.0.30  0045.4942.a32cvlan1000, Ethernet33
    purple.newcompa         0  f012.3118.c09dvlan1000, Port-Channel1
    pink.newcompany         0  00e1.d11a.a1ebvlan1000, Ethernet5
    yellow.newcompa         0  004f.e320.cd23vlan1000, Ethernet6
    172.22.0.80  0032.48da.f9d9vlan1000, Ethernet37
    royalblue.newco         0  0018.910a.1fc5vlan1000, Ethernet29
    172.22.0.11 0  0056.cbe9.8510vlan1000, Ethernet26
    
    switch>

ARP Inspection

Address Resolution Protocol (ARP) inspection command ip arp inspection vlan activates a security feature that protects the network from ARP spoofing. ARP requests and responses on untrusted interfaces are intercepted on specified vlans, and intercepted packets are verified to have valid IP-MAC address bindings. All invalid ARP packets are dropped. On trusted interfaces, all incoming ARP packets are processed and forwarded without verification.

Enabling and Disabling ARP Inspection

By default, ARP inspection is disabled on all vlans.

Examples:
  • This command enables ARP inspection on vlans 1 through 150.
    switch(config)#ip arp inspection vlan 1 - 150
    switch(config)#
  • This command disables ARP inspection on vlans 1 through 150.
    switch(config)#no ip arp inspection vlan 1 - 150
    switch(config)#
  • This command sets the ARP inspection default to vlans 1 through 150.
    switch(config)#default ip arp inspection vlan 1 - 150
    switch(config)#
  • These commands enable ARP inspection on multiple vlans 1 through 150 and 200 through 250.
    switch(config)#ip arp inspection vlan 1-150,200-250
    switch(config)#
Syslog for Invalid ARP Packets Dropped

When an invalid ARP packet is dropped, the following syslog message appears. The log severity level can be set higher if required.

%SECURITY-4-ARP_PACKET_DROPPED: Dropped ARP packet on interface Ethernet28/1 vlan 
2121 because invalid mac and ip binding. Received: 00:0a:00:bc:00:de/1.1.1.1. 
Displaying ARP Inspection States

The command show ip arp inspection vlan displays the configuration and operation state of ARP inspection. For a vlan range specified by show ip arp inspection vlan only vlans with ARP inspection enabled will be displayed. If no vlan is specified, all vlans with ARP inspection enabled are displayed. The operation state turns to Active when hardware is ready to trap ARP packets for inspection.

Example:
This command displays the configuration and operation state of ARP inspection for vlans 1 through 150.
switch(config)#show ip arp inspection vlan 1 - 150

vlan 1
----------
Configuration
: Enabled
Operation State : Active
vlan 2
----------
Configuration
: Enabled
Operation State : Active
{...}
vlan 150
----------
Configuration
: Enabled
Operation State : Active

switch(config)#
Displaying ARP Inspection Statistics

The command show ip arp inspection statistics displays the statistics of inspected ARP packets. For a vlan specified by show ip arp inspection vlan only vlans with ARP inspection enabled will be displayed. If no vlan is specified, all vlans with ARP inspection enabled are displayed.

The command clear arp inspection statistics clears ARP inspection.

Examples:
  • This command displays ARP inspection statistics for vlan 1.
    switch(config)#show ip arp inspection statistics vlan 2
    
    vlan : 2
    ------------
    ARP Req Forwarded = 20
    ARP Res Forwarded = 20
    ARP Req Dropped = 1
    ARP Res Dropped = 1
    
    Last invalid ARP:
    Time: 10:20:30 ( 5 minutes ago )
    Reason: Bad IP/Mac match
    Received on: Ethernet 3/1
    Packet:
      Source MAC: 00:01:00:01:00:01
      Dest MAC: 00:02:00:02:00:02
      ARP Type: Request
      ARP Sender MAC: 00:01:00:01:00:01
      ARP Sender IP: 1.1.1
    
    switch(config)#
  • This command displays ARP inspection statistics for Ethernet interface 3/1.
    switch(config)#show ip arp inspection statistics ethernet interface 3/1
    
    Interface : 3/1
    --------
    ARP Req Forwarded = 10
    ARP Res Forwarded = 10
    ARP Req Dropped = 1
    ARP Res Dropped = 1
    
    Last invalid ARP:
    Time: 10:20:30 ( 5 minutes ago )
    Reason: Bad IP/Mac match
    Received on: vlan 10
    Packet:
      Source MAC: 00:01:00:01:00:01
      Dest MAC: 00:02:00:02:00:02
      ARP Type: Request
      ARP Sender MAC: 00:01:00:01:00:01
      ARP Sender IP: 1.1.1
    
    switch(config)#
  • This command clears ARP inspection statistics.
    switch(config)#clear arp inspection statistics
    switch(config)#
Configure Trust Interface

By default, all interfaces are untrusted. The command ip arp inspection trust configures the trust state of an interface.

Examples:
  • This command configures the trust state of an interface.
    switch(config)#ip arp inspection trust
    switch(config)#
  • This command configures the trust state of an interface to untrusted.
    switch(config)#no ip arp inspection trust
    switch(config)#
  • This command configures the trust state of an interface to its default (untrusted).
    switch(config)#default ip arp inspection trust
    switch(config)#
Configure Rate Limit

When ARP inspection is enabled, ARP packets are trapped to the CPU. Two actions can be taken when the incoming ARP rate exceeds expectation. For notification purpose, the command ip arp inspection logging will enable logging of the incoming ARP packets. To prevent a denial-of-service attack, the command ip arp inspection limit will error-disable interfaces.

Examples:
  • This command enables logging of incoming ARP packets when its rate exceeds the configured value, and sets the rate to 2048 (which is the upper limit for the number of invalid ARP packets allowed per second), and sets the burst consecutive interval over which the interface is monitored for a high ARP rate to 15 seconds.
    switch(config)#ip arp inspection logging rate 2048 burst interval 15
    switch(config)#
  • This command configures the rate limit of incoming ARP packets to errdisable the interface when the incoming ARP rate exceeds the configured value, sets the rate to 512 (which is the upper limit for the number of invalid ARP packets allowed per second), and sets the burst consecutive interval over which the interface is monitored for a high ARP rate to 11 seconds.
    switch(config)#ip arp inspection limit rate 512 burst interval 11
    switch(config)#
  • This command displays verification of the interface specific configuration.
    switch(config)#interface Ethernet 3 / 1
    switch(config)#ip arp inspection limit rate 20 burst interval 5
    switch(config)#interface Ethernet 3 / 3
    switch(config)#ip arp inspection trust
    switch(config)#show ip arp inspection interfaces
    
     Interface      Trust State  Rate (pps) Burst Interval
     -------------  -----------  ---------- --------------
     Et3/1          Untrusted    20         5
     Et3/3          Trusted      None       N/A
    
    switch(config)#
Configure Errdisable Caused by ARP Inspection

If the incoming ARP packet rate on an interface exceeds the configured rate limit in burst interval, the interface will be errdisabled (by default). If errdisabled, the interface will stay in this state until you intervene with the command errdisable detect cause arp-inspection (e.g., after you perform a shutdown or no shutdown of the interface) or it automatically recovers after a certain time period. The command errdisable recovery cause arp-inspection will enable auto recovery. The command errdisable recovery interval will enable sharing the auto recovery interval among all errdisable interfaces. (See the chapter “Data Transfer” for information on all errdisable commands.

Examples:
  • This command enables errdisable caused by an ARP inspection violation.
    switch(config)#errdisable detect cause arp-inspection
    switch(config)#
  • This command disables errdisable caused by an ARP inspection violation.
    switch(config)#no errdisable detect cause arp-inspection
    switch(config)#
  • This command enables auto recovery.
    switch(config)#errdisable recovery cause arp-inspection
    switch(config)#
  • This command disables auto recovery.
    switch(config)#no errdisable recovery cause arp-inspection
    switch(config)#
  • This command enables sharing the auto recovery interval of 10 seconds among all errdisable interfaces.
    switch(config)#errdisable recovery interval 10
    switch(config)#
  • This command disables sharing the auto recovery interval of 10 seconds among all errdisable interfaces.
    switch(config)#no errdisable recovery interval 10
    switch(config)#
  • This command displays the reason for a port entering the errdisable state.
    switch(config)#show interfaces status errdisabled
    
    Port         Name         Status       Reason
    ------------ ------------ ------------ ---------------
    Et3/2                   errdisabled  arp-inspection
    
    switch(config)#
Configure Static IP MAC Binding

The ARP inspection command ip source binding allows users to add static IP-MAC binding. If enabled, ARP inspection verifies incoming ARP packets based on the configured IP-MAC bindings. The static IP-MAC binding entry can only be configured on Layer 2 ports. By default, there is no binding entry on the system.

Examples:
  • This command configures static IP-MAC binding for IP address 127.0.0.1, MAC address 0001.0001.0001, vlan 1, and Ethernet interface slot 4 and port 1.
    switch(config)#ip source binding 127.0.0.1 0001.0001.0001 vlan 1 interface 
    ethernet 4/1
    switch(config)#
  • This command configures static IP-MAC binding for IP address 127.0.0.1, MAC address 0001.0001.0001, vlan 1, and port-channel interface 20.
    switch(config)#ip source binding 127.0.0.1 0001.0001.0001 vlan 1 interface 
    port-channel 20
    switch(config)#
  • This command displays the configured IP-MAC binding entries. Note that the Lease column is mainly used for displaying dynamic DHCP snooping binding entries. For static binding entries, lease time is shown as infinite.
    switch(config)#show ip source binding 127.0.0.1 0001.0001.0001 static vlan 1 
    interface port-channel 20
    
    MacAddress      IpAddress   Lease(sec)  Type   vlan  Interface
    --------------- ----------- ----------- ------ ----- --------------
    0001.0001.0001  127.0.0.1 infinite    static 1     Port-Channel20
    
    switch(config)#

IPv4 Routing

Internet Protocol version 4 (IPv4) is a communications protocol used for relaying network packets across a set of connected networks using the Internet Protocol suite. Routing transmits network layer data packets over connected independent subnets. Each subnet is assigned an IP address range and each device on the subnet is assigned an IP address from that range. The connected subnets have IP address ranges that do not overlap.

A router is a network device that connects multiple subnets. Routers forward inbound packets to the subnet whose address range includes the packets’ destination address. IPv4 and IPv6 are internet layer protocols that define packet-switched internetworking, including source-to-destination datagram transmission across multiple networks.

These sections describe IPv4 routing and route creation options:

Enabling IPv4 Routing

When IPv4 routing is enabled, the switch attempts to deliver inbound packets to destination IPv4 addresses by forwarding them to interfaces or next hop addresses specified by the forwarding table.

The ip routing command enables IPv4 routing.

Example:

This command enables IP routing:

switch(config)#ip routing
switch(config)#

Static and Default IPv4 Routes

Static routes are entered through the CLI and are typically used when dynamic protocols are unable to establish routes to a specified destination prefix. Static routes are also useful when dynamic routing protocols are not available or appropriate. Creating a static route associates a destination IP address with a local interface. The routing table refers to these routes as connected routes that are available for redistribution into routing domains defined by dynamic routing protocols.

The ip route command creates a static route. The destination is a network segment; the nexthop is either an IP address or a routable interface port. When multiple routes exist to a destination prefix, the route with the lowest administrative distance takes precedence.

By default, the administrative distance assigned to static routes is 1. Assigning a higher administrative distance to a static route configures it to be overridden by dynamic routing data. For example, a static route with a distance value of 200 is overridden by OSPF intra-area routes, which have a default distance of 110.

A route tag is a 32-bit number that is attached to a route. Route maps use tags to filter routes. Static routes have a default tag value of 0.

Example:
This command creates a static route:
switch(config)#ip route 172.17.252.0/24 vlan 500
switch(config)#

Creating Default IPv4 Routes

The default route denotes the packet forwarding rule that takes effect when no other route is configured for a specified IPv4 address. All packets with destinations that are not established in the routing table are sent to the destination specified by the default route.

The IPv4 destination prefix is 0.0.0.0/0 and the next-hop is the default gateway.

Example:
This command creates a default route and establishes 192.14.0.4 as the default gateway address:
switch(config)#ip route 0.0.0.0/0 192.14.0.4
switch(config)#

Dynamic IPv4 Routes

Dynamic routes are established by dynamic routing protocols. These protocols also maintain the routing table and modify routes to adjust for topology or traffic changes. Routing protocols assist the switch in communicating with other devices to exchange network information, maintaining routing tables, and establishing data paths.

The switch supports these dynamic IPv4 routing protocols:

Viewing IPv4 Routes and Network Components

Displaying the FIB and Routing Table

The show ip route command displays routing table entries that are in the forwarding information base (FIB), including static routes, routes to directly connected networks, and dynamically learned routes. Multiple equal-cost paths to the same prefix are displayed contiguously as a block, with the destination prefix displayed only on the first line.

The show running-config command displays configured commands not in the FIB. Theshow ip route summary command displays the number of routes, categorized by source, in the routing table.

Examples:
  • This command displays IP routes learned through BGP.
    switch>show ip route bgp
    
    Codes: C - connected, S - static, K - kernel,
     O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
     E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
     N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
     R - RIP, A - Aggregate
    
     B E170.44.48.0/23 [20/0] via 170.44.254.78
     B E170.44.50.0/23 [20/0] via 170.44.254.78
     B E170.44.52.0/23 [20/0] via 170.44.254.78
     B E170.44.54.0/23 [20/0] via 170.44.254.78
     B E170.44.254.112/30 [20/0] via 170.44.254.78
     B E170.53.0.34/32 [1/0] via 170.44.254.78
     B I170.53.0.35/32 [1/0] via 170.44.254.2
     via 170.44.254.13
     via 170.44.254.20
     via 170.44.254.67
     via 170.44.254.35
     via 170.44.254.98
    
    switch>
  • This command displays a summary of routing table contents.
    switch>show ip route summary
    
    Route Source Number Of Routes
    -------------------------------------
    connected 15
    static 0
    ospf74
    Intra-area: 32 Inter-area:33 External-1:0 External-2:9
    NSSA External-1:0 NSSA External-2:0
    bgp7
    External: 6 Internal: 1
    internal45
    attached18
    aggregate0
    
    switch>

Displaying the IP Route Age

The show ip route age command displays the time when the route for the specified network was present in the routing table. It does not account for the changes in parameters like metric, next-hop etc.

Example:
This command displays the amount of time since the last update to ip route 172.17.0.0/20.
switch>show ip route 172.17.0.0/20 age

Codes: C - connected, S - static, K - kernel,
 O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
 E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
 N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
 R - RIP, I - ISIS, A - Aggregate

 B E172.17.0.0/20 via 172.25.0.1, age 3d01h

switch>

Displaying Gateways

A gateway is a router that provides access to another network. The gateway of last resort, also known as the default route, is the route that a packet uses when the route to its destination address is unknown. The IPv4 default route in is 0.0.0.0/0.

The show ip route gateway command displays IP addresses of all gateways (next hops) used by active routes.

Example:
This command displays next hops used by active routes.
switch>show ip route gateway

The following gateways are in use:
 172.25.0.1 vlan101
 172.17.253.2 vlan2000
 172.17.254.2 vlan2201
 172.17.254.11 vlan2302
 172.17.254.13 vlan2302
 172.17.254.17 vlan2303
 172.17.254.20 vlan2303
 172.17.254.66 vlan2418
 172.17.254.67 vlan2418
 172.17.254.68 vlan2768
 172.17.254.29 vlan3020

switch>

Displaying Host Routes

The show ip route host command displays all host routes in the host forwarding table. Host routes are those whose destination prefix is the entire address (mask = 255.255.255.255 or prefix = /32). Each displayed host route is labeled with its purpose:

  • F static routes from the FIB.
  • R routes defined because the IP address is an interface address.
  • B broadcast address.
  • A routes to any neighboring host for which the switch has an ARP entry.
Example:
This command displays all host routes in the host forwarding table.
switch#show ip route host

R - receive B - broadcast F - FIB, A - attached

F 127.0.0.1 to cpu
B 172.17.252.0 to cpu
A 172.17.253.2 on vlan2000
R 172.17.253.3 to cpu
A 172.17.253.10 on vlan2000
R 172.17.254.1 to cpu
A 172.17.254.2 on vlan2901
B 172.17.254.3 to cpu
B 172.17.254.8 to cpu
A 172.17.254.11 on vlan2902
R 172.17.254.12 to cpu

F 172.26.0.28 via 172.17.254.20 on vlan3003
via 172.17.254.67 on vlan3008
via 172.17.254.98 on vlan3492
via 172.17.254.86 on vlan3884
via 172.17.253.2 on vlan3000
F 172.26.0.29 via 172.25.0.1 on vlan101
F 172.26.0.30 via 172.17.254.29 on vlan3910
F 172.26.0.31 via 172.17.254.33 on vlan3911
F 172.26.0.32 via 172.17.254.105 on vlan3912

switch#

IPv4 Multicast Counters

IPv4 multicast counters allow association of IPv4 multicast routes with a packet or byte counter.

This chapter contains the following sections.

Multicast Counters Hardware Overview

This section describes a hardware overview for multicast counters, and contains the following sections.

Platform Independent Requirements for Counters

The following platform independent requirements include:

  • Enable/Disable counters
  • Clear counters
  • Show counters
  • Configure counter mode for byte (default) or frame mode

Policer Counter Overview

The switch hardware has two policer banks, each with 4k entries and each entry has one 32 bit entry1, and one 32 bit entry2, which can be used as either packet counter or byte counter.

In the pipeline, each bank can have one policer index coming from upstream blocks, which means different features cannot update multiple policer entries in the same bank simultaneously. Therefore, different features cannot share entries in the same bank.

In switch hardware routing, each FFU/BST entry points to a corresponding RAM. A policer index is saved in the action ram, so when installing a multicast route into hardware, platform code will get a policer index and saved in the action field. If a policer index is unavailable, a counter is not added to the action field.

Switch hardware can have multiple features competing for the policer banks. It is desirable to have a platform command to reserve policer banks dedicated for a certain feature.

The following command reserves one or two policer banks to be used only by the named feature:

[no] platform fm6000 [nat | acl | qos | multicast] policer banks <1|2>

Available bank(s) are reserved for the feature. Otherwise the command takes effect at the next reboot or FocalPointV2 agent restart. This reservation guarantees the configured number of bank(s) for this feature. However, the feature can still possibly obtain the other policer bank if it needs more, and the other bank is available.

If a feature has a pending reservation request which is not fulfilled because of availability, and some other feature frees a bank, the bank will be allocated to the pending feature.

BGP Functions Supported for Arista Switches

Arista switches support these BGP functions:

  • A single BGP instance
  • Simultaneous internal (IBGP) and external (EBGP) peering
  • Multiprotocol BGP
  • BGP Confederations

Additional Requirements

On switch hardware, the following additional requirements include:

  • Reservation of policer banks
  • Notification of policer bank availability when a policer entry is freed by other features

Multicast Counters iBGP and eBGP Configuration

This section describes the commands required to configure an iBGP and an eBGP topology, and contains the following sections.

Policer Usage

There are two types of counters – those created by wildcard creation and by specific creation. When a specific counter is required and the hardware runs out of policer entries, a wildcard counter is forced to give up its policer entry.

If the user configures a specific counter and the starter group (SG) already has a wildcard-created counter for it, then this counter is upgraded to a specific one, with no change in hardware policer index. If the user configures both a wildcard counter and specific counter for this SG, and subsequently deletes the specific counter, the counter for this SG is downgraded to a wildcard, with no change in hardware policer index. However, if another specific counter is pending for a hardware policer index, then this policer entry will be assigned to that counter due to its higher precedence.

Even if a counter is configured by the user, in order to conserve the use of hardware resources, we should not allocate a policer entry until a real route (G, S) is programmed into the frame filtering and forwarding unit (FFU).

Configuring IPv4 Multicast Counters

Perform the following CLI steps to configure IPv4 multicast counters on the FM6000 platform:

  1. Execute the global configuration command:
    • no | default ip multicast count bytes | packets

    Enables wildcard counters. Also used to change bytes / packets mode. When hardware runs of resources, specific creation has priority to preempt counters from wildcard creation. The bytes | packets optional keyword enables the counter to be in either bytes mode or packets mode. This mode applies to all counters. When the counter mode changes, all counter values will be reset to zero.

    • no | default ip multicast count<G> <S>

    This is only takes affect when ip multicast count is enabled. Either <G, S> or bytes | packets optional keyword is used. They can not be used concurrently.

    No | default Commands: (default is same as no)

    • no ip multicast count Deletes all multicast counters, including explicit <G> <S> routes

      • no ip multicast count <G> <S> Removes the config. Does not delete the counter because the wildcard is still active.

        • If no <G, S> is specified, all multicast routes will have counters unless the hardware runs out of resources. The creation of counters is referred to as “wildcard creation.”
        • If <G, S> is specified, only <G, S> will get a counter (and no other route). The creation of counters is referred to as “specific creation.” By default, all mcast routes will have counters allocated. This <G, S> configuration is applicable when the hardware runs out of resources. Specific <G, S> creation has priority to preempt counters from wildcard creation.

    The byte | frame optional keyword enables the counter to be in either byte mode or frame mode. This mode applies to all counters. When the counter mode changes, all counter values will be reset to zero.

    Either <G, S>, or byte | frame optional keywords are used but cannot be used together. All counters are byte | frame. The byte | frame mode is global, and not applicable on a <G, S> basis.

  2. Execute clear command:
    • clear ip multicast count <G> <S>
  3. Execute show command:
    • show multicast fib ipv4 <G> count

    This command currently exists but does not show anything.

    This show command is intended to display the following (example):

    switch>show multicast fib ipv4 count
    Activity poll time: 60 seconds 
    225.1.1.1 100.0.0.2
    Byte: 123
    vlan100 (iif)
    vlan200
    Activity 0:00:47 ago

    Total counts is the sum of counts from all sources in that group.

    The count value can be N/A if a mroute does not have an associated counter.

    If the count value for any source in a <G> is N/A, then the total counts for <G> will be shown as N/A. However, the count values for other sources are still shown.

