Cisco IOS IPv6 Command Reference
ipv6 summary-address eigrp through mpls ldp router-id
Downloads: This chapterpdf (PDF - 0.97MB) The complete bookPDF (PDF - 9.3MB) | Feedback

ipv6 summary-address eigrp

Table Of Contents

ipv6 summary-address eigrp

ipv6 tacacs source-interface

ipv6 traffic interface-statistics

ipv6 traffic-filter

ipv6 unicast-routing

ipv6 unnumbered

ipv6 unreachables

ipv6 verify unicast reverse-path

ipv6 verify unicast source reachable-via

ipv6 virtual-reassembly

ipv6 virtual-reassembly drop-fragments

isdn switch-type (BRI)

isis ipv6 metric

keepalive target

key

key (TACACS+)

key chain

key-string (authentication)

lifetime (IKE policy)

limit address-count

log-adjacency-changes

log-adjacency-changes (OSPFv3)

logging event link-status (interface configuration)

logging host

logging origin-id

logging source-interface

log-neighbor-changes (IPv6 EIGRP)

log-neighbor-warnings

managed-config-flag

mask

match (IKEv2 policy)

match (IKEv2 profile)

match access-group name

match dscp

match identity

match ipv6

match ipv6 access-list

match ipv6 address

match ipv6 destination

match ipv6 extension map

match ipv6 fragmentation

match ipv6 hop-limit

match ipv6 length

match ipv6 next-hop

match ipv6 route-source

match length

match mpls-label

match precedence

match protocol

match protocol (zone)

match ra prefix-list

max-metric router-lsa

maximum routes

maximum-paths (IPv6)

maximum-paths (OSPFv3)

maximum-paths ibgp

maximum sessions (DSP farm profile)

metric weights (EIGRP)

mls cef maximum-routes

mls erm priority

mls ipv6 acl compress address unicast

mls ipv6 acl source

mls ipv6 vrf

mls rate-limit multicast ipv6

monitor event-trace cef ipv6 (global)

monitor event-trace ipv6 spd

mpls ipv6 source-interface

mpls ldp router-id


ipv6 summary-address eigrp

To configure a summary aggregate address for a specified interface, use the ipv6 summary-address eigrp command in interface configuration mode. To disable a configuration, use the no form of this command.

ipv6 summary-address eigrp as-number ipv6-address [admin-distance]

no ipv6 summary-address eigrp as-number ipv6-address [admin-distance]

Syntax Description

as-number

Autonomous system number.

ipv6-address

Summary IPv6 address to apply to an interface.

admin-distance

(Optional) Administrative distance. A value from 0 through 255. The default value is 90.


Command Default

An administrative distance of 5 is applied to Enhanced Interior Gateway Routing Protocol (EIGRP) for IPv6 summary routes.
EIGRP for IPv6 automatically summarizes to the network level, even for a single host route.
No summary addresses are predefined.

Command Modes

Interface configuration

Command History

Release
Modification

12.4(6)T

This command was introduced.

12.2(33)SRB

This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.


Usage Guidelines

The ipv6 summary-address eigrp command is used to configure interface-level address summarization. EIGRP for IPv6 summary routes are given an administrative distance value of 5. The administrative distance metric is used to advertise a summary address without installing it in the routing table.

Examples

The following example provides a summary aggregate address for EIGRP for IPv6 for AS 1:

ipv6 summary-address eigrp 1 2001:0DB8:0:1::/64

ipv6 tacacs source-interface

To specify an interface to use for the source address in TACACS packets, use the ipv6 tacacs source-interface command in global configuration mode. To remove the specified interface from the configuration, use the no form of this command.

ipv6 tacacs source-interface interface

no ipv6 tacacs source-interface interface

Syntax Description

interface

Interface to be used for the source address in TACACS packets.


Command Default

No interface is specified.

Command Modes

Global configuration (config)

Command History

Release
Modification

Cisco IOS XE Release 3.2S

This command was introduced.


Usage Guidelines

The ipv6 tacacs source-interface command specifies an interface to use for the source address in TACACS packets.

Examples

The following example shows how to configure the Gigabit Ethernet interface to be used as the source address in TACACS packets:

Router(config)# ipv6 tacacs source-interface GigabitEthernet 0/0/0

Related Commands

Command
Description

tacacs server

Configures the TACACS+ server for IPv6 or IPv4 and enters TACACS+ server configuration mode.


ipv6 traffic interface-statistics

To collect IPv6 forwarding statistics for all interfaces, use the ipv6 traffic interface-statistics command in global configuration mode. To ensure that IPv6 forwarding statistics are not collected for any interface, use the no form of this command.

ipv6 traffic interface-statistics [unclearable]

no ipv6 traffic interface-statistics [unclearable]

Syntax Description

unclearable

(Optional) IPv6 forwarding statistics are kept for all interfaces, but it is not possible to clear the statistics on any interface.