Route Management

When routing is enabled, the switch discovers the best route to a packet’s destination address by exchanging routing information with other devices. IP routing is disabled by default.

The following sections describes routing features that the switch supports:

Route Redistribution

Route redistribution is the advertisement, into a dynamic routing protocol’s routing domain, of connected (static) routes or routes established by other routing protocols. By default, the switch advertises only routes in a routing domain that are established by the protocol that defined the domain.

Route redistribution commands specify the scope of the redistribution action. By default, all routes from a specified protocol (or all static routes) are advertised into the routing domain. Commands can also filter routes by applying a route map, which defines the subset of routes to be advertised.

Equal Cost Multipath Routing (ECMP) and Load Sharing

Equal cost multi-path (ECMP) is a routing strategy where traffic is forwarded over multiple paths that have equal routing metric values.

Configuring ECMP (IPv4)

All ECMP paths are assigned the same tag value; commands that change the tag value of a path also change the tag value of all paths in the ECMP route.

In a network topology using ECMP routing, hash polarization may result when all switches perform identical hash calculations. Hash polarization leads to uneven load distribution among the data paths. Hash polarization is avoided when switches use different hash seeds to perform hash calculations.

The ip load-sharing command provides the hash seed to an algorithm that the switch uses to distribute data streams among multiple equal-cost routes to a specified subnet.

Example:
This command sets the IPv4 load sharing hash seed to 20:
switch(config)#ip load-sharing fm6000 20
switch(config)#

Multicast Traffic Over ECMP

The switch attempts to spread outbound unicast and multicast traffic to all ECMP route paths equally. To disable the sending of multicast traffic over ECMP, use the multipath none command or the no version of the multipath deterministic command.

Resilient ECMP

Resilient ECMP is used for those prefixes where it is not desirable for routes to be rehashed due to link flap, typically where ECMP is being used for load balancing. Resilient ECMP configures a fixed number of next-hop entries in the hardware ECMP table for all the routes within a specified IP address prefix. Implementing fixed table entries for a specified next-hop address allows data flows that are hashed to a valid next-hop number to remain intact even when some of the next hops go down or come back online.

Resilient ECMP is enabled for all routes within a specified prefix using the ip hardware fib ecmp resilience command. The command specifies the maximum number of next-hop addresses that the hardware ECMP table can contain for the specified IP prefix, and configures a redundancy factor that facilitates the duplication of next-hop addresses in the table. The fixed table space for the address is the maximum number of next hops multiplied by the redundancy factor. When the table contains the maximum number of next-hop addresses, the redundancy factor specifies the number of times each address is listed in the table. When the table contains fewer than the maximum number of next-hop addresses, the table space entries are filled by additional duplication of the nexthop addresses.

Resilient ECMP is also available for IPv6 IP addresses.

Example:
This command configures a hardware ECMP table space of 24 entries for the IP address 10.14.2.2/24. A maximum of six next-hop addresses can be specified for the IP address. When the table contains six next-hop addresses, each appears in the table four times. When the table contains fewer than six next-hop addresses, each is duplicated until the 24 table entries are filled.
switch(config)#ip hardware fib ecmp resilience 10.14.2.2/24 capacity 6 redundancy 4
switch(config)#

Unicast Reverse Path Forwarding (uRPF)

Unicast Reverse Path Forwarding (uRPF) verifies the accessibility of source IP addresses in packets that the switch forwards. The switch drops a packet when uRPF determines that the routing table does not contain an entry with a valid path to that packet’s source IP address.

IPv4 and IPv6 uRPF operate independently. uRPF is VRF aware. Commands that do not specify a VRF utilize the default instance. Multicast routing is not affected by uRPF.

uRPF defines two operational modes: strict mode and loose mode.

  • Strict mode: uRPF also verifies that a packet is received on the interface that its routing table entry will use for its return packet.
  • Loose mode: uRPF validation does not consider the inbound packet’s ingress interface.

uRPF Operation

uRPF is configurable on interfaces. For packets arriving on a uRPF-enabled interfaces, the source IP address is verified by examining the source and destination addresses of unicast routing table entries.

uRPF requires a reconfigured routing table to support IP address verification. When uRPF is enabled for the first time, unicast routing is briefly disabled to facilitate the routing table reconfiguration. Multicast routing is not affected by the initial uRPF enabling.

A packet fails uRPF verification if the table does not contain an entry whose source or destination address matches the packet’s source IP address. In strict mode, the uRPF also fails when the matching entry’s outbound interface does not match the packet’s ingress interface.

uRPF verification is not available for the following packets:

  • DHCP (Source is 0.0.0.0 – Destination is 255.255.255.255)
  • IPv6 link local (FE80::/10)
  • Multicast packets
ECMP uRPF

When verifying ECMP routes, strict mode checks all possible paths to determine that a packet is received on the correct interface. Strict mode is supported for ECMP groups with a maximum of eight routing table entries. The switch reverts to loose mode for ECMP groups that exceed eight entries.

Default Routes

uRPF strict mode provides an allow-default option that accepts default routes. On interfaces that enable allow-default and a default route is defined, uRPF strict mode validates a packet even when the routing table does not contain an entry that matches the packet’s source IP address. When allow-default is not enabled, uRPF does not consider the default route when verifying an inbound packet.

Null Routes

NULL0 routes drop traffic destined to a specified prefix. When uRPF is enabled, traffic originating from a null route prefixes is dropped in strict and loose modes.

uRPF Configuration

Unicast Reverse Path Forwarding (uRPF) is enabled for IPv4 packets ingressing the configuration mode interface through theip verify command.

Note: uRPF cannot be enabled on interfaces with ECMP member FECs.
Examples:
  • This command enables uRPF loose mode on vlan interface 17.
    switch(config)#interface vlan 17
    switch(config-if-Vl17)#ip verify unicast source reachable-via any
    switch(config-if-Vl17)#show active
     interface vlan17
     ip verify unicast source reachable-via any
    switch(config-if-Vl17)#
  • This command enables uRPF strict mode on vlan interface 18.
    switch(config)#interface vlan 18
    switch(config-if-Vl18)#ip verify unicast source reachable-via rx
    switch(config-if-Vl18)#show active
     interface vlan18
     ip verify unicast source reachable-via rx
    switch(config-if-Vl18)#

Routing Tables / Virtual Routing and Forwarding (VRF)

An IP routing table is a data table that lists the routes to network destinations and metrics (distances) associated with those routes. A routing table is also known as a routing information base (RIB).

Virtual Routing and Forwarding (VRF) allows traffic separation by maintaining multiple routing tables. Arista switches support multiple VRF instances: one global or default VRF called “default” and multiple user-defined VRFs; the number of user-defined VRFs supported varies by platform. VRFs can be used as management or data plane VRFs.

  • Management VRFs have routing disabled. They are typically used for management-related traffic.
  • Dataplane VRFs have routing enabled. They support routing protocols and packet forwarding (hardware and software).

Dataplane VRFs are supported by Trident, FM6000, and Arad platform switches.

VRFs support unicast IPv4 and IPv6 traffic and multicast traffic. Loopback, SVI, and routed ports may be added to VRFs. Management ports may be added without any hardware forwarding.

To allow overlap in the sets of IP addresses used by different VRF instances, a route distinguisher (RD) may be prepended to each address. RDs are defined in RFC 4364.

Default VRF

The default VRF on Arista switches is called “default.” It is created automatically and cannot be renamed or configured. Some configuration options accept “default” as a VRF input.

 

User-Defined VRFs

A user-defined VRF is created with the vrf instance command. After its creation, a VRF may be assigned a route distinguisher (RD) with the rd (VRF configuration mode) command in the VRF submode of Router-BGP Configuration Mode.

Examples:
  • These commands create a VRF named “purple,” place the switch in BGP VRF configuration mode for that VRF, and specify a route distinguisher for the VRF identifying the administrator as AS 530 and assigning 12 as its local number.
    switch(config)#vrf instance purple
    switch(config-vrf-purple)#router bgp 50
    switch(config-router-bgp)#vrf purple
    switch(config-router-bgp-vrf-purple)#rd 530:12
    switch(config-router-bgp-vrf-purple)#
  • To add interfaces to a user-defined VRF, enter configuration mode for the interface and use the vrf (Interface mode) command. Loopback, SVI, and routed ports can be added to a VRF.
    These commands add vlan 20 to the VRF named “purple.”
    switch(config)#interface vlan 20
    switch(config-if-Vl20)#vrf purple
    switch(config-if-Vl20)#
  • The show vrf command shows information about user-defined VRFs on the switch.
    This command displays information for the VRF named “purple”.
    switch>show vrf purple
    Vrf         RD             Protocols      State        Interfaces
    ----------- -------------- -------------- -------------- ------------
    purple      64496:237      ipv4           no routing    vlan42, vlan43
    
    switch>

Context-Active VRF

The context-active VRF specifies the default VRF that VRF-context aware commands use when displaying or refreshing routing table data.

VRF-context aware commands include:

The cli vrf command specifies the context-active VRF.

Example:
This command specifies magenta as the context-active VRF.
switch#cli vrf magenta
switch#show routing-context vrf
Current VRF routing-context is magenta

The show routing-context vrfcommand displays the context-active VRF.

Example:
This command displays the context-active VRF.
switch>show routing-context vrf
Current VRF routing-context is magenta

switch>

RIB Route Control

The routing database (RIB) is composed of the routing information learned by the routing protocols, including static routes. The forwarding database (FIB) is composed of the routes actually used to forward traffic through a router.

Forwarding Information Base (FIB) makes IP destination prefix-based switching decisions. The FIB is similar to a routing table or information base. It maintains the forwarding information for the winning routes from the RIB. When routing or topology changes occur in the network, the IP routing table information is updated, and those changes are reflected in the FIB.

Configuring FIB policy

The RIB calculates the best/winning routes to each destination and place these routes in the forwarding table. Based on the FIB policy configured the best routes are advertised.

For example, a FIB policy can be configured to deny the routes for FIB programming, however, it does not prevent these routes from being advertised by a routing protocol, or to be redistributed into another routing domain, or to be used for recursive resolution in the IP RIB. FIB policies control the size and content of the routing tables, and the best route to take to reach a destination.

The rib ipv4 | ipv6 fib policy command is used to enable FIB policy for a particular VRF under router general configuration mode.

The following match statements are supported:

  • match interface
  • match { ip | ipv6 } address prefix-list
  • match { ip | ipv6 } resolved-next-hop prefix-list
  • match isis level
  • match metric
  • match source-protocol
Example:
The following example enables FIB policy for IPv4 in the default VRF, using the route map, map1.
switch(config)#router general
switch(config-router-general)#vrf default 
switch(config-router-general-vrf-default)#rib ipv4 fib policy map1

Displaying FIB Information

Use the show rib route <ipv4 | ipv6> fib policy excludecommand to display the RIB information. The fib policy exclude option displays the RIB routes that have been excluded from being programmed into FIB, by FIB policy.

Example:
The following example displays the routes filtered by FIB policy using the fib policy excluded option of the show rib route ip|ipv6 command.
switch#show rib route ipv6 fib policy excluded
switch#show rib route ip bgp fib policy excluded

VRF name: default, VRF ID: 0xfe, Protocol: bgp
Codes: C - Connected, S - Static, P - Route Input
 B - BGP, O - Ospf, O3 - Ospf3, I - Isis
 > - Best Route, * - Unresolved Nexthop
 L - Part of a recursive route resolution loop
>B10.1.0.0/24 [200/0]
 via 10.2.2.1 [115/20] type tunnel
via 10.3.5.1, Ethernet1
 via 10.2.0.1 [115/20] type tunnel
via 10.3.4.1, Ethernet2
via 10.3.6.1, Ethernet3 
>B10.1.0.0/24 [200/0]
 via 10.2.2.1 [115/20] type tunnel
via 10.3.5.1, Ethernet1
 via 10.2.0.1 [115/20] type tunnel 
via 10.3.4.1, Ethernet2
via 10.3.6.1, Ethernet3 

Displaying RIB Route Information

Use the show rib route ip command to view the IPv4 RIB information.

Example:

This command displays IPv4 RIB static routes.

switch#show rib route ip static

VRF name: default, VRF ID: 0xfe, Protocol: static
Codes: C - Connected, S - Static, P - Route Input
 B - BGP, O - Ospf, O3 - Ospf3, I - Isis
 > - Best Route, * - Unresolved Nexthop
 L - Part of a recursive route resolution loop
>S10.80.0.0/12 [1/0]
 via 172.30.149.129 [0/1]
via Management1, directly connected
>S172.16.0.0/12 [1/0]
 via 172.30.149.129 [0/1]
via Management1, directly connected

switch#

IPv4 Route Scale

IPv4 routes are optimized to achieve route scale when route distribution has a large number of routes of one or two parameters, with each parameter consisting of prefix lengths 12, 16, 20, 24, 28, and 32. If two separate prefix lengths are configured (in any order), one of them must be the prefix length of 32.

Note: IPv4 Route Scale cannot be used with AlgoMatch.

The following sections describes IPv4 route scale configuration, show commands, and system log messages:

Configuring IPv4 Route Scale

IPv4 route scale is enabled by theip hardware fib optimize command for the configuration mode interface. The platform Layer 3 agent is restarted to ensure IPv4 routes are optimized with the agent SandL3Unicast terminate command for the configuration mode interface.

Example:
This configuration command allows configuring prefix lengths 12 and 32.
switch(config)#ip hardware fib optimize exact-match prefix-length 12 32
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

One of the two prefixes in this command is a prefix-length of 32, which is required in the instance where there are two prefixes. For this command to take effect, the platform Layer 3 agent must be restarted.

Example:
This configuration command restarts the platform Layer 3 agent to ensure IPv4 routes are optimized.
switch(config)#agent SandL3Unicast terminate
SandL3Unicast was terminated

Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.

Example:
This configuration command allows configuring prefix lengths 32 and 16.
switch(config)#ip hardware fib optimize exact-match prefix-length 32 16
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

One of the two prefixes in this command is a prefix-length of 32, which is required in the instance where there are two prefixes. For this command to take effect, the platform Layer 3 agent must be restarted.

Examples:
  • This configuration command restarts the platform Layer 3 agent to ensure IPv4 routes are optimized.
    switch(config)#agent SandL3Unicast terminate
    SandL3Unicast was terminated

    Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.

  • This configuration command allows configuring prefix length 24.
    switch(config)#ip hardware fib optimize exact-match prefix-length 24
    ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
    

In this instance, there is only one prefix-length, so a prefix-length of 32 is not required. For this command to take effect, the platform Layer 3 agent must be restarted.

Examples:
  • This configuration command restarts the platform Layer 3 agent to ensure IPv4 routes are optimized.
    switch(config)#agent SandL3Unicast terminate
    SandL3Unicast was terminated

    Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.

  • This configuration command allows configuring prefix length 32.
    switch(config)#ip hardware fib optimize exact-match prefix-length 32
    ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
    

    For this command to take effect, the platform Layer 3 agent must be restarted.

  • This configuration command restarts the platform Layer 3 agent to ensure IPv4 routes are optimized.
    switch(config)#agent SandL3Unicast terminate
    SandL3Unicast was terminated

    Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.

  • This configuration command disables configuring prefix lengths 12 and 32.
    switch(config)#no ip hardware fib optimize exact-match prefix-length 12 32
    ! Please restart layer 3 forwarding agent to ensure IPv4 routes are not optimized
    

One of the two prefixes in this command is a prefix-length of 32, which is required in the instance where there are two prefixes. For this command to take effect, the platform Layer 3 agent must be restarted.

Examples:
  • This configuration command restarts the platform Layer 3 agent to ensure IPv4 routes are not optimized.
    switch(config)#agent SandL3Unicast terminate
    SandL3Unicast was terminated

    Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.

  • This configuration command attempts to configure prefix length 20 and 28 which triggers an error exception. One of the two prefixes in this command must be a prefix-length of 32, which is required in the instance where there are two prefixes.
    switch(config)#ip hardware fib optimize exact-match prefix-length 20 28
    % One of the prefix lengths must be 32

IPv4 Routescale with 2-to-1 Compression

The IPv4 routescale with2-to-1 compression optimizes certain prefix lengths and enhances the route scale capabilities on 7500R, 7280R, 7500R2, and 7280R2 platforms. The compression is best suited to achieve route scale when route distribution has a large number of routes of one or two prefix lengths.

Configuring IPv4 Routescale 2-to-1 Compression

Use the compress command to increase the hardware resources available for the specified prefix length. This command allows configuring up to one compressed prefix length, and this command is supported only on 7500R, 7280R, 7500R2, and 7280R2 platforms.
Note: The compress command takes effect only when you restart the platform layer3 agent on 7500R, 7280R, 7500R2, and 7280R2 platforms. Use command agent SandL3Unicast terminate to restart the platform layer3 agent.

Examples

  • In the following example we are configuring prefix length 20 and 24, expanding prefix length 19 and 23, and compressing prefix length 25.
    switch(config)#ip hardware fib optimize prefix-length 20 24 expand 19 23 compress 25
     ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
  • In the following example we are configuring prefix length 20 and 23, expanding prefix length 19, compressing prefix length 24.
    switch(config)#ip hardware fib optimize prefix-length 20 23 expand 19 compress 24
     ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
  • Optionally, you can also use the internet profile to configure the IPv4 route scale compression.
    switch(config)#ip hardware fib optimize prefixes profile internet
     ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

Configure a new TCAM profile for the compress configuration to work, and disable a few features in the new TCAM profile to make space for the flex-route feature in the hardware. Features likeacl vlan ip and the mirror ip have to be disabled, if you need any of these features or any other features to be enabled with flex-route feature, please contact the Arista team.

The internet profile works differently based on whether the flex-route feature is enabled in the TCAM profile or not. If the flex-route feature is enabled, the internet profile behaves likeip hardware fib optimize prefix-length 20 23 expand 19 22 compress 24. If the flex-route feature is disabled, the internet profile behaves as ip hardware fib optimize prefix-length 20 24 expand 19 23.

Example
switch(config)#hardware tcam
switch(config-hw-tcam)#profile flex-route copy default
switch(config-hw-tcam-profile-flex-route)#feature flex-route copy system-feature-source-profile
switch(config-hw-tcam-profile-flex-route-feature-flex-route)#exit
switch(config-hw-tcam-profile-flex-route)#no feature acl vlan ip
switch(config-hw-tcam-profile-flex-route)#no feature mirror ip
switch(config-hw-tcam-profile-flex-route)#exit
Saving new profile 'flex-route'
switch(config-hw-tcam)#system profile flex-route

Troubleshooting

For 2-to-1 compression feature, the problem areas could be in the variations of:

  • FEC could be missing or wrongly computed.
  • LEM entry may not be programmed or incorrect.
  • With the compress configuration enabled:
    • TCAM entry may not be programmed or incorrect.
    • TCAM profile may be incorrectly programmed that generates incorrect TCAM lookup key.

The following commands are used for verification, or to troubleshoot any issues related to 2-to-1 compression feature.

  • Use show platform fap ip route summary command to check the usage of hardware resource of all IPv4 routes. Also, you can check which prefixes are looked up in LEM.
    Example
    switch#show platform fap ip route summary
    Total number of VRFs: 1
    Total number of routes: 25
    Total number of route-paths: 25
    Total number of lem-routes: 4
    Total number of /20 routes in lem: 1
    Total number of /23 routes in lem: 3
  • Use show platform fap fec all to verify if all the FECs.
  • Use show platform fap ip route to verify all IPv4 routes present in the hardware.
    switch#show platform fap ip route
    Tunnel Type: M(mpls), G(gre), MoG(mpls-over-gre),
     vxlan-o(vxlan outer-rewrite info), vxlan-i(vxlan inner-rewrite info)
    * - Routes in LEM
    D - ECMP is divergent across switching chips
     --------------------------------------------------------------------------------------------------
    | Routing Table||
    |--------------------------------------------------------------------------------------------------
    |VRF| Destination| | | | | | ECMP|FEC | Tunnel
    | ID|Subnet| Cmd |Destination| VID |Outlif | MAC / CPU Code|Index| Index|T Value 
    ---------------------------------------------------------------------------------------------------
    |0|50.1.0.0/20*|ROUTE| Et8 |1007 |4094 | 00:12:22:34:44:56 |-|32771 | -
    |0|100.1.0.0/23* |ROUTE| Et3 |1006 |4094 | 00:11:22:33:44:55 |-|32772 | -
    |0|100.1.0.0/23* |ROUTE| Et8 |1007 |4094 | 00:12:22:34:44:56 |-|32771 | -
    |0|150.1.0.0/23* |ROUTE| Et3 |1006 |4094 | 00:11:22:33:44:55 |-|32772 | -
    |0|150.1.0.0/23* |ROUTE| Et8 |1007 |4094 | 00:12:22:34:44:56 |-|32771 | -
    |0|200.1.0.0/23* |ROUTE| Et3 |1006 |4094 | 00:11:22:33:44:55 |-|32772 | -

    All optimized routes in LEM will be marked with a ‘*’ in the output of the above command. In addition, a repeated entry (with different FECs / ECMP FECs) means they are compressed.

  • Use show ip hardware ale routes to check the IPv4 routes in the pre-compressed / pre-expanded form.
    switch#show ip hardware ale routes
    VrfName : default
    ^,*,$,@ - Routes are Optimized
    PrefixType FecIdL2AdjIndex Programmed
    ---------------------------------------------------------------------------------------------------
     *50.1.0.0/20 forwardRoute 4294967313 9True
    *$200.1.1.0/24forwardRoute 4294967312 14 True
    *$200.1.0.0/24forwardRoute 4294967312 14 True
    *$100.1.1.0/24forwardRoute 4294967313 9True
    *$100.1.0.0/24forwardRoute 4294967312 14 True
     *150.1.0.0/23forwardRoute 4294967313 9True
    *@150.1.0.0/24forwardRoute 4294967312 14 True

    All optimized routes in LEM will be marked with a ‘*’ in the output of the above command. In addition, routes marked with a:

    • ‘^’ specifies they are expanded.
    • ‘$’ specifies two sibling prefixes are compressed.
    • ‘@’ specifies one of the sibling prefix is compressed with a parent prefix.
  • Use the show platform fap lem to check LEM contents in the hardware.
    switch#show platform fap lem
    Jericho0 LEM:
    [ 10272 ] = ( type: Ipv4, destIp: 200.1.0.0, vrf: 0 ) -> ( fec: 32772 (0x8004), eei: 98304 (0x18000) )
    [ 24608 ] = ( type: Ipv4, destIp: 150.1.0.0, vrf: 0 ) -> ( fec: 32772 (0x8004), fec2: 32771 (0x8003) )
    [ 49184 ] = ( type: Ipv4, destIp: 50.1.0.0, vrf: 0 ) -> ( fec: 32771 (0x8003), eei: 98304 (0x18000) )
    [ 69664 ] = ( type: Ipv4, destIp: 100.1.0.0, vrf: 0 ) -> ( fec: 32772 (0x8004), fec2: 32771 (0x8003) )

    In the above output, on 7500R, 7280R, 7500R2 and 7280R2 platforms, a compressed route will have two FECs in LEM denoted by “fec” and “fec2”.

  • Use show ip hardware fib diff to check if there are any routes present in the FIB but missing in the hardware, or vice versa.
    switch#show ip hardware fib diff
  • Use show hardware tcam profile to see if configuring the TCAM profile was successful.
    switch(config-hw-tcam)#show hardware tcam profile
     ConfigurationStatus
    FixedSystemflex-route flex-route

    If there was an issue with the configuration of the TCAM profile, the “Status” would show as “ERROR” in the above show command output.

    If the TCAM profile was not configured or there was some error in programming it, and the compress option of this feature is enabled, a syslog SAND_FLEXROUTE_ROUTE_UPDATE_IGNORED would be logged when a route that should have been compressed is encountered by the platform.

  • Use show platform fap tcam summary to check which TCAM bank was allocated to this feature (dbFlexRoute).
    switch#show platform fap tcam summary
     Tcam Allocation (Jericho0)
     Bank Used ByReserved By
    ---------- ------------------------- -----------
    0 dbFlexRoute-
     12 dbSystem6-
     12 dbTunnelTermination-
     12dbSystem-
     12dbMplsSystem-
     13dbEgressSystem-
  • Use platform fap jericho0 diag diag field res to figure out the TCAM lookup key.
    switch#bash cat /var/log/agents/SandFap-* | grep "PMF DB.*dbFlexRoute"
    2018-11-28 13:31:31.0834553075 PmfSm0 PMF DB 22 ( dbFlexRoute )

    In the output of the above command, PMF DB 22 implies Resource DB 22.

Limitations

  • A maximum of two prefix lengths can be optimized directly at any point of time, of which only one can be a non-nibble aligned prefix length. Additional prefix lengths can be optimized using the expand or the compress options.
  • A maximum of 1-to-4 way expansion and 2-to-1 way compression into any optimized prefix length is supported. Multiple expansion prefix lengths can be programmed at any time, however, there can be just one compression prefix length programmed at any given point in time.
  • A maximum of 4096 next-hops can be reliably pointed to by the compressed prefixes using 2-to-1 way compression.
  • The 2-to-1 compression cannot be enabled along with unicast RPF. When both features are enabled together, unicast RPF functionality may not be correct.
  • The flex-route feature in TCAM profiles based only on the default profile, while disabling the acl vlan ip and the mirror ip features. Please contact the Arista team if any other feature, that is not available in the default TCAM profile, is required to be supported along with the flex-route feature, including support for Mirror to GRE tunnel or ACLs on SVI.
  • VXLAN is not supported with the compress option of this feature. There is no syslog or a warning message when VXLAN is configured along with the 2-to-1 way compression feature.

Show Commands

The IPv4 route scale summary is displayed by the show platform arad ip route summary command for the configuration mode interface. Resources for all IPv4 route scale routes are displayed by the show platform arad ip route command for the configuration mode interface.

Examples:
  • This command shows hardware resource usage of IPv4 routes.
    switch(config)#show platform arad ip route summary
    
    Total number of VRFs: 1
    Total number of routes: 25
    Total number of route-paths: 21
    Total number of lem-routes: 4
  • This command shows resources for all IPv4 routes in hardware. Routes that use the additional hardware resources will appear with an asterisk.
    switch(config)#show platform arad ip route
    
    Tunnel Type: M(mpls), G(gre)
    * - Routes in LEM
    ------------------------------------------------------------------------------------------------
    |Routing Table| |
    |------------------------------------------------------------------------------------------------
    |VRF|Destination | | ||Acl| |ECMP | FEC | Tunnel
    |ID |Subnet| Cmd |Destination|VID |Label| MAC / CPU Code|Index|Index|T Value
    ------------------------------------------------------------------------------------------------
    |0|0.0.0.0/8 |TRAP |CoppSystemL3DstMiss|0 | - |ArpTrap|-|1030 | -
    |0|100.1.0.0/32|TRAP |CoppSystemIpBcast|0 | - |BcastReceive |-|1032 | -
    |0|100.1.0.0/32|TRAP |CoppSystemIpUcast|0 | - |Receive|-|32766| -
    |0|100.1.255.255/32|TRAP |CoppSystemIpBcast|0 | - |BcastReceive |-|1032 | -
    |0|200.1.255.255/32|TRAP |CoppSystemIpBcast|0 | - |BcastReceive |-|1032 | -
    |0|200.1.0.0/16|TRAP |CoppSystemL3DstMiss|1007| - |ArpTrap|-|1029 | -
    |0|0.0.0.0/0 |TRAP |CoppSystemL3LpmOver|0 | - |SlowReceive|-|1024 | -
    |0|4.4.4.0/24* |ROUTE|Et10 |1007| - |00:01:00:02:00:03|-|1033 | -
    |0|10.20.30.0/24*|ROUTE|Et9|1006| - |00:01:00:02:00:03|-|1027 | -
    

Syslog

When the number of routes exceed additional hardware resources, the ROUTING_LEM_RESOURCE_FULL syslog message is displayed.

IP Source Guard

IP Source Guard (IPSG) prevents IP spoofing attacks.

IP Source Guard (IPSG) filters inbound IP packets based on their source MAC and IP addresses. IPSG is supported in hardware. IPSG enabled on a Layer 2 port verifies IP packets received on this port. Packets are permitted if each packet source MAC and IP addresses match any of the user-configured IP-MAC binding entries on the receiving vlan and port. Packets with no match are dropped immediately.

Configuring IPSG

IPSG is applicable only to Layer 2 ports, and is enabled by the ip verify sourcecommand for the configuration mode interface. When configured on Layer 3 ports, IPSG does not take effect until this interface is converted to Layer 2.

IPSG is supported on Layer 2 Port-Channels, not member ports. The IPSG configuration on port channels supersedes the configuration on the physical member ports. Therfore, source IP MAC binding entries should be configured on port channels using the ip source binding command. When configured on a port channel member port, IPSG does not take effect until this port is deleted from the port channel configuration.

Examples:
  • These configuration commands exclude vlan IDs 1 through 3 from IPSG filtering. When enabled on a trunk port, IPSG filters the inbound IP packets on all allowed vlans. IP packets received on vlans 4 through 10 on Ethernet 36 will be filtered by IPSG, while those received on vlans 1 through 3 are permitted.
    switch(config)#no ip verify source vlan 1-3
    switch(config)#interface ethernet 36
    switch(config-if-Et36)#switchport mode trunk
    switch(config-if-Et36)#switchport trunk allowed vlan 1-10
    switch(config-if-Et36)#ip verify source
    switch(config-if-Et36)#
  • This configuration command configures source IP-MAC binding entries to IP address 10.1.1.1, MAC address 0000.aaaa.1111, vlan ID 4094, and Ethernet interface 36.
    switch(config)#ip source binding 10.1.1.1 0000.aaaa.1111 vlan 4094 interface ethernet 36
    switch(config)#

Show Commands

The IPSG configuration and operational states and IP-MAC binding entries are displayed by the show ip verify source command for the configuration mode interface.

Examples:
  • This command verifies the IPSG configuration and operational states.
    switch(config)#show ip verify source
    
    Interface       Operational State
    --------------- ------------------------
    Ethernet1       IP source guard enabled
    Ethernet2       IP source guard disabled
  • This command displays all vlans configured in no ip verify source vlan. Hardware programming errors, e.g.,vlan classification failed, are indicated in the operational state. If an error occurs, this vlan will be considered as enabled for IPSG. Traffic on this vlan will still be filtered by IPSG.
    switch(config)#show ip verify source vlan
    
    IPSG disabled on vlanS: 1-2
    vlan            Operational State
    --------------- ------------------------
    1               IP source guard disabled
    2               Error: vlan classification failed
  • This command displays all source IP-MAC binding entries configured for IPSG. A source binding entry is considered active if it is programmed in hardware. IP traffic matching any active binding entry will be permitted. If a source binding entry is configured on an interface or a vlan whose operational state is IPSG disabled, this entry will not be installed in the hardware, in which case an “IP source guard disabled” state will be shown. If a port channel has no member port configured, binding entries configured for this port channel will not be installed in hardware, and a “Port-Channel down” state will be shown.
    switch(config)#show ip verify source detail
    
    Interface     IP Address MAC Address    vlan  State
    ------------- ---------- -------------- ----- -----------------------
    Ethernet1     10.1.1.1   0000.aaaa.11115    active
    Ethernet1     10.1.1.5   0000.aaaa.55551    IP source guard disabled
    Port-Channel1 20.1.1.1   0000.bbbb.1111  4    Port-Channel down
    

DHCP Relay Across VRF

The eos DHCP relay agent supports forwarding of DHCP requests to DHCP servers located in a different VRF to the DHCP client interface VRF. In order to enable VRF support for the DHCP relay agent, Option 82 (DHCP Relay Agent Information Option) must first be enabled. The DHCP relay agent uses Option 82 to pass client specific information to the DHCP server.

These sections describe DHCP Relay across VRF features:

The DHCP relay agent inserts Option 82 information into the DHCP forwarded request, which requires the DHCP server belongs to a network on an interface, and that interface belongs to a different VRF than the DHCP client interface. Option 82 information includes the following:

  • VPN identifier: The VRF name for the ingress interface of the DHCP request, inserted as sub-option 151.

    Table 1. VPN Identifier

    SubOpt

    Len

    ASCII VRF Identifier

    151

    7

    V

    R

    F

    N

    A

    M

    E

  • Link selection: The subnet address of the interface that receives the DHCP request, inserted as sub-option 5. When the DHCP smart relay is enabled, the link selection is filled with the subnet of the active address. The relay agent will set the Gateway IP address (gIPaddr) to its own IP address so that DHCP messages can be routed over the network to the DHCP server.

    Table 2. Link Selection

    SubOpt

    Len

    Subnet IP Address

    5

    4

    A1

    A2

    A3

    A4

  • Server identifier override: The primary IP address of the interface that receives the DHCP request, inserted as sub-option 11. When the DHCP smart relay is enabled, the server identifier is filled with the active address (one of the primary or secondary addresses chosen by smart relay mechanism).

    Table 3. Link Selection

    SubOpt

    Len

    Overriding Server Identifier Address

    11

    4

    B1

    B2

    B3

    B4

  • VSS control suboption as suboption 152: The DHCP server will strip out this suboption when sending the response to the relay, indicating that the DHCP server used VPN information to allocate IP address.

    Note:

    The DHCP server must be capable of handling VPN identifier information in option 82.

Direct communication between DHCP client and server may not be possible as they are in separate VRFs. The Server identifier override and Link Selection sub-options set the relay agent to act as the DHCP server, and enable all DHCP communication to flow through the relay agent.

The relay agent adds all the appropriate sub-options, and forwards all (including renew and release) request packets to the DHCP server. When the DHCP server response messages are received by the relay, Option 82 information is removed and the response is forwarded to the DHCP client in the client VRF.

Global Configuration

The DHCP relay agent information option is inserted in DHCP messages relayed to the DHCP server. The ip helper-address command enables DHCP relay on an interface; and relays DHCP messages to the specified IPv4 address.

Example:

This command enables DHCP relay on the interface Ethernet 1/2; and relays DHCP messages to the server at 1.1.1.1.

switch(config)#interface ethernet 1/2
switch(config-if-Et1/2)#ip helper-address 1.1.1.1
switch(config-if-Et1/2)#

The commands provided in examples below will turn on the attachment of VRF-related tags in the relay agent information option. If both the DHCP client interface and server interface are on the same VRF (default or non-default), then no VRF-related DHCP relay agent information option is inserted.

Examples:
  • This command configures the DHCP relay to add option 82 information.
    switch(config)#ip dhcp relay information option
  • These commands configures two new VRF instances and assign them Route Distinguishers (RDs).
    switch(config)#vrf instance mtxxg-vrf
    switch(config-vrf-mtxxg-vrf)#router bgp 50
    switch(config-router-bgp)#vrf mtxxg-vrf
    switch(config-router-bgp-vrf-mtxxg-vrf)#rd 5546:5546
    switch(config)#vrf instance qchyh-vrf
    switch(config-vrf-qchyh-vrf)#router bgp 50
    switch(config-router-bgp)#vrf qchyh-vrf
    switch(config-router-bgp-vrf-qchyh-vrf)#rd 218:218
  • This command configures an interface connected to DHCP client in vrf mtxxg-vrfand assigns an IP address.
    switch(config)#interface Ethernet 9
    switch(config-if-Et9)#no switchport
  • This command configures the DHCP client interface in VRF mtxxg-vrf.
    switch(config-if-Et9)#vrf mtxxg-vrf
    switch(config-if-Et9)#ip address 10.10.0.1/16
  • This command configures the server interface in VRF qchyh-vrf.
    switch(config-if-Et11)#vrf qchyh-vrf
    switch(config-if-Et11)#ip address 10.40.0.1/16
  • This command configures a helper address for a DHCP server in VRF qchyh-vrf.
    switch(config-if-Et11)#ip helper-address 10.40.2.3 vrf qchyh-vrf

Show Command

Example:

This command displays the VRF specifier for the server:
rtr1#show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is enabled
DHCP Smart Relay is disabled
Interface: Ethernet9
Option 82 Circuit ID: Ethernet9
DHCP Smart Relay is disabled
DHCP servers: 10.40.2.3
10.40.2.3:vrf=qchyh-vrf

TCP MSS Clamping

TCP MSS clamping limits the value of the maximum segment size (MSS) in the TCP header of TCP SYN packets transiting a specified Ethernet or tunnel interface. Setting the MSS ceiling can avoid IP fragmentation in tunnel scenarios by ensuring that the MSS is low enough to account for the extra overhead of GRE and tunnel outer IP headers. TCP MSS clamping can be used when connecting via GRE to cloud providers that require asymmetric routing.

When MSS clamping is configured on an interface, if the TCP MSS value in a SYN packet transiting that interface exceeds the configured ceiling limit it will be overwritten with the configured limit and the TCP checksum will be recomputed and updated.

TCP MSS clamping is handled by default in the software data path, but the process can be supported through hardware configuration to minimize possible packet loss and a reduction in the number of TCP sessions which the switch can establish per second.

Cautions

This feature should be used with caution. When the TCP MSS clamping feature is enabled by issuing the tcp mss ceiling command on any routed interface, all routed IPv4 TCP SYN packets (TCP packets with the “SYN” flag set) are sent by default to the CPU and switched through software, even on interfaces where no TCP MSS ceiling has been configured, as long as TCP MSS clamping is enabled. This limits the number of TCP sessions that can be established through the switch per second, and, because throughput for software forwarding is limited, this feature can also cause packet loss if the rate at which TCP SYN packets are sent to the CPU exceeds the limits configured in the control-plane policy map.

Packet loss and TCP session reductions can be minimized by enabling TCP MSS clamping in hardware, but only SYN packets in which MSS is the first TCP option are clamped in the hardware data path; other TCP SYN packets are still switched through software.

To disable MSS clamping, the MSS ceiling must be removed from every interface on which it has been configured by issuing the no tcp mss ceiling command on each configured interface.

Enabling TCP MSS Clamping

There is no global configuration to enable TCP MSS clamping. It is enabled as soon as an MSS ceiling is configured on at least one interface.

 

Disabling TCP MSS Clamping

To disable TCP MSS clamping, the MSS ceiling configuration must be removed from every interface by using the no or default form of the tcp mss ceiling command on every interface where a ceiling has been configured.

Configuring the TCP MSS Ceiling on an Interface

The TCP MSS ceiling limit is set on an interface using the tcp mss ceiling command. This also enables TCP MSS clamping on the switch as a whole.

Note: Configuring a TCP MSS ceiling on any interface enables TCP MSS clamping on the switch as a whole. Without hardware support, clamping routes all TCP SYN packets through software, even on interfaces where no TCP MSS ceiling has been configured. This significantly limits the number of TCP sessions the switch can establish per second, and can potentially cause packet loss if the CPU traffic exceeds control plane policy limits.

On Sand platform switches (Qumran-MX, Qumran-AX, Jericho, Jericho+), the following limitations apply:

  • This command works only on egress.
  • TCP MSS ceiling is supported on IPv4 unicast packets entering the switch; the configuration has no effect on GRE transit packets.
  • The feature is supported only on IPv4 routed interfaces. It is not supported on L2 (switchport) interfaces or IPv6 routed interfaces.
  • The feature is not supported for IPv6 packets even if they are going to be tunneled over an IPv4 GRE tunnel.
  • The feature is not supported on VXLAN, loopback or management interfaces.
  • The feature is only supported on IPv4 unicast packets entering the switch. The configuration has no effect on GRE transit packets or GRE decap, even if the egress interface has a TCP MSS ceiling configured.
  • The feature cannot co-exist with Policy Based Routing (PBR) on switches running releases 4.21.5F or older.
Example:
These commands configure Ethernet interface 5 as a routed port, then specify a maximum MSS ceiling value of 1458 bytes for TCP SYN packets exiting that port.
switch(config)#interface ethernet 5
switch(config-if-Et5)#no switchport
switch(config-if-Et5)#tcp mss ceiling ipv4 1458 egress
switch(config-if-Et5)#

Configuring Hardware Support for TCP MSS Clamping

TCP MSS clamping can be supported in hardware, but some packets are still routed through the software data path, and an MSS ceiling value must be configured on each interface where clamping is to be applied.

Hardware support for clamping is accomplished through the use of a user-defined TCAM profile. The TCAM profile can be created from scratch or copied from an existing profile, but in either case it must include the tcp-mss-ceiling ip feature.

Guidelines

  • When the system TCAM profile is changed, some agents will restart.
  • To ensure that the TCP MSS feature is allocated a TCAM DB, it may be necessary to remove some unused features from the TCAM profile.
  • Hardware TCP MSS clamping only works for TCP packets with MSS as the first TCP option. Other TCP SYN packets are still trapped to the CPU for clamping in software.
  • Hardware TCP MSS clamping is not supported with host routes when the clamping is applied on a non-tunnel interface. This limitation does not apply to GRE tunnel interfaces.
  • The maximum MSS ceiling limit with hardware MSS clamping is 32727 even though the CLI allows configuration of much larger values.
  • For more information on the creation of user-defined TCAM profiles, see https://eos.arista.com/eos-4-20-5f/user-defined-pmf-profile/

To configure hardware support for TCP MSS clamping, create a TCAM profile that includes the tcp-mss-ceiling ip feature, then apply it to the system.

Creating the TCAM Profile

A TCAM profile that supports TCP MSS clamping can be created from scratch, or the feature can be added to a copy of the default TCAM profile. When creating a profile from scratch, care must be taken to ensure that all needed TCAM features are included in the profile.

Modifying a Copy of the Default TCAM Profile

The following commands create a copy of the default TCAM profile, name it “tcp-mss-clamping,” and configure it to enable MSS clamping in hardware, then remove some unused features included in the default profile to ensure that there are sufficient TCAM resources for the clamping feature.

switch(config)#hardware tcam
switch(config-hw-tcam)#profile tcp-mss-clamping copy default
switch(config-hw-tcam-profile-tcp-mss-clampingl)#feature tcp-mss-ceiling ip copy 
system-feature-source-profile
switch(config-hw-tcam-profile-tcp-mss-clamping-feature-tcp-mss-ceiling)#key 
size limit 160
switch(config-hw-tcam-profile-tcp-mss-clamping-feature-tcp-mss-ceiling)#packet 
ipv4 forwarding routed
switch(config-hw-tcam-profile-tcp-mss-clamping-feature-tcp-mss-ceiling)#exit

switch(config-hw-tcam-profile-tcp-mss-clamping)#no feature mirror ip
switch(config-hw-tcam-profile-tcp-mss-clamping)#no feature acl port mac
switch(config-hw-tcam-profile-tcp-mss-clampingl)#exit

switch(config-hw-tcam)#exit

switch(config)#

Applying the TCAM Profile to the System

The following commands enter Hardware TCAM Configuration Mode and set the “tcp-mss-clamping” profile as the system profile.

switch(config)#hardware tcam
switch(config-hw-tcam)#system profile tcp-mss-clamping
switch(config-hw-tcam)#

Verifying the TCAM Profile Configuration

The following command displays hardware TCAM profile information to verify that the user-defined TCAM profile has been applied correctly.

switch(config)#show hardware tcam profile

ConfigurationStatus
FixedSystemtcp-mss-clamping tcp-mss-clamping 

switch(config)#

IPv4 GRE Tunneling

GRE tunneling supports the forwarding over IPv4 GRE tunnel interfaces. The GRE tunnel interfaces act as a logical interface that performs GRE encapsulation or decapsulation.

The following switches support the IPv4 forwarding of GRE tunnel interface.
  • DCS-7020R
  • DCS-7280R
  • DCS-7500R
Note: The forwarding over GRE tunnel interface on DCS-7500R is supported only if all the line cards on the system have Jericho family chip-set.