Command Default

IPv6 forwarding statistics are collected for all interfaces.

Command Modes

Global configuration

Command History

Release
Modification

12.2(33)SRC

This command was introduced.

12.2(33)SB

This command was integrated into Cisco IOS Release 12.2(33)SB.

Cisco IOS XE Release 2.1

This command was introduced on Cisco ASR 1000 Series Routers.


Usage Guidelines

Using the optional unclearable keyword halves the per-interface statistics storage requirements.

Examples

The following example does not allow statistics to be cleared on any interface:

ipv6 traffic interface-statistics unclearable 

ipv6 traffic-filter

To filter incoming or outgoing IPv6 traffic on an interface, use the ipv6 traffic-filter command in interface configuration mode. To disable the filtering of IPv6 traffic on an interface, use the no form of this command.

ipv6 traffic-filter access-list-name {in | out}

no ipv6 traffic-filter access-list-name

Syntax Description

access-list-name

Specifies an IPv6 access name.

in

Specifies incoming IPv6 traffic.

out

Specifies outgoing IPv6 traffic.


Command Default

Filtering of IPv6 traffic on an interface is not configured.

Command Modes

Interface configuration (config-if)
Policy-map configuration (config-pmap)

Command History

Release
Modification

12.2(2)T

This command was introduced.

12.0(21)ST

This command was integrated into Cisco IOS Release 12.0(21)ST.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Cisco IOS XE Release 2.1

This command was introduced on Cisco ASR 1000 series routers.

12.2(33)SXI4

The out keyword and therefore filtering of outgoing traffic is not supported in IPv6 port-based access list (PACL) configuration.

12.2(54)SG

This command was modified. Support for Cisco IOS Release 12.2(54)SG was added.

12.2(50)SY

This command was modified. The out keyword is not supported.


Examples

The following example filters inbound IPv6 traffic on Ethernet interface 0/0 as defined by the access list named cisco:

Router(config)# interface ethernet 0/0
Router(config-if)# ipv6 traffic-filter cisco in

Related Commands

Command
Description

ipv6 access-list

Defines an IPv6 access list and sets deny or permit conditions for the defined access list.

show ipv6 access-list

Displays the contents of all current IPv6 access lists.

show ipv6 interface

Displays the usability status of interfaces configured for IPv6.


ipv6 unicast-routing

To enable the forwarding of IPv6 unicast datagrams, use the ipv6 unicast-routing command in global configuration mode. To disable the forwarding of IPv6 unicast datagrams, use the no form of this command.

ipv6 unicast-routing

no ipv6 unicast-routing

Syntax Description

This command has no arguments or keywords.

Command Default

IPv6 unicast routing is disabled.

Command Modes

Global configuration

Command History

Release
Modification

12.2(2)T

This command was introduced.

12.0(21)ST

This command was integrated into Cisco IOS Release 12.0(21)ST.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Cisco IOS XE Release 2.1

This command was introduced on Cisco ASR 1000 series routers.


Usage Guidelines

Configuring the no ipv6 unicast-routing command removes all IPv6 routing protocol entries from the IPv6 routing table.

Examples

The following example enables the forwarding of IPv6 unicast datagrams:

Router(config)# ipv6 unicast-routing

Related Commands

Command
Description

ipv6 address link-local

Configures an IPv6 link-local address for an interface and enables IPv6 processing on the interface.

ipv6 address eui-64

Configures an IPv6 address and enables IPv6 processing on an interface using an EUI-64 interface ID in the low-order 64 bits of the address.

ipv6 enable

Enables IPv6 processing on an interface that has not been configured with an explicit IPv6 address.

ipv6 unnumbered

Enables IPv6 processing on an interface without assigning an explicit IPv6 address to the interface.

show ipv6 route

Displays the current contents of the IPv6 routing table.


ipv6 unnumbered

To enable IPv6 processing on an interface without assigning an explicit IPv6 address to the interface, use the ipv6 unnumbered command in interface configuration mode. To disable IPv6 on an unnumbered interface, use the no form of this command.

ipv6 unnumbered interface-type interface-number

no ipv6 unnumbered

Syntax Description

interface-type

The interface type of the source address that the unnumbered interface uses in the IPv6 packets that it originates. The source address cannot be another unnumbered interface.

interface-number

The interface number of the source address that the unnumbered interface uses in the IPv6 packets that it originates.