Configuring GRE Tunneling Interface

On a local Arista switch

switch(config)#ip routing
switch(config)#interface Tunnel 10
switch(config-if-Tu10)#tunnel mode gre
switch(config-if-Tu10)#ip address 192.168.1.1/24
switch(config-if-Tu10)#tunnel source 10.1.1.1
switch(config-if-Tu10)#tunnel destination 10.1.1.2
switch(config-if-Tu10)#tunnel path-mtu-discovery
switch(config-if-Tu10)#tunnel tos 10
switch(config-if-Tu10)#tunnel ttl 10

On a remote Arista switch

switch(config)#ip routing
switch(config)#interface Tunnel 10
switch(config-if-Tu10)#tunnel mode gre
switch(config-if-Tu10)#ip address 192.168.1.2/24
switch(config-if-Tu10)#tunnel source 10.1.1.2
switch(config-if-Tu10)#tunnel destination 10.1.1.1
switch(config-if-Tu10)#tunnel path-mtu-discovery
switch(config-if-Tu10)#tunnel tos 10
switch(config-if-Tu10)#tunnel ttl 10 

Alternative configuration for tunnel source IPv4 address

switch(config)#interface Loopback 10
switch(config-if-Lo10)#ip add 10.1.1.1/32
switch(config-if-Lo10)#exit

switch(config)#conf terminal
switch(config)#interface Tunnel 10
switch(config-if-Tu10)#tunnel source interface Loopback 10

Configuration for adding an IPv4 route over the GRE tunnel interface

switch(config)#ip route 192.168.100.0/24 Tunnel 10

Tunnel Mode

Tunnel Mode needs to be configured as gre, for GRE tunnel interface. Default value is tunnel mode gre.

IP address

Configures the IP address for the GRE tunnel interface. The IP address can be used for routing over the GRE tunnel interface. The configured subnet is reachable over the GRE tunnel interface and the packets to the subnet are encapsulated in the GRE header.

Tunnel Source

Specifies the source IP address for the outer IPv4 encapsulation header for packets going over the GRE tunnel interface. The tunnel source IPv4 address should be a valid local IPv4 address configured on the Arista Switch. The tunnel source can also be specified as any routed interface on the Arista Switch. The routed interface’s IPv4 address is assigned as the tunnel source IPv4 address.

Tunnel Destination

Specifies the destination IPv4 address for the outer IPv4 encapsulation header for packets going over the GRE tunnel interface. The tunnel destination IPv4 should be reachable from the Arista Switch.

Tunnel Path Mtu Discovery

Specifies if the “Do not Fragment” flag needs to set in the outer IPv4 encapsulation header for packets going over the GRE tunnel interface.

Tunnel TOS

Specifies the Tunnel type of service (ToS) value to be assigned to the outer IPv4 encapsulation header for packets going over the GRE tunnel interface. Default TOS value of 0 will be assigned if tunnel TOS is not configured.

Tunnel TTL

Specifies the TTL value to the assigned to the outer IPv4 encapsulation header for packet going over the GRE tunnel interface. The TTL value is copied from the inner IPv4 header if tunnel TTL is not configured. The tunnel TTL configuration requires the tunnel Path MTU Discovery to be configured.

Displaying GRE tunnel Information

  • The following commands display the tunnel configuration.

    switch#show interfaces Tunnel 10
    Tunnel10 is up, line protocol is up (connected)
     Hardware is Tunnel, address is 0a01.0101.0800
     Internet address is 192.168.1.1/24
     Broadcast address is 255.255.255.255
     Tunnel source 10.1.1.1, destination 10.1.1.2
     Tunnel protocol/transport GRE/IP
     Key disabled, sequencing disabled
     Checksumming of packets disabled
     Tunnel TTL 10, Hardware forwarding enabled
     Tunnel TOS 10
     Path MTU Discovery
     Tunnel transport MTU 1476 bytes
     Up 3 seconds
  • switch#show gre tunnel static
    
    Name IndexSource DestinationNexthopInterface
    -------- ------ -------- ------------ -------- -----------
    Tunnel10 10 10.1.1.1 10.1.1.2 10.6.1.2 Ethernet6/1
    
    switch#show tunnel fib static interface gre 10
    Type 'Static Interface', index 10, forwarding Primary
     via 10.6.1.2, 'Ethernet6/1'
    GRE, destination 10.1.1.2, source 10.1.1.1, ttl 10, tos 0xa
  • Use show platform fap tcam summary to verify if the TCAM bank is allocated for GRE packet termination lookup.

    switch#show platform fap tcam summary
    
     Tcam Allocation (Jericho0)
    BankUsed By Reserved By
    ---------- ------------ -----------
    0dbGreTunnel -
  • Use show ip route to verify if the routes over tunnel is setup properly.

    switch#show ip route
    
    VRF: default
    Codes: C - connected, S - static, K - kernel,
     O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
     E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
     N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
     R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
     O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
     NG - Nexthop Group Static Route, V - VXLAN Control Service,
     DH - DHCP client installed default route, M - Martian,
     DP - Dynamic Policy Route
    
    Gateway of last resort is not set
    
     C192.168.1.0/24 is directly connected, Tunnel10, Static Interface GRE tunnel 
    index 10, dst 10.1.1.2, src 10.1.1.1, TTL 10, TOS 10
     S192.168.100.0/24 is directly connected, Tunnel10, Static Interface GRE 
    tunnel index 10, dst 10.1.1.2, src 10.1.1.1, TTL 10, TOS 10
    
    
  • The following commands are used to verify the tunnel encapsulation programming.

    switch#show platform fap eedb ip-tunnel gre interface Tunnel 10
     
    -------------------------------------------------------------------------------
    |Jericho0|
    | GRE Tunnel Egress Encapsulation DB 
    |
    |-----------------------------------------------------------------------------|
    | Bank/ | OutLIF | Next | VSI| Encap | TOS| TTL | Source | Destination| 
    OamLIF| OutLIF | Drop|
    | Offset|| OutLIF | LSB| Mode|| | IP | IP | Set 
    | Profile| |
    |-----------------------------------------------------------------------------|
    | 3/0 | 0x6000 | 0x4010 | 0| 2 | 10 | 10| 10.1.1.1 | 10.1.1.2 | No
    | 0| No |
    
    switch#show platform fap eedb ip-tunnel
     
    -------------------------------------------------------------------------------
    |Jericho0 |
    | IP Tunnel Egress Encapsulation DB 
    |
    |-----------------------------------------------------------------------------|
    | Bank/ | OutLIF | Next | VSI | Encap| TOS | TTL | Src | Destination | OamLIF 
    | OutLIF| Drop|
    | Offset|| OutLIF | LSB | Mode | Idx | Idx | Idx | IP| Set| 
    Profile | |
    |-----------------------------------------------------------------------------|
    | 3/0 | 0x6000 | 0x4010 | 0 | 2| 9 | 0 | 0 | 10.1.1.2| No | 
    0 | No |
    
    

IPv4 Commands

IP Routing and Address Commands

IPv4 DHCP Relay

IPv4 DHCP Snooping

IPv4 Multicast Counters

ARP Table

VRF Commands

Trident Forwarding Table Commands

IPv4 GRE Tunneling Commands

rd (VRF configuration mode)

The rd command issued in VRF Configuration Mode is a legacy command supported for backward compatibility. To configure a route distinguisher (RD) for a VRF, use the rd (VRF configuration mode) command.

Note: Legacy RDs that were assigned to a VRF in VRF Configuration Mode will still appear in show vrf outputs if an RD has not been configured in Router-BGP VRF Configuration Mode, but they no longer have an effect on the system.

agent SandL3Unicast terminate

The agent SandL3Unicast terminate command restarts the platform Layer 3 agent to ensure IPv4 routes are optimized.

Command Mode

Global Configuration

Command Syntax

agent SandL3Unicast terminate

Related Commands
Example:
This configuration command restarts the platform Layer 3 agent to ensure IPv4 routes are optimized.
switch(config)#agent SandL3Unicast terminate
SandL3Unicast was terminated

Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.

arp aging timeout

The arp aging timeout command specifies the duration of dynamic address entries in the Address Resolution Protocol (ARP) cache for addresses learned through the configuration mode interface. The default duration is 14400 seconds (four hours).

The arp aging timeout and default arp aging timeout commands restores the default ARP aging timeout for addresses learned on the configuration mode interface by deleting the corresponding arp aging timeout command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-vlan Configuration

Command Syntax

arp aging timeout arp_time

no arp aging timeout

default arp aging timeout

Parameters
  • arp_time ARP aging timeout period (seconds). Values range from 60 to 65535. Default value is 14400.

Example:
This command specifies an ARP cache duration of 7200 seconds (two hours) for dynamic addresses added to the ARP cache that were learned through vlan 200.
switch(config)#interface vlan 200
switch(config-if-Vl200)#arp aging timeout 7200
switch(config-if-Vl200)#show active
interface vlan200
 arp timeout 7200
switch(config-if-Vl200)#

arp cache persistent

The arp cache persistent command restores the dynamic entries in the Address Resolution Protocol (ARP) cache after reboot.

The no arp cache persistent and default arp cache persistent commands remove the ARP cache persistent configuration from the running-config.

Command Mode

Global Configuration

Command Syntax

arp cache persistent

no arp cache persistent

default arp cache persistent

Example:
This command restores the ARP cache after reboot.
switch(config)#arp cache persistent
switch(config)#

arp gratuitous accept

The arp gratuitous accept command configures the configuration mode interface to accept gratuitous ARP request packets received on that interface. Accepted gratuitous ARP requests are then learned by the ARP table.

The no and default forms of the command prevent the interface from accepting gratuitous ARP requests. Configuring gratuitous ARP acceptance on an L2 interface has no effect.

Command Mode

Interface-Ethernet Configuration

Interface-vlan Configuration

Interface Port-channel Configuration

Command Syntax

arp gratuitous accept

no arp gratuitous accept

default arp gratuitous accept

Example:
These commands configure Ethernet interface 2/1 to accept gratuitous ARP request packets.
switch (config)#interface ethernet 2/1
switch (config-if-Et2/1)#arp gratuitous accept
switch (config-if-Et2/1)#

arp

The arp command adds a static entry to an Address Resolution Protocol (ARP) cache. The switch uses ARP cache entries to correlate 32-bit IP addresses to 48-bit hardware addresses.

The no arp and default arp commands remove the ARP cache entry with the specified IP address. When multiple VRFs contain ARP cache entries for identical IP addresses, each entry can only be removed individually.

Command Mode

Global Configuration

Command Syntax

arp [VRF_INSTANCE] ipv4_addr mac_addr arpa

no arp [VRF_INSTANCE] ipv4_addr

default arp [VRF_INSTANCE] ipv4_addr

Parameters
  • VRF_INSTANCE Specifies the VRF instance being modified.

    • <no parameter> Changes are made to the default VRF.
    • vrf vrf_name Changes are made to the specified user-defined VRF.
  • ipv4_addr IPv4 address of ARP entry.
  • mac_addrLocal data-link (hardware) address (48-bit dotted hex notation – H.H.H).

Examples:
  • This command adds a static entry to the ARP cache in the default VRF.
    switch(config)#arp 172.22.30.52 0025.900e.c63c arpa
    switch(config)#
  • This command adds the same static entry to the ARP cache in the VRF named “purple.”
    switch(config)#arp vrf purple 172.22.30.52 0025.900e.c63c arpa
    switch(config)#

clear arp

The clear arp command removes the specified dynamic ARP entry for the specified IP address from the Address Resolution Protocol (ARP) table.

Command Mode

Privileged EXEC

Command Syntax

clear arp [VRF_INSTANCE] ipv4_addr Parameters
  • VRF_INSTANCE Specifies the VRF instance for which arp data is removed.

    • <no parameter> Specifies the context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
  • ipv4_addr IPv4 address of dynamic ARP entry.

Example:
These commands display the ARP table before and after the removal of dynamic ARP entry for IP address 172.22.30.52.
switch#show arp

Address Age (min)Hardware Addr Interface
172.22.30.1 0001c.730b.1d15Management1
172.22.30.5200025.900e.c468Management1
172.22.30.5300025.900e.c63cManagement1
172.22.30.133 0001c.7304.3906Management1

switch#clear arp 172.22.30.52
switch#show arp

Address Age (min)Hardware Addr Interface
172.22.30.1 0001c.730b.1d15Management1
172.22.30.5300025.900e.c63cManagement1
172.22.30.133 0001c.7304.3906Management1

switch#

clear arp-cache

The clear arp-cache command refreshes dynamic entries in the Address Resolution Protocol (ARP) cache. Refreshing the ARP cache updates current ARP table entries and removes expired ARP entries not yet deleted by an internal, timer-driven process.

The command, without arguments, refreshes ARP cache entries for all enabled interfaces. With arguments, the command refreshes cache entries for the specified interface. Executing clear arp-cache for all interfaces can result in extremely high CPU usage while the tables are resolving.

Command Mode

Privileged EXEC

Command Syntax

clear arp-cache [VRF_INSTANCE][INTERFACE_NAME]

Parameters
  • VRF_INSTANCE Specifies the VRF instance for which arp data is refreshed.

    • <no parameter> Specifies the context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
  • INTERFACE_NAME Interface upon which ARP cache entries are refreshed. Options include:

    • <no parameter> All ARP cache entries.
    • interface ethernet e_num ARP cache entries of specified Ethernet interface.
    • interface loopback l_num ARP cache entries of specified loopback interface.
    • interface management m_num ARP cache entries of specified management interface.
    • interface port-channel p_num ARP cache entries of specified port-channel Interface.
    • interface vlan v_num ARP cache entries of specified vlan interface.
    • interface vxlan vx_num VXLAN interface specified by vx_num.

Related Commands
  • cli vrf specifies the context-active VRF.
Example:
These commands display the ARP cache before and after ARP cache entries are refreshed.
switch#show arp

Address Age (min)Hardware Addr Interface
172.22.30.1 0001c.730b.1d15Management1
172.22.30.118 0001c.7301.6015Management1

switch#clear arp-cache
switch#show arp

Address Age (min)Hardware Addr Interface
172.22.30.1 0001c.730b.1d15Management1

switch#

clear ip dhcp relay counters

The clear ip dhcp relay counters command resets the DHCP relay counters. The configuration mode determines which counters are reset:

  • Interface configuration: command clears the counter for the configuration mode interface.

Command Mode

Privileged EXEC

Command Syntax

clear ip dhcp relay counters [INTERFACE_NAME]

Parameters
  • INTERFACE_NAME Entity for which counters are cleared. Options include:

    • <no parameter> Clears counters for the switch and for all interfaces.
    • interface ethernet e_num Clears counters for the specified Ethernet interface.
    • interface loopback l_num Clears counters for the specified loopback interface.
    • interface port-channel p_num Clears counters for the specified port-channel Interface.
    • interface vlan v_num Clears counters for the specified vlan interface.

Examples:
  • These commands clear the DHCP relay counters for vlan 1045 and shows the counters before and after the clear command.
    switch#show ip dhcp relay counters
    
    |Dhcp Packets|
    Interface | Rcvd Fwdd Drop | Last Cleared
    ----------|----- ---- -----|---------------------
    All Req |3763760 | 4 days, 19:55:12 ago
     All Resp |2772770 |
    ||
     vlan1001 |2071480 | 4 days, 19:54:24 ago
     vlan1045 |3762770 | 4 days, 19:54:24 ago
    
    switch#clear ip dhcp relay counters interface vlan 1045
    
    |Dhcp Packets|
    Interface | Rcvd Fwdd Drop | Last Cleared
    ----------|----- ---- -----|---------------------
    All Req |3803800 | 4 days, 21:19:17 ago
     All Resp |2812810 |
    ||
     vlan1000 |2071480 | 4 days, 21:18:30 ago
     vlan1045 |000 |0:00:07 ago
    
  • These commands clear all DHCP relay counters on the switch.
    switch(config-if-Vl1045)#exit
    switch(config)#clear ip dhcp relay counters
    switch(config)#show ip dhcp relay counters
    
              |Dhcp Packets|
    Interface | Rcvd Fwdd Drop | Last Cleared
    ----------|----- ---- -----|-------------
    All Req |000 |0:00:03 ago
     All Resp |000 |
    ||
     vlan1000 |000 |0:00:03 ago
     vlan1045 |000 |0:00:03 ago
    

clear ip dhcp snooping counters

The clear ip dhcp snooping counters command resets the DHCP snooping packet counters.

Command Mode

Privileged EXEC

Command Syntax

clear ip dhcp snooping counters [COUNTER_TYPE]

Parameters
  • COUNTER_TYPE The type of counter that the command resets. Options include:

    • <no parameter> Counters for each vlan.
    • debug Aggregate counters and drop cause counters.

Examples:
  • This command clears the DHCP snooping counters for each vlan.
    switch#clear ip dhcp snooping counters
    switch#show ip dhcp snooping counters
    
     | Dhcp Request Pkts | Dhcp Reply Pkts |
    vlan |RcvdFwddDrop | Rcvd FwddDrop | Last Cleared
    -----|------ ----- ------|----- ---- ------|-------------
     100 | 0 0 0 |00 0 |0:00:10 ago
    
    switch#
  • This command clears the aggregate DHCP snooping counters.
    switch#clear ip dhcp snooping counters debug
    switch#show ip dhcp snooping counters debug
    
    Counter Snooping to Relay Relay to Snooping
    ----------------------------- ----------------- -----------------
    Received0 0
    Forwarded 0 0
    Dropped - Invalid vlanId0 0
    Dropped - Parse error 0 0
    Dropped - Invalid Dhcp Optype 0 0
    Dropped - Invalid Info Option 0 0
    Dropped - Snooping disabled 0 0
    
    Last Cleared:0:00:08 ago
    
    switch#

clear ip multicast count

The clear ip multicast count command clears all counters associated with the multicast traffic.

Command Mode

Gobal Configuration

Command Syntax

clear ip multicast count [group_address [source_address]]

Parameters
  • <no parameters> Clears all counts of the multicast route traffic.
  • group_address Clears the multicast traffic count of the specified group address.

    • source_address Clears the multicast traffic count of the specified group and source addresses.

Guidelines
Examples:
  • This command clears all counters associated with the multicast traffic.
    switch(config)#clear ip multicast count
  • This command clears the multicast traffic count of the specified group address.
    switch(config)#clear ip multicast count 16.39.24.233

cli vrf

The cli vrf command specifies the context-active VRF. The context-active VRF determines the default VRF that VRF-context aware commands use when displaying routing table data.

Command Mode

Privileged EXEC

Command Syntax

cli vrf [VRF_ID]

Parameters
  • VRF_ID Name of VRF assigned as the current VRF scope. Options include:

    • vrf_name Name of user-defined VRF.
    • default System-default VRF.

Guidelines

VRF-context aware commands include:

clear arp-cache

show ip

show ip arp

show ip route

show ip route gateway

show ip route host

Related Commands

Example:

These commands specify magenta as the context-active VRF, then display the context-active VRF.

switch#cli vrf magenta
switch#show routing-context vrf
Current VRF routing-context is magenta
switch#

compress

The compress command increases the hardware resources available for the specified prefix lengths.

The no compresscommand removes the 2-to-1 compression configuraion from the running-config.

Note: The compress command is supported only on 7500R, 7280R, 7500R2 and 7280R2 platforms.

Command Mode

Global Configuration

Command Syntax

ip hardware fib optimize prefix-length<prefix-length>expand<prefix-length>compress

no ip hardware fib optimize prefix-length<prefix-length>expand<prefix-length>compress

Parameters
  • compress Allows configuring up to one compressed prefix length.
Example:
In the following example we are configuring prefix length 20 and 24, expanding prefix length 19 and 23, and compressing prefix length 25.
switch(config)#ip hardware fib optimize prefix-length 20 24 expand 19 23 compress 25
 ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

description (VRF)

The description command adds a text string to the configuration mode VRF. The string has no functional impact on the VRF.

The no description and default description commands remove the text string from the configuration mode VRF by deleting the corresponding description command from running-config.

Command Mode

VRF Configuration

Command Syntax

description label_text

no description

default description

Parameters
  • label_text Character string assigned to the VRF configuration.

Related Commands
Example:
These commands add description text to the magenta VRF.
switch(config)#vrf instance magenta
switch(config-vrf-magenta)#description This is the first vrf
switch(config-vrf-magenta)#show active
 vrf instance magenta
 description This is the first vrf

switch(config-vrf-magenta)#

interface tunnel

The interface tunnel command places the switch in interface-tunnel configuration mode.

Interface-tunnel configuration mode is not a group change mode; running-config is changed immediately after commands are executed.

The no interface tunnel command deletes the specified interface tunnel configuration.

The exit command returns the switch to the global configuration mode.

Command Mode

Global Configuration

Command Syntax

interface tunnel <number>

no interface tunnel <number>

Parameter

  • number Tunnel interface number. Values range from 0 to 255.

Example:
This command places the switch in interface-tunnel configuration mode for tunnel interface 10.
switch(config)#interface tunnel 10
switch(config-if-Tu10)#

ip arp inspection limit

The ip arp inspection limit command err-disables the interface if the incoming ARP rate exceeds the configured value rate limit the incoming ARP packets on an interface.

Command Mode

EXEC

Command Syntax

ip arp inspection limit [ RATE <pps>] [BURST_INTERVAL <sec> | none]

no ip arp inspection limit [ RATE <pps>] [BURST_INTERVAL <sec> | none]

default ip arp inspection limit [ RATE <pps>] [BURST_INTERVAL <sec> | none]

Parameters

  • RATE Specifies the ARP inspection limit rate in packets per second.

    • <pps> ARP inspection limit rate packets per second.
  • BURST_INTERVAL Specifies the ARP inspection limit burst interval.

    • <sec> Burst interval second.

Examples:
  • This command configures the rate limit of incoming ARP packets to errdisable the interface when the incoming ARP rate exceeds the configured value, sets the rate to 512 (which is the upper limit for the number of invalid ARP packets allowed per second), and sets the burst consecutive interval over which the interface is monitored for a high ARP rate to 11 seconds.
    switch(config)#ip arp inspection limit rate 512 burst interval 11
    switch(config)#
  • This command displays verification of the interface specific configuration.
    switch(config)#interface Ethernet 3/1
    switch(config)#ip arp inspection limit rate 20 burst interval 5
    switch(config)#interface Ethernet 3/3
    switch(config)#ip arp inspection trust
    switch(config)#show ip arp inspection interfaces
     
     Interface      Trust State  Rate (pps) Burst Interval
     -------------  -----------  ---------- --------------
     Et3/1          Untrusted    20         5
     Et3/3          Trusted      None       N/A
    
    switch(config)#

ip arp inspection logging

The ip arp inspection logging command enables logging of incoming ARP packets on the interface if the rate exceeds the configured value.

Command Mode

EXEC

Command Syntax

ip arp inspection logging [RATE <pps> ][BURST_INTERVAL <sec> | none]

no ip arp inspection logging [RATE <pps> ][BURST_INTERVAL <sec> | none]

default ip arp inspection logging [RATE <pps> ][BURST_INTERVAL <sec> | none]

Parameters

  • RATE Specifies the ARP inspection limit rate in packets per second.

    • <pps> ARP inspection limit rate packets per second.
  • BURST_INTERVAL Specifies the ARP inspection limit burst interval.

    • <sec> Burst interval second.

Example:
This command enables logging of incoming ARP packets when the incoming ARP rate exceeds the configured value on the interface, sets the rate to 2048 (which is the upper limit for the number of invalid ARP packets allowed per second), and sets the burst consecutive interval over which the interface is monitored for a high ARP rate to 15 seconds.
switch(config)#ip arp inspection logging rate 2048 burst interval 15
switch(config)#

ip arp inspection trust

The ip arp inspection trust command configures the trust state of an interface. By default, all interfaces are untrusted.

Command Mode

EXEC

Command Syntax

ip arp inspection trust

no ip arp inspection trust

default ip arp inspection trust

Related Commands

Examples:
  • This command configures the trust state of an interface.
    switch(config)#ip arp inspection trust
    switch(config)#
  • This command configures the trust state of an interface to untrusted.
    switch(config)#no ip arp inspection trust
    switch(config)#
  • This command configures the trust state of an interface to its default (untrusted).
    switch(config)#default ip arp inspection trust
    switch(config)#

ip arp inspection vlan

The ip arp inspection vlan command enables ARP inspection. ARP requests and responses on untrusted interfaces are intercepted on specified vlans, and intercepted packets are verified to have valid IP-MAC address bindings. All invalid ARP packets are dropped. On trusted interfaces, all incoming ARP packets are processed and forwarded without verification. By default, ARP inspection is disabled on all vlans.

Command Mode

EXEC

Command Syntax

ip arp inspection vlan [LIST]

Parameters

Example:
  • This command enables ARP inspection on vlans 1 through 150.
    switch(config)#ip arp inspection vlan 1 - 150
    switch(config)#
  • This command disables ARP inspection on vlans 1 through 150.
    switch(config)#no ip arp inspection vlan 1 - 150
    switch(config)#
  • This command sets the ARP inspection default to vlans 1 through 150.
    switch(config)#default ip arp inspection vlan 1 - 150
    switch(config)#
  • These commands enable ARP inspection on multiple vlans 1 through 150 and 200 through 250.
    switch(config)#ip arp inspection vlan 1-150,200-250
    switch(config)#

ip dhcp relay all-subnets default

The ip dhcp relay all-subnets default command configures the global DHCP smart relay setting. DHCP smart relay supports forwarding DHCP requests with a client’s secondary IP addresses in the gateway address field. The default global DHCP smart relay setting is disabled.

The global DHCP smart relay setting is applied to all interfaces for which an ip dhcp relay all-subnets statement is not configured. Enabling DHCP smart relay on an interface requires that DHCP relay is also enabled on that interface.

The no ip dhcp relay all-subnets default and default ip dhcp relay all-subnets default commands restore the global DHCP smart relay default setting of disabled by removing the ip dhcp relay all-subnets default command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp relay all-subnets default

no ip dhcp relay all-subnets default

default ip dhcp relay all-subnets default

Related Commands

Example:
This command configures the global DHCP smart relay setting to enabled.
switch(config)#ip dhcp relay all-subnets default
switch(config)#

ip dhcp relay all-subnets

The ip dhcp relay all-subnets command configures the DHCP smart relay status on the configuration mode interface. DHCP smart relay supports forwarding DHCP requests with a client’s secondary IP addresses in the gateway address field. Enabling DHCP smart relay on an interface requires that DHCP relay is also enabled on that interface.

By default, an interface assumes the global DHCP smart relay setting as configured by the ip dhcp relay all-subnets default command. The ip dhcp relay all-subnets command, when configured, takes precedence over the global smart relay setting.

The no ip dhcp relay all-subnets command disables DHCP smart relay on the configuration mode interface. The default ip dhcp relay all-subnets command restores the interface’s to the default DHCP smart relay setting, as configured by the ip dhcp relay all-subnets default command, by removing the corresponding ip dhcp relay all-subnets or no ip dhcp relay all-subnets statement from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Interface-vlan Configuration

Command Syntax

ip dhcp relay all-subnets

no ip dhcp relay all-subnets

default ip dhcp relay all-subnets

Examples:
  • This command enables DHCP smart relay on vlan interface 100.
    switch(config)#interface vlan 100
    switch(config-if-Vl100)#ip helper-address 10.4.4.4
    switch(config-if-Vl100)#ip dhcp relay all-subnets
    switch(config-if-Vl100)#show ip dhcp relay
    DHCP Relay is active
    DHCP Relay Option 82 is disabled
    DHCP Smart Relay is enabled
    Interface: vlan100
    DHCP Smart Relay is enabled
    DHCP servers: 10.4.4.4
    switch(config-if-Vl100)#
  • This command disables DHCP smart relay on vlan interface 100.
    switch(config-if-Vl100)#no ip dhcp relay all-subnets
    switch(config-if-Vl100)#show active
     interface vlan100
     no ip dhcp relay all-subnets
     ip helper-address 10.4.4.4
    switch(config-if-Vl100)#show ip dhcp relay
    DHCP Relay is active
    DHCP Relay Option 82 is disabled
    DHCP Smart Relay is enabled
    Interface: vlan100
    DHCP Smart Relay is disabled
    DHCP servers: 10.4.4.4
    switch(config-if-Vl100)#
  • This command enables DHCP smart relay globally, configures vlan interface 100 to use the global setting, then displays the DHCP relay status.
    switch(config)#ip dhcp relay all-subnets default
    switch(config)#interface vlan 100
    switch(config-if-Vl100)#ip helper-address 10.4.4.4
    switch(config-if-Vl100)#default ip dhcp relay
    switch(config-if-Vl100)#show ip dhcp relay
    DHCP Relay is active
    DHCP Relay Option 82 is disabled
    DHCP Smart Relay is enabled
    Interface: vlan100
    Option 82 Circuit ID: 333
    DHCP Smart Relay is enabled
    DHCP servers: 10.4.4.4
    switch(config-if-Vl100)#

ip dhcp relay always-on

The ip dhcp relay always-on command enables the switch DHCP relay agent on the switch regardless of the DHCP relay agent status on any interface. By default, the DHCP relay agent is enabled only if at least one routable interface is configured with an ip helper-address statement.

The no ip dhcp relay always-on and default ip dhcp relay always-on commands remove the ip dhcp relay always-on command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp relay always-on

no ip dhcp relay always-on

default ip dhcp relay always-on

Related Commands

These commands implement DHCP relay agent.

Example:
This command enables the DHCP relay agent.
switch(config)#ip dhcp relay always-on
switch(config)#

ip dhcp relay information option (Global)

The ip dhcp relay information option command configures the switch to attach tags to DHCP requests before forwarding them to the DHCP servers designated by ip helper-address commands. The command specifies the tag contents for packets forwarded by the interface that it configures.

The no ip dhcp relay information option and default ip dhcp relay information option commands restore the switch’s default setting of not attaching tags to DHCP requests by removing the ip dhcp relay information option command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp relay information option

no ip dhcp relay information option

default ip dhcp relay information option

Related Commands

These commands implement DHCP relay agent.

Example:

This command enables the attachment of tags to DHCP requests that are forwarded to DHCP server addresses.

switch(config)#ip dhcp relay information option
switch(config)#

ip dhcp relay information option circuit-id

The ip dhcp relay information option circuit-id command specifies the content of tags that the switch attaches to DHCP requests before they are forwarded from the configuration mode interface to DHCP server addresses specified by ip helper-address commands. Tags are attached to outbound DHCP requests only if the information option is enabled on the switch (ip dhcp relay information option circuit-id). The default value for each interface is the name and number of the interface.

The no ip dhcp relay information option circuit-id and default ip dhcp relay information option circuit-id commands restore the default content setting for the configuration mode interface by removing the corresponding command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-vlan Configuration

Command Syntax

ip dhcp relay information option circuit-id id_label

no ip dhcp relay information option circuit-id

default ip dhcp relay information option circuit-id

Parameters

  • id_label Tag content. Format is alphanumeric characters (maximum 15 characters).

Related Commands

Example:

This command configures x-1234 as the tag content for packets send from vlan 200.

switch(config)#interface vlan 200
switch(config-if-Vl200)#ip dhcp relay information option circuit-id x-1234
switch(config-if-Vl200)#

ip dhcp snooping information option

The ip dhcp snooping information option command enables the insertion of option-82 DHCP snooping information in DHCP packets on vlans where DHCP snooping is enabled. DHCP snooping is a layer 2 switch process that allows relay agents to provide remote-ID and circuit-ID information to DHCP reply and request packets. DHCP servers use this information to determine the originating port of DHCP requests and associate a corresponding IP address to that port.

DHCP snooping uses information option (Option-82) to include the switch MAC address (router-ID) along with the physical interface name and vlan number (circuit-ID) in DHCP packets. After adding the information to the packet, the DHCP relay agent forwards the packet to the DHCP server through DHCP protocol processes.

DHCP snooping on a specified vlan requires all of these conditions to be met:

  • DHCP snooping is globally enabled.
  • Insertion of option-82 information in DHCP packets is enabled.
  • DHCP snooping is enabled on the specified vlan.
  • DHCP relay is enabled on the corresponding vlan interface.

When global DHCP snooping is not enabled, the ip dhcp snooping information option command persists in running-config without any operational effect.

The no ip dhcp snooping information option and default ip dhcp snooping information option commands disable the insertion of option-82 DHCP snooping information in DHCP packets by removing the ip dhcp snooping information option statement from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp snooping information option

no ip dhcp snooping information option

default ip dhcp snooping information option

Related Commands

Example:
These commands enable DHCP snooping on DHCP packets from ports on snooping-enabled vlans. DHCP snooping was previously enabled on the switch.
switch(config)#ip dhcp snooping information option
switch(config)#show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following vlans:
100
DHCP Snooping is operational on following vlans:
100
Insertion of Option-82 is enabled
Circuit-id format: Interface name:vlan ID
Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch(config)#

ip dhcp snooping vlan

The ip dhcp snooping vlan command enables DHCP snooping on specified vlans. DHCP snooping is a Layer 2 process that allows relay agents to provide remote-ID and circuit-ID information in DHCP packets. DHCP servers use this data to determine the originating port of DHCP requests and associate a corresponding IP address to that port. DHCP snooping is configured on a global and vlan basis.

vlan snooping on a specified vlan requires each of these conditions:

  • DHCP snooping is globally enabled.
  • Insertion of option-82 information in DHCP packets is enabled.
  • DHCP snooping is enabled on the specified vlan.
  • DHCP relay is enabled on the corresponding vlan interface.

When global DHCP snooping is not enabled, the ip dhcp snooping vlan command persists in running-config without any operational affect.

The no ip dhcp snooping information option and default ip dhcp snooping information option commands disable DHCP snooping operability by removing the ip dhcp snooping information option statement from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp snooping vlan v_range

no ip dhcp snooping vlan v_range

default ip dhcp snooping vlan v_range

Parameters

  • v_range vlans upon which snooping is enabled. Formats include a number, a number range, or a comma-delimited list of numbers and ranges. Numbers range from 1 to 4094.

    Related Commands

  • ip dhcp snooping globally enables DHCP snooping.
  • ip dhcp snooping vlan enables insertion of option-82 snooping data.
  • ip helper-address enables the DHCP relay agent on a configuration mode interface.

Example:
These commands enable DHCP snooping globally, DHCP on vlan interface100, and DHCP snooping on vlan 100.
switch(config)#ip dhcp snooping
switch(config)#ip dhcp snooping information option
switch(config)#ip dhcp snooping vlan 100
switch(config)#interface vlan 100
switch(config-if-Vl100)#ip helper-address 10.4.4.4
switch(config-if-Vl100)#show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following vlans:
100
DHCP Snooping is operational on following vlans:
100
Insertion of Option-82 is enabled
Circuit-id format: Interface name:vlan ID
Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch(config)#

ip dhcp snooping

The ip dhcp snooping command enables DHCP snooping globally on the switch. DHCP snooping is a set of layer 2 processes that can be configured on LAN switches and used with DHCP servers to control network access to clients with specific IP/MAC addresses. The switch supports Option-82 insertion, which is a DHCP snooping process that allows relay agents to provide remote-ID and circuit-ID information to DHCP reply and request packets. DHCP servers use this information to determine the originating port of DHCP requests and associate a corresponding IP address to that port. DHCP servers use port information to track host location and IP address usage by authorized physical ports.

DHCP snooping uses the information option (Option-82) to include the switch MAC address (router-ID) along with the physical interface name and vlan number (circuit-ID) in DHCP packets. After adding the information to the packet, the DHCP relay agent forwards the packet to the DHCP server as specified by the DHCP protocol.

DHCP snooping on a specified vlan requires all of these conditions to be met:

  • DHCP snooping is globally enabled.
  • Insertion of option-82 information in DHCP packets is enabled.
  • DHCP snooping is enabled on the specified vlan.
  • DHCP relay is enabled on the corresponding vlan interface.

The no ip dhcp snooping and default ip dhcp snooping commands disables global DHCP snooping by removing the ip dhcp snooping command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp snooping

no ip dhcp snooping

default ip dhcp snooping

Related Commands

Example:
This command globally enables snooping on the switch, displaying DHCP snooping status prior and after invoking the command.
switch(config)#show ip dhcp snooping
DHCP Snooping is disabled
switch(config)#ip dhcp snooping
switch(config)#show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is not operational
DHCP Snooping is configured on following vlans:
None
DHCP Snooping is operational on following vlans:
None
Insertion of Option-82 is disabled
switch(config)#

ip hardware fib ecmp resilience

The ip hardware fib ecmp resilience command enables resilient ECMP for the specified IP address prefix and configures a fixed number of next hop entries in the hardware ECMP table for that prefix. In addition to specifying the maximum number of next hop addresses that the table can contain for the prefix, the command includes a redundancy factor that allows duplication of each next hop address. The fixed table space for the address is the maximum number of next hops multiplied by the redundancy factor.

Resilient ECMP is useful when it is not desirable for routes to be rehashed due to link flap, as when ECMP is being used for load balancing.

The no ip hardware fib ecmp resilience and default ip hardware fib ecmp resilience commands restore the default hardware ECMP table management by removing the ip hardware fib ecmp resilience command from running-config .

Command Mode

Global Configuration

Command Syntax

ip hardware fib ecmp resilience net_addr capacity nhop_max redundancy duplicates

no ip hardware fib ecmp resilience net_addr

default ip hardware fib ecmp resilience net_addr

Parameters

  • net_addr IP address prefix managed by command. (CIDR or address-mask).
  • nhop_max Maximum number of nexthop addresses for specified IP address prefix. Value range varies by platform:

    • Helix: <2 to 64>
    • Trident: <2 to 32>
    • Trident II: <2 to 64>
  • duplicates Specifies the redundancy factor. Value ranges from 1 to 128.

Example:
This command configures a hardware ECMP table space of 24 entries for the IP address 10.14.2.2/24. A maximum of six next-hop addresses can be specified for the IP address. When the table contains six next-hop addresses, each appears in the table four times. When the table contains fewer than six next-hop addresses, each is duplicated until the 24 table entries are filled.
switch(config)#ip hardware fib ecmp resilience 10.14.2.2/24 capacity 6 redundancy 4
switch(config)#

ip hardware fib optimize

The ip hardware fib optimize command enables IPv4 route scale. The platform layer 3 agent is restarted to ensure IPv4 routes are optimized with theagent SandL3Unicast terminate command for the configuration mode interface.

Command Mode

Global Configuration

Command Syntax

ip hardware fib optimize exact-match prefix-length <prefix-length> <optional: prefix-length>

ip hardware fib optimize exact-match prefix-length <prefix-length> <optional: prefix-length>

Parameters

  • prefix-length The length of the prefix equal to 12, 16, 20, 24, 28, or 32. One additional prefix-length limited to the prefix-length of 32 is optional.

    Related Commands

  • agent SandL3Unicast terminateenables restarting the layer 3 agent to ensure IPv4 routes are optimized.
  • show platform arad ip routeshows resources for all IPv4 routes in hardware. Routes that use the additional hardware resources will appear with an asterisk.
  • show platform arad ip route summary shows hardware resource usage of IPv4 routes.

Examples:
  • This configuration command allows configuring prefix lengths 12 and 32.
    switch(config)#ip hardware fib optimize exact-match prefix-length 12 32
    ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
    
  • One of the two prefixes in this command is a prefix-length of 32, which is required in the instance where there are two prefixes. For this command to take effect, the platform layer 3 agent must be restarted.
    • This configuration command restarts the platform layer 3 agent to ensure IPv4 routes are optimized.
      switch(config)#agent SandL3Unicast terminate
      SandL3Unicast was terminated
      
  • Restarting the platform layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.
    • This configuration command allows configuring prefix lengths 32 and 16.
      switch(config)#ip hardware fib optimize exact-match prefix-length 32 16
      ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
      
  • One of the two prefixes in this command is a prefix-length of 32, which is required in the instance where there are two prefixes. For this command to take effect, the platform layer 3 agent must be restarted.
    • This configuration command restarts the platform layer 3 agent to ensure IPv4 routes are optimized.
      switch(config)#agent SandL3Unicast terminate
      SandL3Unicast was terminated
      
  • Restarting the platform layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.
    • This configuration command allows configuring prefix length 24.
      switch(config)#ip hardware fib optimize exact-match prefix-length 24
      ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
      
  • In this instance, there is only one prefix-length, so a prefix-length of 32 is not required. For this command to take effect, the platform layer 3 agent must be restarted.
    • This configuration command restarts the platform layer 3 agent to ensure IPv4 routes are optimized.
      switch(config)#agent SandL3Unicast terminate
      SandL3Unicast was terminated
      
  • Restarting the platform layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.
    • This configuration command allows configuring prefix length 32.
      switch(config)#ip hardware fib optimize exact-match prefix-length 32
      ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
      
  • For this command to take effect, the platform layer 3 agent must be restarted.
    • This configuration command restarts the platform layer 3 agent to ensure IPv4 routes are optimized.
      switch(config)#agent SandL3Unicast terminate
      SandL3Unicast was terminated
      
  • Restarting the platform layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.
    • This configuration command disables configuring prefix lengths 12 and 32.
      switch(config)#no ip hardware fib optimize exact-match prefix-length 12 32
      ! Please restart layer 3 forwarding agent to ensure IPv4 routes are not optimized
      
    • One of the two prefixes in this command is a prefix-length of 32, which is required in the instance where there are two prefixes. For this command to take effect, the platform layer 3 agent must be restarted.

ip helper-address

The ip helper-address command enables the DHCP relay agent on the configuration mode interface and specifies a forwarding address for DHCP requests. An interface that is configured with multiple helper-addresses forwards DHCP requests to all specified addresses.

The no ip helper-address and default ip helper-address commands remove the corresponding ip helper-address command from running-config. Commands that do not specify an IP helper-address remove all helper-addresses from the interface.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Interface-vlan Configuration

Command Syntax

ip helper-address ipv4_addr [vrf vrf_name][source-address ipv4_addr | source-interface INTERFACES]

no ip helper-address [ipv4_addr]

default ip helper-address [ipv4_addr]

Parameters

  • vrf vrf_name Specifies the user-defined VRF for DHCP server.
  • ipv4_addr Specifies the DHCP server address accessed by interface.
  • source-address ipv4_addr Specifiesthe source IPv4 address to communicate with DHCP server.
  • source-interface INTERFACES Specifies the source interface to communicate with DHCP server. Options include:

    • Ethernet eth_num Specifies the Ethernet interface number.
    • Loopback lpbck_num Specifiesthe loopback interface number. Value ranges from 0 to 1000.
    • Management mgmt_num Specifiesthe management interface number. Accepted values are 1 and 2.
    • Port-Channel {int_num | sub_int_num} Specifies the port-channel interface or subinterface number. Value of interface ranges from 1 to 2000. Value of sub-interface ranges from 1 to 4094.
    • Tunnel tnl_num Specifies the tunnel interface number. Value ranges from 0 to 255.
    • vlan vlan_num Specifies the Ethernet interface number. Value ranges from 1 to 4094.

Guidelines

If the source-address parameter is specified, then the DHCP client receives an IPv4 address from the subnet of source IP address. The source-address must be one of the configured addresses on the interface.

Examples:
  • This command enables DHCP relay on the vlan interface 200; and configure the switch to forward DHCP requests received on this interface to the server at 10.10.41.15.
    switch(config)#interface vlan 200
    switch(config-if-Vl200)#ip helper-address 10.10.41.15
    switch(config-if-Vl200)#show active
    interface vlan200
     ip helper-address 10.10.41.15
    switch(config-if-Vl200)#
  • This command enables DHCP relay on the interface Ethernet 1/2; and configures the switch to use 2.2.2.2 as the source IP address when relaying IPv4 DHCP messages to the server at 1.1.1.1.
    switch(config)#interface ethernet 1/2
    switch(config-if-Et1/2)#ip helper-address 1.1.1.1 source-address 2.2.2.2
    switch(config-if-Et1/2)#

ip icmp redirect

The ip icmp redirect command enables the transmission of ICMP redirect messages. Routers send ICMP redirect messages to notify data link hosts of the availability of a better route for a specific destination.

The no ip icmp redirect disables the switch from sending ICMP redirect messages.