Command Default

This command is disabled.

Command Modes

Interface configuration

Command History

Release
Modification

12.2(2)T

This command was introduced.

12.0(21)ST

This command was integrated into Cisco IOS Release 12.0(21)ST.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.


Usage Guidelines

IPv6 packets that are originated from an unnumbered interface use the global IPv6 address of the interface specified in the ipv6 unnumbered command as the source address for the packets. The ipv6 unnumbered interface command is used as a hint when doing source address selection; that is, when trying to determine the source address of an outgoing packet.


Note Serial interfaces using High-Level Data Link Control (HDLC), PPP, Link Access Procedure, Balanced (LAPB), Frame Relay encapsulations, and tunnel interfaces can be unnumbered. You cannot use this interface configuration command with X.25 or Switched Multimegabit Data Service (SMDS) interfaces.

Examples

The following example configures serial interface 0/1as unnumbered. IPv6 packets that are sent on serial interface 0/1 use the IPv6 address of Ethernet 0/0 as their source address:

Router(config)# interface ethernet 0/0
Router(config-if)# ipv6 address 3FFE:C00:0:1:260:3EFF:FE11:6770
 
   
Router(config)# interface serial 0/1
Router(config-if)# ipv6 unnumbered ethernet 0/0

Related Commands

Command
Description

show ipv6 interface

Displays the usability status of interfaces configured for IPv6.


ipv6 unreachables

To enable the generation of Internet Control Message Protocol for IPv6 (ICMPv6) unreachable messages for any packets arriving on a specified interface, use the ipv6 unreachables command in interface configuration mode. To prevent the generation of unreachable messages, use the no form of this command.

ipv6 unreachables

no ipv6 unreachables

Syntax Description

This command has no arguments or keywords.

Command Default

ICMPv6 unreachable messages can be generated for any packets arriving on that interface.

Command Modes

Interface configuration

Command History

Release
Modification

12.4(2)T

This command was introduced.

12.2(33)SRB

This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.


Usage Guidelines

If the Cisco IOS software receives a nonbroadcast packet destined for itself that uses a protocol it does not recognize, it sends an ICMPv6 unreachable message to the source.

If the software receives a datagram that it cannot deliver to its ultimate destination because it knows of no route to the destination address, it replies to the originator of that datagram with an ICMP host unreachable message.

Examples

The following example enables the generation of ICMPv6 unreachable messages, as appropriate, on an interface:

interface ethernet 0
 ipv6 unreachables

ipv6 verify unicast reverse-path

To enable Unicast Reverse Path Forwarding (Unicast RPF) for IPv6, use the ipv6 verify unicast reverse-path command in interface configuration mode. To disable Unicast RPF, use the no form of this command.

ipv6 verify unicast reverse-path [access-list name]

no ipv6 verify unicast reverse-path [access-list name]

Syntax Description

access-list name

(Optional) Specifies the name of the access list.

Note This keyword and argument are not supported on the Cisco 12000 series Internet router.


Command Default

Unicast RPF is disabled.

Command Modes

Interface configuration (config-if)

Command History

Release
Modification

12.2(13)T

This command was introduced.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.0(31)S

This command was integrated into Cisco IOS Release 12.0(31)S and introduced on the 10G Engine 5 SPA Interface Processor in the Cisco 12000 series Internet router.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.


Usage Guidelines

The ipv6 verify unicast reverse-path command is used to enable Unicast RPF for IPv6 in strict checking mode. The Unicast RPF for IPv6 feature requires that Cisco Express Forwarding for IPv6 is enabled on the router.


Note Beginning in Cisco IOS Release 12.0(31)S, the Cisco 12000 series Internet router supports both the ipv6 verify unicast reverse-path and ipv6 verify unicast source reachable-via rx commands to enable Unicast RPF to be compatible with the Cisco IOS Release 12.3T and 12.2S software trains.

Use the ipv6 verify unicast reverse-path command to mitigate problems caused by malformed or forged (spoofed) IP source addresses that pass through a router. Malformed or forged source addresses can indicate denial-of-service (DoS) attacks based on source IP address spoofing.

When Unicast RPF is enabled on an interface, the router examines all packets received on that interface. The router checks to make sure that the source IPv6 address appears in the routing table and that it is reachable by a path through the interface on which the packet was received. Unicast RPF is an input feature and is applied only on the input interface of a router at the upstream end of a connection.