Command Mode

Global Configuration

Command Syntax

ip icmp redirect

no ip icmp redirect

default ip icmp redirect

Example:

This command disables the redirect messages.

switch(config)#no ip icmp redirect
switch(config)#show running-config
<-------OUTPUT OMITTED FROM EXAMPLE-------->
!
no ip icmp redirect
ip routing
!
 <-------OUTPUT OMITTED FROM EXAMPLE-------->
switch(config)#

ip load-sharing

The ip load-sharing command provides the hash seed to an algorithm that the switch uses to distribute data streams among multiple equal-cost routes to an individual IPv4 subnet.

In a network topology using Equal-Cost Multipath routing, all switches performing identical hash calculations may result in hash polarization, leading to uneven load distribution among the data paths. Hash polarization is avoided when switches use different hash seeds to perform different hash calculations.

The no ip load-sharing and default ip load-sharing commands return the hash seed to the default value of zero by removing the ip load-sharing command from running-config.

Command Mode

Global Configuration

Command Syntax

ip load-sharing HARDWARE seed

no ip load-sharing HARDWARE

default ip load-sharing HARDWARE

Parameters

  • HARDWARE The ASIC switching device. The available option depend on the switch platform. Verify available options with the CLI ? command.

    • arad
    • fm6000
    • petraA
    • trident
  • seed The hash seed. Value range varies by switch platform. The default value on all platforms is 0.

    • when HARDWARE=arad seed ranges from 0 to 2.
    • when HARDWARE=fm6000 seed ranges from 0 to 39.
    • when HARDWARE=petraA seed ranges from 0 to 2.
    • when HARDWARE=trident seed ranges from 0 to 5.

Example:
This command sets the IPv4 load sharing hash seed to one on FM6000 platform switches.
switch(config)#ip load-sharing fm6000 1
switch(config)# 

ip local-proxy-arp

The ip local-proxy-arp command enables local proxy ARP (Address Resolution Protocol) on the configuration mode interface. When local proxy ARP is enabled, ARP requests received on the configuration mode interface will return an IP address even when the request comes from within the same subnet.

The no ip local-proxy-arp and default ip local-proxy-arp commands disable local proxy ARP on the configuration mode interface by removing the corresponding ip local-proxy-arp command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-vlan Configuration

Command Syntax

ip local-proxy-arp

no ip local-proxy-arp

default ip local-proxy-arp

Example:
These commands enable local proxy ARP on vlan interface 140.
switch(config)#interface vlan 140
switch(config-if-Vl140)#ip local-proxy-arp
switch(config-if-Vl140)#show active
interface vlan140
 ip local-proxy-arp
switch(config-if-Vl140)#

ip multicast count

The ip multicast count command enables the IPv4 multicast route traffic counter of group and source addresses in either bytes or packets.

The no ip multicast count command deletes all multicast counters including the routes of group and source addresses.

The no ip multicast count group_address source_addresscommand removes the current configuration of the specified group and source addresses. It does not delete the counter because the wildcard is still active.

The default ip multicast count command reverts the current counter configuration of multicast route to the default state.

Command Mode

Global Configuration

Command Syntax

ip multicast count [group_address [source_address] | bytes | packets]

no ip multicast count [group_address [source_address] | bytes | packets]

default ip multicast count [group_address [source_address] | bytes | packets]

Parameters

  • group_address Configures the multicast route traffic count of the specified group address.

    • source_address Configures the multicast route traffic count of the specified group and source addresses.
  • bytes Configures the multicast route traffic count to bytes.
  • packets Configures the multicast route traffic count to packets.

Guidelines

This command is supported on the FM6000 platform only.

Examples:
  • This command configures the multicast route traffic count to bytes.
    switch(config)#ip multicast count bytes
  • This command configures the multicast route traffic count of the specified group and source addresses.
    switch(config)#ip multicast count 10.50.30.23 45.67.89.100
  • This command deletes all multicast counters including the routes of group and source addresses.
    switch(config)#no ip multicast count
  • This command reverts the current multicast route configuration to the default state.
    switch(config)#default ip multicast count

ip proxy-arp

The ip proxy-arp command enables proxy ARP on the configuration mode interface. Proxy ARP is disabled by default.

The no ip proxy-arp and default ip proxy-arp commands disable proxy ARP on the configuration mode interface by removing the corresponding ip proxy-arp command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-vlan Configuration

Command Syntax

ip proxy-arp

no ip proxy-arp

default ip proxy-arp

Example:
This command enables proxy ARP on Ethernet interface 4.
switch(config)#interface ethernet 4
switch(config-if-Et4)#ip proxy-arp
switch(config-if-Et4)#

ip route

The ip route command creates a static route. The destination is a network segment; the nexthop address is either an IPv4 address or a routable port. When multiple routes exist to a destination prefix, the route with the lowest administrative distance takes precedence.

By default, the administrative distance assigned to static routes is 1. Assigning a higher administrative distance to a static route configures it to be overridden by dynamic routing data. For example, a static route with an administrative distance value of 200 is overridden by OSPF intra-area routes, which have a default administrative distance of 110.

Tags are used by route maps to filter routes. The default tag value on static routes is 0.

Multiple routes with the same destination and the same administrative distance comprise an Equal Cost Multi-Path (ECMP) route. The switch attempts to spread outbound traffic equally through all ECMP route paths. All paths comprising an ECMP are assigned identical tag values; commands that change the tag value of a path change the tag value of all paths in the ECMP.

The no ip route and default ip route commands delete the specified static route by removing the corresponding ip route command from running-config. Commands that do not list a nexthop address remove all ip route statements with the specified destination from running-config. If an ip route statement exists for the same IP address in multiple VRFs, each must be removed separately. All static routes in a user-defined VRF are deleted when the VRF is deleted.

Command Mode

Global Configuration

Command Syntax

ip route [VRF_INSTANCE]dest_net NEXTHOP [DISTANCE][TAG_OPTION][RT_NAME]

no ip route [VRF_INSTANCE]dest_net [NEXTHOP][DISTANCE]

default ip route [VRF_INSTANCE] dest_net [NEXTHOP][DISTANCE]

Parameters

  • VRF_INSTANCE Specifies the VRF instance being modified.

    • <no parameter> Changes are made to the default VRF.
    • vrf vrf_name Changes are made to the specified VRF.
  • dest_net Destination IPv4 subnet (CIDR or address-mask notation).
  • NEXTHOP Location or access method of next hop device. Options include:

    • ipv4_addr An IPv4 address.
    • null0 Null0 interface.
    • ethernet e_num Ethernet interface specified by e_num.
    • loopback l_num Loopback interface specified by l_num.
    • management m_num Management interface specified by m_num.
    • port-channel p_num Port-channel interface specified by p_num.
    • vlan v_num vlan interface specified by v_num.
    • vxlan vx_num VXLAN interface specified by vx_num.
  • DISTANCE Administrative distance assigned to route. Options include:

    • <no parameter> Route assigned default administrative distance of one.
    • <1-255> The administrative distance assigned to route.
  • TAG_OPTION Static route tag. Options include:

    • <no parameter> Assigns default static route tag of 0.
    • tag t_value Static route tag value. t_value ranges from 0 to 4294967295.
  • RT_NAME Associates descriptive text to the route. Options include:

    • <no parameter> No text is associated with the route.
    • name descriptive_text The specified text is assigned to the route.

Related Command

The ip route nexthop-group command creates a static route that specifies a Nexthop Group to determine the Nexthop address.

Example

This command creates a static route in the default VRF.
switch(config)#ip route 172.17.252.0/24 vlan 2000
switch(config)#

ip routing

The ip routing command enables IPv4 routing. When IPv4 routing is enabled, the switch attempts to deliver inbound packets to destination IPv4 addresses by forwarding them to interfaces or next hop addresses specified by the forwarding table.

The no ip routing and default ip routing commands disable IPv4 routing by removing the ip routing command from running-config. When IPv4 routing is disabled, the switch attempts to deliver inbound packets to their destination MAC addresses. When this address matches the switch’s MAC address, the packet is delivered to the CPU. IP packets with IPv4 destinations that differ from the switch’s address are typically discarded. The delete-static-routes option removes static entries from the routing table.

IPv4 routing is disabled by default.

Command Mode

Global Configuration

Command Syntax

ip routing [VRF_INSTANCE]

no ip routing [DELETE_ROUTES][VRF_INSTANCE

default ip routing [DELETE_ROUTES][VRF_INSTANCE]

Parameters

  • DELETE_ROUTES Resolves routing table static entries when routing is disabled.

    • <no parameter> Routing table retains static entries.
    • delete-static-routes Static entries are removed from the routing table.
  • VRF_INSTANCE Specifies the VRF instance being modified.

    • <no parameter> Changes are made to the default VRF.
    • vrf vrf_name Changes are made to the specified user-defined VRF.

Example:
This command enables IPv4 routing.
switch(config)#ip routing
switch(config)#

ip source binding

IP source guard (IPSG) is supported on Layer 2 Port-Channels, not member ports. The IPSG configuration on port channels supersedes the configuration on the physical member ports. Hence, source IP MAC binding entries should be configured on port channels. When configured on a port channel member port, IPSG does not take effect until this port is deleted from the port channel configuration.

Note: IP source bindings are also used by static ARP inspection.

The no ip source binding and default ip source binding commands exclude parameters from IPSG filtering, and set the default for ip source binding.

Command Mode

Interface-Ethernet Configuration

Command Syntax

ip source binding [IP_ADDRESS][MAC_ADDRESS]vlan [vlan_RANGE] interface [INTERFACE]

no ip source binding [IP_ADDRESS][MAC_ADDRESS] vlan [vlan_RANGE] interface [INTERFACE]

default ip source binding [IP_ADDRESS][MAC_ADDRESS] vlan [vlan_RANGE] interface [INTERFACE]

Parameters

  • IP_ADDRESS Specifies the IP ADDRESS.
  • MAC_ADDRESS Specifies the MAC ADDRESS.
  • vlan_RANGE Specifies the vlan ID range.
  • INTERFACE Specifies the Ethernet interface.

Example:
This command configures source IP-MAC binding entries to IP address 10.1.1.1, MAC address 0000.aaaa.1111, vlan ID 4094, and Ethernet interface 36.
switch(config)#ip source binding 10.1.1.1 0000.aaaa.1111 vlan 4094 interface 
ethernet 36
switch(config)#

ip verify source

The ip verify source command configures IP source guard (IPSG) applicable only to Layer 2 ports. When configured on Layer 3 ports, IPSG does not take effect until this interface is converted to Layer 2.

IPSG is supported on Layer 2 Port-Channels, not member ports. The IPSG configuration on port channels supersedes the configuration on the physical member ports. Therefore, source IP MAC binding entries should be configured on port channels. When configured on a port channel member port, IPSG does not take effect until this port is deleted from the port channel configuration.

The no ip verify source and default ip verify source commands exclude vlan IDs from IPSG filtering, and set the default for ip verify source.

Command Mode

Interface-Ethernet Configuration

Command Syntax

ip verify source vlan [vlan_RANGE]

no ip verify source [vlan_RANGE]

default ip verify source

Parameters

  • vlan_RANGE Specifies the vlan ID range.

Related Commands
Example:
This command excludes vlan IDs 1 through 3 from IPSG filtering. When enabled on a trunk port, IPSG filters the inbound IP packets on all allowed vlans. IP packets received on vlans 4 through 10 on Ethernet 36 will be filtered by IPSG, while those received on vlans 1 through 3 are permitted.
switch(config)#no ip verify source vlan 1-3
switch(config)#interface ethernet 36
switch(config-if-Et36)#switchport mode trunk
switch(config-if-Et36)#switchport trunk allowed vlan 1-10
switch(config-if-Et36)#ip verify source
switch(config-if-Et36)#

ip verify

The ip verify command configures Unicast Reverse Path Forwarding (uRPF) for inbound IPv4 packets on the configuration mode interface. uRPF verifies the accessibility of source IP addresses in packets that the switch forwards.

uRPF defines two operational modes: strict mode and loose mode.

  • Strict mode: uRPF verifies that a packet is received on the interface that its routing table entry specifies for its return packet.
  • Loose mode: uRPF validation does not consider the inbound packet’s ingress interface only that there is a valid return path.

The no ip verify and default ip verify commands disable uRPF on the configuration mode interface by deleting the corresponding ip verify command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-Channel Configuration

Interface-vlan Configuration

Command Syntax

ip verify unicast source reachable-via RPF_MODE

no ip verify unicast

default ip verify unicast

Parameters

  • RPF_MODE Specifies the uRPF mode. Options include:

    • any Loose mode.
    • rx Strict mode.
    • rx allow-default Strict mode. All inbound packets are forwarded if a default route is defined.

Guidelines

The first IPv4 uRPF implementation briefly disrupts IPv4 unicast routing. Subsequent ip verify commands on any interface do not disrupt IPv4 routing.

Examples:
  • This command enables uRPF loose mode on vlan interface 17.
    switch(config)#interface vlan 17
    switch(config-if-Vl17)#ip verify unicast source reachable-via any
    switch(config-if-Vl17)#show active
     interface vlan17
     ip verify unicast source reachable-via any
    switch(config-if-Vl17)#
  • This command enables uRPF strict mode on vlan interface 18.
    switch(config)#interface vlan 18
    switch(config-if-Vl18)#ip verify unicast source reachable-via rx
    switch(config-if-Vl18)#show active
     interface vlan18
     ip verify unicast source reachable-via rx
    switch(config-if-Vl18)#

ipv4 routable 240.0.0.0/4

The ipv4 routable 240.0.0.0/4 command assignes an class E addresses to an interface. When configured, the class E address traffic are routed through BGP, OSPF, ISIS, RIP, static routes and programmed to the FIB and kernel. By default, this command is disabled.

The no ipv4 routable 240.0.0.0/4 and default ipv4 routable 240.0.0.0/4 commands disable IPv4 Class E routing by removing the ipv4 routable 240.0.0.0/4 command from running-config.

IPv4 routable 240.0.0.0/4 routing is disabled by default.

Command Mode

Router General Configuration

Command Syntax

ipv4 routable 240.0.0.0/4

no ipv4 routable 240.0.0.0/4

default ipv4 routable 240.0.0.0/4

Example:
  • These commands configure an IPv4 Class E (240/4) address to an interface.
    switch(config)#router general
    switch(config-router-general)#ipv4 routable 240.0.0.0/4

platform trident forwarding-table partition

The platform trident forwarding-table partition command provides a shared table memory for L2, L3 and algorithmic LPM entries that can be partitioned in different ways.

Instead of having fixed-size tables for L2 MAC entry tables, L3 IP forwarding tables, and Longest Prefix Match (LPM) routes, the tables can be unified into a single shareable forwarding table.

Note: Changing the Unified Forwarding Table mode causes the forwarding agent to restart, briefly disrupting traffic forwarding on all ports.

The no platform trident forwarding-table partition and default platform trident forwarding-table partition commands remove the platform trident forwarding-table partition command from running-config.

Command Mode

Global Configuration

Command Syntax

platform trident forwarding-table partition SIZE

no platform trident forwarding-table partition

default platform trident forwarding-table partition

Parameters

  • SIZE Size of partition. Options include:

    • 0 288k l2 entries, 16k host entries, 16k lpm entries
    • 1 224k l2 entries, 80k host entries, 16k lpm entries
    • 2 160k l2 entries, 144k host entries, 16k lpm entries
    • 3 96k l2 entries, 208k host entries, 16k lpm entries

    The default value is 2 (160k l2 entries, 144k host entries, 16k lpm entries).

Examples:
  • This command sets the single shareable forwarding table to option 2 that supports 160k L2 entries, 144k host entries, and 16k LPM entries.
    switch(config)#platform trident forwarding-table partition 2
    switch(config)
  • This command sets the single shareable forwarding table to option 3 that supports 96k L2 entries, 208k host entries, and 16k LPM entries. Since the switch was previously configured to option 2, you’ll see a warning notice before the changes are implemented.
    #switch(config)#platform trident forwarding-table partition 3
    
    Warning: StrataAgent will restart immediately

platform trident routing-table partition

The platform trident routing-table partition command manages the partition sizes for the hardware LPM table that stores IPv6 routes of varying sizes.

An IPv6 route of length /64 (or shorter) requires half the hardware resources of an IPv6 route that is longer than /64. The switch installs routes of varying lengths in different table partitions. This command specifies the size of these partitions to optimize table usage.

Note: Changing the routing table partition mode causes the forwarding agent to restart, briefly disrupting traffic forwarding on all ports.

The no platform trident routing-table partition and default platform trident routing-table partition commands restore the default partitions sizes by removing the platform trident routing-table partition command from running-config.

Command Mode

Global Configuration

Command Syntax

platform trident routing-table partition SIZE

no platform trident routing-table partition

default platform trident routing-table partition

Parameters

  • SIZE Size of partition. Options include:

    • 1 16k IPv4 entries, 6k IPv6 (/64 and smaller) entries, 1k IPv6 (any prefix length)
    • 2 16k IPv4 entries, 4k IPv6 (/64 and smaller) entries, 2k IPv6 (any prefix length)
    • 3 16k IPv4 entries, 2k IPv6 (/64 and smaller) entries, 3k IPv6 (any prefix length)

    The default value is 2 (16k IPv4 entries, 4k IPv6 (/64 and smaller) entries, 2k IPv6 (any prefix length).

Restrictions

Partition allocation cannot be changed from the default setting when uRPF is enabled for IPv6 traffic.

Example:
This command sets the shareable routing table to option 1 that supports 6K prefixes equal to or shorter than /64 and 1K prefixes longer than /64.
switch(config)#platform trident routing-table partition 1
switch(config)

rib fib policy

The rib fib policy command enables FIB policy for a particular VRF under router general configuration mode.The FIB policy can be configured to advertise only specific RIB routes and exclude all other routes.

For example, a FIB policy can be configured that will not place routes associated with a specific origin in the routing table. These routes will not be used to forward data packets and these routes are not advertised by the routing protocol to neighbors.

The no rib fib policy and default rib fib policy commands restore the switch to its default state by removing the corresponding rib fib policy command from running-config .

Command Mode

Router General Configuration

Command Syntax

rib [ipv4 | ipv6] fib policy name

no rib [ipv4 | ipv6] fib policy name

default rib [ipv4 | ipv6] fib policy name

Parameters

  • ipv4 IPv4 configuration commands.
  • ipv6 IPv6 configuration commands.
  • name Route map name.

Example:
The following example enables FIB policy for IPv4 in the default VRF, using the route map, map1.
Switch(config)#router general
Switch(config-router-general)#vrf default
Switch(config-router-general-vrf-default)#rib ipv4 fib policy map1

show arp

The show arp command displays all ARP tables. This command differs from the show ip arp command in that it shows MAC bindings for all protocols, whereas show ip arp only displays MAC address – IP address bindings. Addresses are displayed as their host name by including the resolve argument.

Command Mode

EXEC

show arp [VRF_INST][FORMAT][HOST_ADD][HOST_NAME][INTF][MAC_ADDR][DATA]

Parameters

The VRF_INST and FORMAT parameters are always listed first and second. The DATA parameter is always listed last. All other parameters can be placed in any order.

  • VRF_INST Specifies the VRF instance for which data is displayed.

    • <no parameter> Context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
  • FORMAT Displays format of host address. Options include:

    • <no parameter> Entries associate hardware address with an IPv4 address.
    • resolve Enter associate hardware address with a host name (if it exists).
  • HOST_ADD IPv4 address by which routing table entries are filtered. Options include:

    • <no parameter> Routing table entries are not filtered by host address.
    • ipv4_addr Table entries matching specified IPv4 address.
  • HOST_NAME Host name by which routing table entries are filtered. Options include:

    • <no parameter> Routing table entries are not filtered by host name.
    • host hostname Entries matching hostname (text).
  • INTF Interfaces for which command displays status.

    • <no parameter> Routing table entries are not filtered by interface.
    • interface ethernet e_num Routed Ethernet interface specified by e_num.
    • interface loopback l_num Routed loopback interface specified by l_num.
    • interface management m_num Routed management interface specified by m_num.
    • interface port-channel p_num Routed port channel Interface specified by p_num.
    • interface vlan v_num vlan interface specified by v_num.
    • interface vxlan vx_num VXLAN interface specified by vx_num.
  • MAC_ADDR MAC address by which routing table entries are filtered. Options include:

    • <no parameter> Routing table entries are not filtered by interface MAC address.
    • mac_address mac_address Entries matching mac_address (dotted hex notation – H.H.H).
  • DATA Detail of information provided by command. Options include:

    • <no parameter> Routing table entries.
    • summary Summary of ARP table entries.
    • summary total Number of ARP table entries.

Related Commands
  • cli vrf specifies the context-active VRF.

Example:
This command displays the ARP table.
switch>show arp
Address Age (min)Hardware Addr Interface
172.22.30.1 0001c.730b.1d15Management1
172.22.30.133 0001c.7304.3906Management1
switch>

show interface tunnel

The show interface tunnel command displays the interface tunnel information.

Command Mode

EXEC

Command Syntax

show interface tunnel <number>

Parameter

  • number Specifies the tunnel interface number.

Example:
This command displays tunnel interface configuration information for tunnel interface 10.
switch#show interface tunnel 10

Tunnel10 is up, line protocol is up (connected)
 Hardware is Tunnel, address is 0a01.0101.0800
 Internet address is 192.168.1.1/24
 Broadcast address is 255.255.255.255
 Tunnel source 10.1.1.1, destination 10.1.1.2
 Tunnel protocol/transport GRE/IP
 Key disabled, sequencing disabled
 Checksumming of packets disabled
 Tunnel TTL 10, Hardware forwarding enabled
 Tunnel TOS 10
 Path MTU Discovery
 Tunnel transport MTU 1476 bytes
 Up 3 seconds 

show ip arp inspection statistics

The show ip arp inspection statistics command displays the statistics of inspected ARP packets. For a vlan specified, only vlans with ARP inspection enabled will be displayed. If no vlan is specified, all vlans with ARP inspection enabled are displayed.

Command Mode

EXEC

Command Syntax

show ip arp inspection statistics [vlan [VID]|[INTERFACE] interface < intf_slot/intf_port>]

Parameters

  • VID Specifies the vlan interface ID.
  • INTERFACE Specifies the interface (e.g., Ethernet).

    • <intf_slot> Interface slot.
    • <intf_port> Interface port.
  • INTF Specifies the vlan interface slot and port.

Examples:
  • This command display statistics of inspected ARP packets for vlan 10.
    switch(config)#show ip arp inspection statistics vlan 10
    
    vlan : 10
    --------------
    ARP
    Req Forwarded = 20
    ARP Res Forwarded = 20
    ARP Req Dropped = 1
    ARP Res Dropped = 1
    Last invalid ARP:
    Time: 10:20:30 ( 5 minutes ago )
    Reason: Bad IP/Mac match
    Received on: Ethernet 3/1
    Packet:
      Source MAC: 00:01:00:01:00:01
      Dest MAC: 00:02:00:02:00:02
      ARP Type: Request
      ARP Sender MAC: 00:01:00:01:00:01
      ARP Sender IP: 1.1.1
    
    switch(config)#
  • This command displays ARP inspection statistics for Ethernet interface 3/1.
    switch(config)#show ip arp inspection statistics ethernet interface 3/1
    Interface : 3/1
    --------
    ARP Req Forwarded = 10
    ARP Res Forwarded = 10
    ARP Req Dropped = 1
    ARP Res Dropped = 1
    
    Last invalid ARP:
    Time: 10:20:30 ( 5 minutes ago )
    Reason: Bad IP/Mac match
    Received on: vlan 10
    Packet:
      Source MAC: 00:01:00:01:00:01
      Dest MAC: 00:02:00:02:00:02
      ARP Type: Request
      ARP Sender MAC: 00:01:00:01:00:01
      ARP Sender IP: 1.1.1
    
    switch(config)#

show ip arp inspection vlan

The show ip arp inspection vlan command displays the configuration and operation state of ARP inspection. For a vlan range specified, only vlans with ARP inspection enabled will be displayed. If no vlan is specified, all vlans with ARP inspection enabled are displayed. The operation state turns to Active when hardware is ready to trap ARP packets for inspection.

Command Mode

EXEC

Command Syntax

show ip arp inspection vlan [LIST]

Parameters

  • LIST Specifies the vlan interface number.

Example:
This command displays the configuration and operation state of ARP inspection for vlans 1 through 150.
switch(config)#show ip arp inspection vlan 1 - 150

vlan 1
----------
Configuration
: Enabled
Operation State : Active
vlan 2
----------
Configuration
: Enabled
Operation State : Active
{...}
vlan 150
----------
Configuration
: Enabled
Operation State : Active

switch(config)#

show ip arp

The show ip arp command displays ARP cache entries that map an IPv4 address to a corresponding MAC address. The table displays addresses by their host names when the command includes the resolve argument.

Command Mode

EXEC

Command Syntax

show ip arp [VRF_INST][FORMAT][HOST_ADD][HOST_NAME][INTF][MAC_ADDR][DATA]

Parameters

The VRF_INST and FORMAT parameters are always listed first and second. The DATA parameter is always listed last. All other parameters can be placed in any order.

  • VRF_INST Specifies the VRF instance for which data is displayed.

    • <no parameter> Context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
  • FORMAT Displays format of host address. Options include:

    • <no parameter> Entries associate hardware address with an IPv4 address.
    • resolve Enter associate hardware address with a host name (if it exists).
  • HOST_ADDR IPv4 address by which routing table entries are filtered. Options include:

    • <no parameter> Routing table entries are not filtered by host address.
    • ipv4_addr Table entries matching specified IPv4 address.
  • HOST_NAME Host name by which routing table entries are filtered. Options include:

    • <no parameter> Routing table entries are not filtered by host name.
    • host hostname Entries matching hostname (text).
  • INTERFACE_NAME Interfaces for which command displays status.

    • <no parameter> Routing table entries are not filtered by interface.
    • interface ethernet e_num Routed Ethernet interface specified by e_num.
    • interface loopback l_num Routed loopback interface specified by l_num.
    • interface management m_num Routed management interface specified by m_num.
    • interface port-channel p_num Routed port channel Interface specified by p_num.
    • interface vlan v_num vlan interface specified by v_num.
    • interface vxlan vx_num VXLAN interface specified by vx_num.
  • MAC_ADDR MAC address by which routing table entries are filtered. Options include:

    • <no parameter> Routing table entries are not filtered by interface MAC address.
    • mac_address mac_address entries matching mac_address (dotted hex notation – H.H.H).
  • DATA Detail of information provided by command. Options include:

    • <no parameter> Routing table entries.
    • summarySummary of ARP table entries.
    • summary total Number of ARP table entries.

Related Commands
  • cli vrf specifies the context-active VRF.

Examples:
  • This command displays ARP cache entries that map MAC addresses to IPv4 addresses.
    switch>show ip arp
    
    Address Age (min)Hardware Addr Interface
    172.25.0.20  004c.6211.021evlan101, Port-Channel2
    172.22.0.10  004c.6214.3699vlan1000, Port-Channel1
    172.22.0.20  004c.6219.a0f3vlan1000, Port-Channel1
    172.22.0.30  0045.4942.a32cvlan1000, Ethernet33
    172.22.0.50  f012.3118.c09dvlan1000, Port-Channel1
    172.22.0.60  00e1.d11a.a1ebvlan1000, Ethernet5
    172.22.0.70  004f.e320.cd23vlan1000, Ethernet6
    172.22.0.80  0032.48da.f9d9vlan1000, Ethernet37
    172.22.0.90  0018.910a.1fc5vlan1000, Ethernet29
    172.22.0.11 0  0056.cbe9.8510vlan1000, Ethernet26
    switch>
  • This command displays ARP cache entries that map MAC addresses to IPv4 addresses. Host names assigned to IP addresses are displayed in place of the address.
    switch>show ip arp resolve
    
    Address Age (min)Hardware Addr Interface
    green-vl101.new         0  004c.6211.021evlan101, Port-Channel2
    172.22.0.10  004c.6214.3699vlan1000, Port-Channel1
    orange-vl1000.n         0  004c.6219.a0f3vlan1000, Port-Channel1
    172.22.0.30  0045.4942.a32cvlan1000, Ethernet33
    purple.newcompa         0  f012.3118.c09dvlan1000, Port-Channel1
    pink.newcompany         0  00e1.d11a.a1ebvlan1000, Ethernet5
    yellow.newcompa         0  004f.e320.cd23vlan1000, Ethernet6
    172.22.0.80  0032.48da.f9d9vlan1000, Ethernet37
    royalblue.newco         0  0018.910a.1fc5vlan1000, Ethernet29
    172.22.0.11 0  0056.cbe9.8510vlan1000, Ethernet26
    switch>

show ip dhcp relay counters

The show ip dhcp relay counters command displays the number of DHCP packets received, forwarded, or dropped on the switch and on all interfaces enabled as DHCP relay agents.

Command Mode

EXEC

Command Syntax

show ip dhcp relay counters

Example:
This command displays the IP DHCP relay counter table.
switch>show ip dhcp relay counters

|Dhcp Packets|
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|---------------------
All Req |3763760 | 4 days, 19:55:12 ago
 All Resp |2772770 |
||
 vlan1000 |000 | 4 days, 19:54:24 ago
 vlan1036 |3762770 | 4 days, 19:54:24 ago

switch>

show ip dhcp relay

The show ip dhcp relay command displays the DHCP relay agent configuration status on the switch.

Command Mode

EXEC

Command Syntax

show ip dhcp relay

Example:
This command displays the DHCP relay agent configuration status.
switch>show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: vlan100
DHCP Smart Relay is disabled
DHCP servers: 10.4.4.4
switch>

show ip dhcp snooping counters

The show ip dhcp snooping counters command displays counters that track the quantity of DHCP request and reply packets that the switch receives. Data is either presented for each vlan or aggregated for all vlans with counters for packets dropped.

Command Mode

EXEC

Command Syntax

show ip dhcp snooping counters [COUNTER_TYPE]

Parameters

  • COUNTER_TYPE The type of counter that the command resets. Formats include:

    • <no parameter> Command displays counters for each vlan.
    • debug Command displays aggregate counters and drop cause counters.

Examples:
  • This command displays the number of DHCP packets sent and received on each vlan.
    switch>show ip dhcp snooping counters
    
     | Dhcp Request Pkts | Dhcp Reply Pkts |
    vlan |RcvdFwddDrop | Rcvd FwddDrop | Last Cleared
    -----|------ ----- ------|----- ---- ------|-------------
     100 | 0 0 0 |00 0 |0:35:39 ago
    
    switch>
    
  • This command displays the number of DHCP packets sent on the switch.
    switch>show ip dhcp snooping counters debug
    Counter Snooping to Relay Relay to Snooping
    ----------------------------- ----------------- -----------------
    Received0 0
    Forwarded 0 0
    Dropped - Invalid vlanId0 0
    Dropped - Parse error 0 0
    Dropped - Invalid Dhcp Optype 0 0
    Dropped - Invalid Info Option 0 0
    Dropped - Snooping disabled 0 0
    
    Last Cleared:3:37:18 ago
    switch>

show ip dhcp snooping hardware

The show ip dhcp snooping hardware command displays internal hardware DHCP snooping status on the switch.

Command Mode

EXEC

Command Syntax

show ip dhcp snooping hardware

Example:

This command DHCP snooping hardware status.

switch>show ip dhcp snooping hardware
DHCP Snooping is enabled
DHCP Snooping is enabled on following vlans:
None
vlans enabled per Slice
Slice:FixedSystem
None
switch>

show ip dhcp snooping

The show ip dhcp snooping command displays the DHCP snooping configuration.

Command Mode

EXEC

Command Syntax

show ip dhcp snooping

Related Commands

Example:
This command displays the switch’s DHCP snooping configuration.
switch>show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following vlans:
100
DHCP Snooping is operational on following vlans:
100
Insertion of Option-82 is enabled
Circuit-id format: Interface name:vlan ID
Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch>

show ip interface brief

Use the show ip interface brief command output to display the status summary of the specified interfaces that are configured as routed ports. The command provides the following information for each specified interface:

  • IP address
  • Operational status
  • Line protocol status
  • MTU size

Command Mode

EXEC

Command Syntax

show ip interface [INTERFACE_NAME][VRF_INST] brief

Parameters
  • INTERFACE_NAME Interfaces for which command displays status.

    • <no parameter> All routed interfaces.
    • ipv4_addr Neighbor IPv4 address.
    • ethernet e_range Routed Ethernet interfaces specified by e_range.
    • loopback l_range Routed loopback interfaces specified by l_range.
    • management m_range Routed management interfaces specified by m_range.
    • port-channel p_range Routed port channel Interfaces specified by p_range.
    • vlan v_range vlan interfaces specified by v_range.
    • vxlan vx_range VXLAN interface range specified by vx_range.
  • VRF_INST Specifies the VRF instance for which data is displayed.

    • <no parameter> Context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.

Example:
This command displays the summary status of vlan interfaces 900-910.
switch>show ip interface vlan 900-910 brief

! Some interfaces do not exist
InterfaceIP Address Status Protocol MTU
vlan901170.33.254.1/30up up9212
vlan902170.33.254.14/29 up up9212
vlan905170.33.254.17/29 up up1500
vlan907170.33.254.67/29 up up9212
vlan910170.33.254.30/30 up up9212

show ip interface

The show ip interface command displays the status of specified interfaces that are configured as routed ports. The command provides the following information:

  • Interface description
  • Internet address
  • Broadcast address
  • Address configuration method
  • Proxy-ARP status
  • MTU size

Command Mode

EXEC

Command Syntax

show ip interface [INTERFACE_NAME][VRF_INST]

Parameters
  • INTERFACE_NAME Interfaces for which command displays status.

    • <no parameter> All routed interfaces.
    • ipv4_addr Neighbor IPv4 address.
    • ethernet e_range Routed Ethernet interfaces specified by e_range.
    • loopback l_range Routed loopback interfaces specified by l_range.
    • management m_range Routed management interfaces specified by m_range.
    • port-channel p_range Routed port channel Interfaces specified by p_range.
    • vlan v_range vlan interfaces specified by v_range.
    • vxlan vx_range VXLAN interfaces specified by vx_range.
  • VRF_INST Specifies the VRF instance for which data is displayed.

    • <no parameter> Context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.

Example:
  • This command displays IP status of configured vlan interfaces numbered between 900 and 910.
    switch>show ip interface vlan 900-910
    ! Some interfaces do not exist
    vlan901 is up, line protocol is up (connected)
    Description: ar.pqt.mlag.peer
    Internet address is 170.23.254.1/30
    Broadcast address is 255.255.255.255
    Address determined by manual configuration
    Proxy-ARP is disabled
    MTU 9212 bytes
    vlan903 is up, line protocol is up (connected)
    Description: ar.pqt.rn.170.23.254.16/29
    Internet address is 170.23.254.19/29
    Broadcast address is 255.255.255.255
    Address determined by manual configuration
    Proxy-ARP is disabled
    MTU 9212 bytes
  • This command displays the configured TCP maximum segment size (MSS) ceiling value of 1436 bytes for an Ethernet interface 25.
    switch>show ip interface ethernet 25
    Ethernet25 is up, line protocol is up (connected)
    Internet address is 10.1.1.1/24
    Broadcast address is 255.255.255.255
    IPv6 Interface Forwarding : None
    Proxy-ARP is disabled
    Local Proxy-ARP is disabled
    Gratuitous ARP is ignored
    IP MTU 1500 bytes
    IPv4 TCP MSS egress ceiling is 1436 bytes

show ip route age

The show ip route age command displays the time when the route for the specified network was present in the routing table. It does not account for the changes in parameters like metric, next-hop etc.

Command Mode

EXEC

Command Syntax

show ip route ADDRESS age

Parameters
  • ADDRESS Filters routes by IPv4 address or subnet.

    • ipv4_addr Routing table entries matching specified address.
    • ipv4_subnet Routing table entries matching specified subnet (CIDR or address-mask).

Example:
This command shows the amount of time since the last update to ip route 172.17.0.0/20.
switch>show ip route 172.17.0.0/20 age
Codes: C - connected, S - static, K - kernel,
 O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
 E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
 N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
 R - RIP, I - ISIS, A - Aggregate

 B E172.17.0.0/20 via 172.25.0.1, age 3d01h
switch>

show ip route gateway

The show ip route gateway command displays IP addresses of all gateways (next hops) used by active routes.

Command Mode

EXEC

Command Syntax

show ip route [VRF_INSTANCE] gateway

Parameters
  • VRF_INSTANCE Specifies the VRF instance for which data is displayed.

    • <no parameter> Context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.

Related Commands
  • cli vrf specifies the context-active VRF.

Example:
This command displays next hops used by active routes.
switch>show ip route gateway
The following gateways are in use:
 172.25.0.1 vlan101
 172.17.253.2 vlan3000
 172.17.254.2 vlan3901
 172.17.254.11 vlan3902
 172.17.254.13 vlan3902
 172.17.254.17 vlan3903
 172.17.254.20 vlan3903
 172.17.254.66 vlan3908
 172.17.254.67 vlan3908
 172.17.254.68 vlan3908
 172.17.254.29 vlan3910
 172.17.254.33 vlan3911
 172.17.254.35 vlan3911
 172.17.254.105 vlan3912
 172.17.254.86 vlan3984
 172.17.254.98 vlan3992
 172.17.254.99 vlan3992
switch>

show ip route host

The show ip route host command displays all host routes in the host forwarding table. Host routes are those whose destination prefix is the entire address (mask = 255.255.255.255 or prefix = /32). Each entry includes a code of the route’s purpose:

  • F static routes from the FIB.
  • R routes defined because the IP address is an interface address.
  • B broadcast address.
  • A routes to any neighboring host for which the switch has an ARP entry.

Command Mode

EXEC

Command Syntax

show ip route [VRF_INSTANCE] host

Parameters
  • VRF_INSTANCE Specifies the VRF instance for which data is displayed.

    • <no parameter> Context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.

Related Commands
  • cli vrf specifies the context-active VRF.
Example:
This command displays all host routes in the host forwarding table.
switch>show ip route host
R - receive B - broadcast F - FIB, A - attached

F 127.0.0.1 to cpu
B 172.17.252.0 to cpu
A 172.17.253.2 on vlan2000
R 172.17.253.3 to cpu
A 172.17.253.10 on vlan2000
B 172.17.253.255 to cpu
B 172.17.254.0 to cpu
R 172.17.254.1 to cpu
B 172.17.254.3 to cpu
B 172.17.254.8 to cpu
A 172.17.254.11 on vlan2902
R 172.17.254.12 to cpu

F 172.26.0.28 via 172.17.254.20 on vlan3003
via 172.17.254.67 on vlan3008
via 172.17.254.98 on vlan3492
                via 172.17.254.2 on vlan3601
via 172.17.254.13 on vlan3602
via 172.17.253.2 on vlan3000
F 172.26.0.29 via 172.25.0.1 on vlan101
F 172.26.0.30 via 172.17.254.29 on vlan3910
F 172.26.0.32 via 172.17.254.105 on vlan3912
switch>

show ip route match tag

The show ip route match tag command displays the route tag assigned to the specified IPv4 address or subnet. Route tags are added to static routes for use by route maps.

Command Mode

EXEC

Command Syntax

show ip route [VRF_INSTANCE] ADDRESS match tag

Parameters
  • VRF_INSTANCE Specifies the VRF instance for which data is displayed.

    • <no parameter> Context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
  • ADDRESS Displays routes of specified IPv4 address or subnet.

    • ipv4_addr Routing table entries matching specified IPv4 address.
    • ipv4_subnet Routing table entries matching specified IPv4 subnet (CIDR or address-mask).

Example:
This command displays the route tag for the specified subnet.
switch>show ip route 172.17.50.0/23 match tag
Codes: C - connected, S - static, K - kernel,
 O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
 E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
 N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
 R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
 O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
 NG - Nexthop Group Static Route, V - VXLAN Control Service,
 DH - DHCP client installed default route, M - Martian

 O E2 172.17.50.0/23 tag 0

switch>

show ip route summary

The show ip route summary command displays the number of routes, categorized by destination prefix, in the routing table.

Command Mode

EXEC

Command Syntax

show ip route [VRF_INSTANCE] summary Parameters
  • VRF_INSTANCE Specifies the VRF instance for which data is displayed.

    • <no parameter> Context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.

Example:
This command displays a summary of the routing table contents.
switch>show ip route summary
Route Source Number Of Routes
-------------------------------------
connected 15
static 0
ospf74
Intra-area: 32 Inter-area:33 External-1:0 External-2:9
NSSA External-1:0 NSSA External-2:0
bgp7
External: 6 Internal: 1
internal45
attached18
aggregate0
switch>

show ip route

The show ip route command displays routing table entries that are in the Forwarding Information Base (FIB), including static routes, routes to directly connected networks, and dynamically learned routes. Multiple equal-cost paths to the same prefix are displayed contiguously as a block, with the destination prefix displayed only on the first line.

The show running-config command displays configured commands not in the FIB.

Command Mode

EXEC

Command Syntax

show ip route [VRF_INSTANCE][ADDRESS][ROUTE_TYPE][INFO_LEVEL][PREFIX]

Parameters

The VRF_INSTANCE and ADDRESS parameters are always listed first and second, respectively. All other parameters can be placed in any order.

  • VRF_INSTANCE Specifies the VRF instance for which data is displayed.

    • <no parameter> Context-active VRF.
    • vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
  • ADDRESS Filters routes by IPv4 address or subnet.

    • <no parameter> All routing table entries.
    • ipv4_addr Routing table entries matching specified address.
    • ipv4_subnet Routing table entries matching specified subnet (CIDR or address-mask).
  • ROUTE_TYPE Filters routes by specified protocol or origin. Options include:

    • <no parameter> All routing table entries.
    • aggregate Entries for BGP aggregate routes.
    • bgp Entries added through BGP protocol.
    • connected Entries for routes to networks directly connected to the switch.
    • isis Entries added through ISIS protocol.
    • kernel Entries appearing in Linux kernel but not added by eos software.
    • ospf Entries added through OSPF protocol.
    • rip Entries added through RIP protocol.
    • static Entries added through CLI commands.
    • vrf Displays routes in a VRF.
  • INFO_LEVEL Filters entries by next hop connection. Options include:

    • <no parameter> Filters routes whose next hops are directly connected.
    • detail Displays all routes.
  • PREFIX Filters routes by prefix.

    • <no parameter> Specific route entry that matches the ADDRESS parameter.
    • longer-prefixes All subnet route entries in range specified by ADDRESS parameter.

Related Commands
  • cli vrf specifies the context-active VRF.

Examples:
  • This command displays IPv4 routes learned through BGP.
    switch>show ip route bgp
    Codes: C - connected, S - static, K - kernel,
     O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
     E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
     N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
     R - RIP, A - Aggregate
    
     B E170.44.48.0/23 [20/0] via 170.44.254.78
     B E170.44.50.0/23 [20/0] via 170.44.254.78
     B E170.44.52.0/23 [20/0] via 170.44.254.78
     B E170.44.54.0/23 [20/0] via 170.44.254.78
     B E170.44.254.112/30 [20/0] via 170.44.254.78
     B E170.53.0.34/32 [1/0] via 170.44.254.78
     B I170.53.0.35/32 [1/0] via 170.44.254.2
     via 170.44.254.13
     via 170.44.254.20
     via 170.44.254.67
     via 170.44.254.35
     via 170.44.254.98
    
  • This command displays the unicast IP routes installed in the system.
    switch#show ip route
     VRF name: default
    Codes: C - connected, S - static, K - kernel,
     O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
     E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
     N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
     R - RIP, I - ISIS, A B - BGP Aggregate, A O - OSPF Summary,
     NG - Nexthop Group Static Route
    
    Gateway of last resort is not set
     C 10.1.0.0/16 is directly connected, vlan2659
     C 10.2.0.0/16 is directly connected, vlan2148
     C 10.3.0.0/16 is directly connected, vlan2700
     S 172.17.0.0/16 [1/0] via 172.24.0.1, Management1
     S 172.18.0.0/16 [1/0] via 172.24.0.1, Management1
     S 172.19.0.0/16 [1/0] via 172.24.0.1, Management1
     S 172.20.0.0/16 [1/0] via 172.24.0.1, Management1
     S 172.22.0.0/16 [1/0] via 172.24.0.1, Management1
     C 172.24.0.0/18 is directly connected, Management1
    
  • This command displays the leaked routes from a source VRF.
    switch#show ip route vrf VRF2 20.0.0.0/8
    ...
    S L20.0.0.0/8 [1/0] (source VRF VRF1) via 10.1.2.10, Ethernet1

show ip verify source

The show ip verify source command displays the IP source guard (IPSG) configuration, operational states, and IP-MAC binding entries for the configuration mode interface.

Command Mode

EXEC

Command Syntax

show ip verify source [vlan | DETAIL]

Parameters
  • vlan Displays all vlans configured in no ip verify source vlan.
  • DETAIL Displays all source IP-MAC binding entries configured for IPSG.

Related Commands
Examples:
  • This command verifies the IPSG configuration and operational states.
    switch(config)#show ip verify source
    Interface       Operational State
    --------------- ------------------------
    Ethernet1       IP source guard enabled
    Ethernet2       IP source guard disabled
  • This command displays all vlans configured in no ip verify source vlan. Hardware programming errors, e.g.,vlan classification failed, are indicated in the operational state. If an error occurs, this vlan will be considered as enabled for IPSG. Traffic on this vlan will still be filtered by IPSG.
    switch(config)#show ip verify source vlan
    IPSG disabled on vlanS: 1-2
    vlan            Operational State
    --------------- ------------------------
    1               IP source guard disabled
    2               Error: vlan classification failed
  • This command displays all source IP-MAC binding entries configured for IPSG. A source binding entry is considered active if it is programmed in hardware. IP traffic matching any active binding entry will be permitted. If a source binding entry is configured on an interface or a vlan whose operational state is IPSG disabled, this entry will not be installed in the hardware, in which case an “IP source guard disabled” state will be shown. If a port channel has no member port configured, binding entries configured for this port channel will not be installed in hardware, and a “Port-Channel down” state will be shown.
    switch(config)#show ip verify source detail
    Interface       IP Address    MAC Address      vlan   State
    --------------- ------------- ---------------- ------ ------------------------
    Ethernet1       10.1.1.1      0000.aaaa.1111   5      active
    Ethernet1       10.1.1.5      0000.aaaa.5555   1      IP source guard disabled
    Port-Channel1   20.1.1.1      0000.bbbb.1111   4      Port-Channel down

show ip

The show ip command displays IPv4 routing, IPv6 routing, IPv4 multicast routing, and VRRP status on the switch.

Command Mode

EXEC

Command Syntax

show ip

Example:
This command displays IPv4 routing status.
switch>show ip

IP Routing : Enabled
IP Multicast Routing : Disabled
VRRP: Configured on 0 interfaces

IPv6 Unicast Routing : Enabled
IPv6 ECMP Route support : False
IPv6 ECMP Route nexthop index: 5
IPv6 ECMP Route num prefix bits for nexthop index: 10

switch>

show platform arad ip route summary

The show platform arad ip route summary command shows hardware resource usage of IPv4 routes.

Command Mode

EXEC

Command Syntax

show platform arad ip route summary

Related Commands

Example:
This command shows hardware resource usage of IPv4 routes.
switch(config)#show platform arad ip route summary
Total number of VRFs: 1
Total number of routes: 25
Total number of route-paths: 21
Total number of lem-routes: 4

switch(config)#

show platform arad ip route

The show platform arad ip route command shows resources for all IPv4 routes in hardware. Routes that use the additional hardware resources will appear with an asterisk.

Command Mode

EXEC

Command Syntax

show platform arad ip route

Examples:
  • This command displays the platform unicast forwarding routes. In this example, the ACL label field in the following table is 4094 by default for all routes. If an IPv4 egress RACL is applied to an SVI, all routes corresponding to that vlan will have an ACL label value. In this case, the ACL Label field value is 2.
    switch#show platform arad ip route
     Tunnel Type: M(mpls), G(gre)
     
    -------------------------------------------------------------------------------
    |Routing Table| 
    |
    |------------------------------------------------------------------------------
    |VRF| Destination||| | Acl | | 
    ECMP| FEC | Tunnel
    | ID| Subnet | Cmd| Destination| VID | Label |MAC / CPU 
    Code |Index|Index|T Value
     
    -------------------------------------------------------------------------------
    |0|0.0.0.0/8 |TRAP | CoppSystemL3DstMiss|0| - | ArpTrap | - |1031 | -
    |0|10.1.0.0/16 |TRAP | CoppSystemL3DstMiss|2659 | - | ArpTrap | - |1030 | -
    |0|10.2.0.0/16 |TRAP | CoppSystemL3DstMiss|2148 | - | ArpTrap | - |1026 | -
    |0|172.24.0.0/18 |TRAP | CoppSystemL3DstMiss|0| - | ArpTrap | - |1032 | -
    |0|0.0.0.0/0 |TRAP | CoppSystemL3LpmOver|0| - | SlowReceive | - 
    |1024 | -
    |0|10.1.0.0/32*|TRAP | CoppSystemIpBcast|0| - | BcastReceive | - 
    |1027 | -
    |0|10.1.0.1/32*|TRAP | CoppSystemIpUcast|0| - | Receive | - |32766| -
    |0|10.1.255.1/32*|ROUTE| Po1|2659 |4094 | 00:1f:5d:6b:ce:45 
    | - |1035 | -
    |0|10.1.255.255/32*|TRAP | CoppSystemIpBcast|0| - | BcastReceive | - 
    |1027 | -
    |0|10.3.0.0/32*|TRAP | CoppSystemIpBcast|0| - | BcastReceive | - 
    |1027 | -
    |0|10.3.0.1/32*|TRAP | CoppSystemIpUcast|0| - | Receive | - |32766| -
    |0|10.3.255.1/32*|ROUTE| Et18 |2700 |2 | 00:1f:5d:6b:00:01 
    | - |1038 | -
    ...........................................................
    
  • Related Commands
  • This command shows resources for all IPv4 routes in hardware. Routes that use the additional hardware resources will appear with an asterisk.
    switch(config)#show platform arad ip route
    Tunnel Type: M(mpls), G(gre)
    * - Routes in LEM
     
    -------------------------------------------------------------------------------
    |Routing Table | |
    |------------------------------------------------------------------------------
    |VRF|Destination | | ||Acl| |ECMP 
    | FEC | Tunnel
    |ID |Subnet| Cmd |Destination|VID |Label| MAC / CPU Code
    |Index|Index|T Value
     
    -------------------------------------------------------------------------------
    |0|0.0.0.0/8 |TRAP |CoppSystemL3DstMiss|0 | - |ArpTrap|-
    |1030 | - 
    |0|100.1.0.0/32|TRAP |CoppSystemIpBcast|0 | - |BcastReceive |-
    |1032 | - 
    |0|100.1.0.0/32|TRAP |CoppSystemIpUcast|0 | - |Receive|-
    |32766| - 
    |0|100.1.255.255/32|TRAP |CoppSystemIpBcast|0 | - |BcastReceive |-
    |1032 | - 
    |0|200.1.255.255/32|TRAP |CoppSystemIpBcast|0 | - |BcastReceive |-
    |1032 | - 
    |0|200.1.0.0/16|TRAP |CoppSystemL3DstMiss|1007| - |ArpTrap|-
    |1029 | - 
    |0|0.0.0.0/0 |TRAP |CoppSystemL3LpmOver|0 | - |SlowReceive|-
    |1024 | - 
    |0|4.4.4.0/24* |ROUTE|Et10 |1007| - |00:01:00:02:00:03|-
    |1033 | - 
    |0|10.20.30.0/24*|ROUTE|Et9|1006| - |00:01:00:02:00:03|-
    |1027 | -
    
    switch(config)#

show platform fap eedb ip-tunnel gre interface tunnel

The show platform fap eedb ip-tunnel gre interface tunnel command verifies the tunnel encapsulation programming for the tunnel interface.

Command Mode

EXEC

Command Syntax

show platform fap eedb ip-tunnel gre interface tunnel <number>

Parameter
  • number Specifies the tunnel interface number.

Example:
These commands verify the tunnel encapsulation programming for the tunnel interface 10.
switch#show platform fap eedb ip-tunnel gre interface tunnel 10

----------------------------------------------------------------------------
|Jericho0|
| GRE Tunnel Egress Encapsulation DB 
|
|--------------------------------------------------------------------------|
| Bank/ | OutLIF | Next | VSI| Encap | TOS| TTL | Source | Destination| 
OamLIF| OutLIF | Drop|
| Offset|| OutLIF | LSB| Mode|| | IP | IP | Set 
| Profile| |
|--------------------------------------------------------------------------|
| 3/0 | 0x6000 | 0x4010 | 0| 2 | 10 | 10| 10.1.1.1 | 10.1.1.2 | No
| 0| No|

switch#show platform fap eedb ip-tunnel
-------------------------------------------------------------------------------
|Jericho0|
| IP Tunnel Egress Encapsulation DB 
|
|------------------------------------------------------------------------------
| Bank/ | OutLIF | Next | VSI | Encap| TOS | TTL | Src | Destination | OamLIF 
| OutLIF| Drop|
| Offset|| OutLIF | LSB | Mode | Idx | Idx | Idx | IP| Set| 
Profile | |
|------------------------------------------------------------------------------
| 3/0 | 0x6000 | 0x4010 | 0 | 2| 9 | 0 | 0 | 10.1.1.2| No | 
0 | No|

show platform fap tcam summary

The show platform fap tcam summary command displays information about the TCAM bank that is allocated for GRE packet termination lookup.

Command Mode

EXEC

Command Syntax

show platform fap tcam summary

Example:
This command verifies if the TCAM bank is allocated for GRE packet termination lookup.
switch#show platform fap tcam summary

Tcam Allocation (Jericho0)
BankUsed ByReserved By
---------- ----------------------- -----------
0 dbGreTunnel -

show platform trident forwarding-table partition

The show platform trident forwarding-table partition command displays the size of the L2 MAC entry tables, L3 IP forwarding tables, and Longest Prefix Match (LPM) routes.

Command Mode

Privileged EXEC

Command Syntax

show platform trident forwarding-table partition

Example:
This command shows the Trident forwarding table information.
switch(config)#show platform trident forwarding-table partition
L2 Table Size: 96k
L3 Host Table Size: 208k
LPM Table Size: 16k
switch(config)#

show rib route ip

The show rib route ip command displays a list of IPv4 Routing Information Base (RIB) routes.

Command Mode

EXEC

Command Syntax

show rib route ip [vrf vrf_name][PREFIX][ROUTE TYPE]

Parameters
  • vrf vrf_name Displays RIB routes from the specified VRF.
  • PREFIX dDisplays routes filtered by the specified IPv4 information. Options include:

    • ip_address Displays RIB routes filtered by the specified IPv4 address.
    • ip_subnet_mask Displays RIB routes filtered by the specified IPv4 address and subnet mask.
    • ip_prefix Displays RIB routes filtered by the specified IPv4 prefix.
  • ROUTE TYPE Displays routes filtered by the specified route type. Options include:

    • bgp Displays RIB routes filtered by BGP.
    • connected Displays RIB routes filtered by connected routes.
    • dynamicPolicy Displays RIB routes filtered by dynamic policy routes.
    • host Displays RIB routes filtered by host routes.
    • isis Displays RIB routes filtered by ISIS routes.
    • ospf Displays RIB routes filtered by OSPF routes.
    • ospf3 Displays RIB routes filtered by OSPF3 routes.
    • reserved Displays RIB routes filtered by reserved routes.
    • route-input Displays RIB routes filtered by route-input routes.
    • static Displays RIB routes filtered by static routes.
    • vrf Displays routes in a VRF.
    • vrf-leak Displays leaked routes in a VRF.

Examples:
  • This command displays IPv4 RIB static routes.
    switch#show rib route ip static
    VRF name: default, VRF ID: 0xfe, Protocol: static
    Codes: C - Connected, S - Static, P - Route Input
     B - BGP, O - Ospf, O3 - Ospf3, I - Isis
     > - Best Route, * - Unresolved Nexthop
     L - Part of a recursive route resolution loop
    >S10.80.0.0/12 [1/0]
     via 172.30.149.129 [0/1]
    via Management1, directly connected
    >S172.16.0.0/12 [1/0]
     via 172.30.149.129 [0/1]
    via Management1, directly connected
    switch#
  • This command displays IPv4 RIB connected routes.
    switch#show rib route ip connected
    VRF name: default, VRF ID: 0xfe, Protocol: connected
    Codes: C - Connected, S - Static, P - Route Input
     B - BGP, O - Ospf, O3 - Ospf3, I - Isis
     > - Best Route, * - Unresolved Nexthop
     L - Part of a recursive route resolution loop
    >C10.1.0.0/24 [0/1]
     via 10.1.0.102, Ethernet1
    >C10.2.0.0/24 [0/1]
     via 10.2.0.102, Ethernet2
    >C10.3.0.0/24 [0/1]
     via 10.3.0.102, Ethernet3
    switch#
  • This command displays routes leaked through VRF leak agent.
    switch#show rib route ip vrf VRF2 vrf-leak
    VRF: VRF2, Protocol: vrf-leak
    ...
    >VL20.0.0.0/8 [1/0] source VRF: VRF1
    via 10.1.2.10 [0/0] type ipv4
     via 10.1.2.10, Ethernet1

show rib route <ipv4 | ipv6> fib policy excluded

The show rib route <ipv4 | ipv6> fib policy excluded command displays the RIB routes filtered by FIB policy. The fib policy exclude option displays the RIB routes that have been excluded from being programmed into FIB, by FIB policy.

Command Mode

EXEC

Command Syntax

show rib route<ipv4 | ipv6> fib policy excluded

Example:
The following example displays the RIB routes excluded by the FIB policy using the fib policy excluded option of the show rib route <ipv4 | ipv6> command.
Switch#show rib route ipv6 fib policy excluded
switch#show rib route ip bgp fib policy excluded

VRF name: default, VRF ID: 0xfe, Protocol: bgp
Codes: C - Connected, S - Static, P - Route Input
 B - BGP, O - Ospf, O3 - Ospf3, I - Isis
 > - Best Route, * - Unresolved Nexthop
 L - Part of a recursive route resolution loop
>B10.1.0.0/24 [200/0]
 via 10.2.2.1 [115/20] type tunnel
via 10.3.5.1, Ethernet1
 via 10.2.0.1 [115/20] type tunnel
via 10.3.4.1, Ethernet2
via 10.3.6.1, Ethernet3 
>B10.1.0.0/24 [200/0]
 via 10.2.2.1 [115/20] type tunnel
via 10.3.5.1, Ethernet1
 via 10.2.0.1 [115/20] type tunnel 
via 10.3.4.1, Ethernet2
via 10.3.6.1, Ethernet3

show routing-context vrf

The show routing-context vrf command displays the context-active VRF. The context-active VRF determines the default VRF that VRF-context aware commands use when displaying routing table data from a specified VRF.

Command Mode

EXEC

Command Syntax

show routing-context vrf

Related Commands
  • cli vrf specifies the context-active VRF.

Example:
This command displays the context-active VRF.
switch>show routing-context vrf
Current VRF routing-context is PURPLE
switch>

show tunnel fib static interface gre

The show tunnel fib static interface gre command displays the forwarding information base (FIB) information for a static interface GRE tunnel.

Command Mode

EXEC

Command Syntax

show tunnel fib static interface gre <number>

Parameter
  • number Specifies the tunnel index number.

Example:
This command display the interface tunnel configuration with GRE configured.
switch#show tunnel fib static interface gre 10

Type 'Static Interface', index 10, forwarding Primary
 via 10.6.1.2, 'Ethernet6/1'
GRE, destination 10.1.1.2, source 10.1.1.1, ttl 10, tos 0xa

show vrf

The show vrf command displays the VRF name, RD, supported protocols, state and included interfaces for the specified VRF or for all VRFs on the switch.

Command Mode

EXEC

Command Syntax

show vrf [VRF_INSTANCE]

Parameters
  • VRF_INSTANCE Specifies the VRF instance to display.

    • <no parameter> Information is displayed for all VRFs.
    • vrf vrf_name Information is displayed for the specified user-defined VRF.

Example:
This command displays information for the VRF named “purple.”
switch>show vrf purple
Vrf          RD              Protocols       State        Interfaces
------------ --------------- --------------- ------------ --------------
purple       64496:237       ipv4            no routing   vlan42, vlan43

switch>

tcp mss ceiling

The tcp mss ceiling command configures the maximum segment size (MSS) limit in the TCP header on the configuration mode interface and enables TCP MSS clamping.

The no tcp mss ceiling and the default tcp mss ceiling commands remove any MSS ceiling limit previously configured on the interface.

Note: Configuring a TCP MSS ceiling on any Ethernet or tunnel interface enables TCP MSS clamping on the switch as a whole. Without hardware support, clamping routes all TCP SYN packets through software, even on interfaces where no TCP MSS ceiling has been configured. This significantly limits the number of TCP sessions the switch can establish per second, and can potentially cause packet loss if the CPU traffic exceeds control plane policy limits.

Command Mode

Interface-Ethernet Configuration

Subinterface-Ethernet Configuration

Interface-Port-channel Configuration

Subinterface-Port-channel Configuration

Interface-Tunnel Configuration

Interface-vlan Configuration

Command Syntax

tcp mss ceiling {ipv4 segment size | ipv6 segment size} {egress | ingress}

no tcp mss ceiling

default tcp mss ceiling

Parameters

  • ipv4 segment sizeThe IPv4 segment size value in bytes. Values range from 64 to 65515.
  • ipv6 segment size The IPv6 segment size value in bytes. Values range from 64 to 65495. This option is not supported on Sand platform switches (Qumran-MX, Qumran-AX, Jericho, Jericho+).
  • egressThe TCP SYN packets that are forwarded from the interface to the network.
  • ingress The TCP SYN packets that are received from the network to the interface. Not supported on Sand platform switches.

Guidelines
  • On Sand platform switches (Qumran-MX, Qumran-AX, Jericho, Jericho+), this command works only for egress, and is supported only on IPv4 unicast packets entering the switch.
  • Clamping can only be configured in one direction per interface and works only on egress on Sand platform switches.
  • To configure ceilings for both IPv4 and IPv6 packets, both configurations must be included in a single command; re-issuing the command overwrites any previous settings.
  • Clamping configuration has no effect on GRE transit packets.

Example:
These commands configure Ethernet interface 5 as a routed port, then specify a maximum MSS ceiling value of 1458 bytes in TCP SYN packets exiting that port. This enables TCP MSS clamping on the switch.
switch(config)#interface ethernet 5
switch(config-if-Et5)#no switchport
switch(config-if-Et5)#tcp mss ceiling ipv4 1458 egress
switch(config-if-Et5)#

tunnel

The tunnel command configures options for protocol-over-protocol tunneling. Because interface-tunnel configuration mode is not a group change mode, running-config is changed immediately after commands are executed. The exit command does not affect the configuration.

The no tunnel command deletes the specified tunnel configuration.

Command Mode

Interface-tunnel Configuration

Command Syntax

tunnel <options>

no tunnel <options>

Parameters
  • options Specifies the various tunneling options as listed below.

    • destination Destination address of the tunnel.
    • ipsec Secures the tunnel with the IPsec address.
    • key Sets the tunnel key.
    • mode Tunnel encapsulation method.
    • path-mtu-discovery Enables the Path MTU discovery on tunnel.
    • source Source of the tunnel packets.
    • tos Sets the IP type of service value.
    • ttl Sets time to live value.
    • underlay Tunnel underlay.

Example:
These commands place the switch in interface-tunnel configuration mode for tunnel interface 10 and with GRE tunnel configured on the interfaces specified.
switch(config)#ip routing
switch(config)#interface Tunnel 10
switch(config-if-Tu10)#tunnel mode gre
switch(config-if-Tu10)#ip address 192.168.1.1/24
switch(config-if-Tu10)#tunnel source 10.1.1.1
switch(config-if-Tu10)#tunnel destination 10.1.1.2
switch(config-if-Tu10)#tunnel path-mtu-discovery
switch(config-if-Tu10)#tunnel tos 10
switch(config-if-Tu10)#tunnel ttl 10

vrf (Interface mode)

The vrf command adds the configuration mode interface to the specified VRF. You must create the VRF first, using the vrf instance command.

The no vrf and default vrf commands remove the configuration mode interface from the specified VRF by deleting the corresponding vrf command from running-config.

All forms of the vrf command remove all IP addresses associated with the configuration mode interface.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-vlan Configuration

Command Syntax

vrf [vrf_name]

no vrf [vrf_name]

default vrf [vrf_name]

Parameters
  • vrf_name Name of configured VRF.

Examples:
  • These commands add the configuration mode interface (vlan 20) to the VRF named “purple”.
    switch(config)#interface vlan 20
    switch(config-if-Vl20)#vrf purple
    switch(config-if-Vl20)#
  • These commands remove the configuration mode interface from VRF “purple”.
    switch(config)#interface vlan 20
    switch(config-if-Vl20)#no vrf purple
    switch(config-if-Vl20)#

vrf instance

The vrf instance command places the switch in VRF configuration mode for the specified VRF. If the named VRF does not exist, this command creates it. The number of user-defined VRFs supported varies by platform.

To add an interface to the VRF once it is created, use the vrf (Interface mode) command.

The no vrf instance and default vrf instance commands delete the specified VRF instance by removing the corresponding vrf instance command from running-config. This also removes all IP addresses associated with interfaces that belong to the deleted VRF.

The exit command returns the switch to global configuration mode.

Command Mode

Global Configuration

Command Syntax

vrf instance [vrf_name]

no vrf instance [vrf_name]

default vrf instance [vrf_name]

Parameters
  • vrf_name Name of VRF being created, deleted or configured. The names “main” and “default” are reserved.

Example:
This command creates a VRF named “purple” and places the switch in VRF configuration mode for that VRF.
switch(config)#vrf instance purple
switch(config-vrf-purple)#