The Unicast RPF feature performs a reverse lookup in the CEF table to check if any packet received at a router interface has arrived on a path identified as a best return path to the source of the packet. If a reverse path for the packet is not found, Unicast RPF can drop or forward the packet, depending on whether an ACL is specified in the Unicast RPF command. If an ACL is specified in the command, then when (and only when) a packet fails the Unicast RPF check, the ACL is checked to determine whether the packet should be dropped (using a deny statement in the ACL) or forwarded (using a permit statement in the ACL). Whether a packet is dropped or forwarded, the packet is counted in the global IP traffic statistics for Unicast RPF drops and in the interface statistics for Unicast RPF.

If no ACL is specified in the Unicast RPF command, the router drops the forged or malformed packet immediately and no ACL logging occurs. The router and interface Unicast RPF counters are updated.

Unicast RPF events can be logged by specifying the logging option for the ACL entries used by the Unicast RPF command. Log information can be used to gather information about the attack, such as source address, time, and so on.


Note When you configure Unicast RPF for IPv6 on the Cisco 12000 series Internet router, the most recently configured checking mode is not automatically applied to all interfaces as on other platforms. You must enable Unicast RPF for IPv6 separately on each interface.

When you configure a SPA on the Cisco 12000 series Internet router, the interface address is in the format slot/subslot/port.

The optional access-list keyword for the ipv6 verify unicast reverse-path command is not supported on the Cisco 12000 series Internet router. For information about how Unicast RPF can be used with ACLs on other platforms to mitigate the transmission of invalid IPv4 addresses (perform egress filtering) and to prevent (deny) the reception of invalid IPv4 addresses (perform ingress filtering), refer to the "Configuring Unicast Reverse Path Forwarding" chapter in the "Other Security Features" section of the Cisco IOS Security Configuration Guide.

Note When using Unicast RPF, all equal-cost "best" return paths are considered valid. This means that Unicast RPF works in cases where multiple return paths exist, provided that each path is equal to the others in terms of the routing cost (number of hops, weights, and so on).

Do not use Unicast RPF on core-facing interfaces that are internal to the network. Internal interfaces are likely to have routing asymmetry, meaning that there are multiple routes to the source of a packet. Apply Unicast RPF only where there is natural or configured symmetry.

For example, routers at the edge of the network of an Internet service provider (ISP) are more likely to have symmetrical reverse paths than routers that are in the core of the ISP network. Routers that are in the core of the ISP network have no guarantee that the best forwarding path out of the router will be the path selected for packets returning to the router. Hence, it is not recommended that you apply Unicast RPF where there is a chance of asymmetric routing. It is simplest to place Unicast RPF only at the edge of a network or, for an ISP, at the customer edge of the network.

Examples

Unicast Reverse Path Forwarding on a Serial Interface

The following example shows how to enable the Unicast RPF feature on a serial interface:

interface serial 5/0/0
  ipv6 verify unicast reverse-path

Unicast Reverse Path Forwarding on a Cisco 12000 Series Internet Router

The following example shows how to enable Unicast RPF for IPv6 with strict checking on a 10G SIP Gigabit Ethernet interface 2/1/2:

Router# configure terminal
 
   
Enter configuration commands, one per line.  End with CNTL/Z.
 
   
Router(config)# interface gigabitEthernet 2/1/2
 
   
Router(config-if)# ipv6 verify unicast reverse-path
Router(config-if)# exit

Unicast Reverse Path Forwarding on a Single-Homed ISP

The following example uses a very simple single-homed ISP to demonstrate the concepts of ingress and egress filters used in conjunction with Unicast RPF. The example illustrates an ISP-allocated classless interdomain routing (CIDR) block 209.165.202.128/28 that has both inbound and outbound filters on the upstream interface. Be aware that ISPs are usually not single-homed. Hence, provisions for asymmetrical flows (when outbound traffic goes out one link and returns via a different link) need to be designed into the filters on the border routers of the ISP.

interface Serial 5/0/0 
description Connection to Upstream ISP 
ipv6 address FE80::260:3EFF:FE11:6770/64 
no ipv6 redirects
ipv6 verify unicast reverse-path abc 
! 
ipv6 access-list abc 
permit ipv6 host 2::1 any 
deny ipv6 FEC0::/10 any 
  ipv6 access-group abc in
  ipv6 access-group jkl out
!
access-list abc permit ip FE80::260:3EFF:FE11:6770/64 2001:0DB8:0000:0001::0001any
access-list abc deny ipv6 any any log 
access-list jkl deny ipv6 host 2001:0DB8:0000:0001::0001 any log
access-list jkl deny ipv6 2001:0DB8:0000:0001:FFFF:1234::5.255.255.255 any log
access-list jkl deny ipv6 2002:0EF8:002001:0DB8:0000:0001:FFFF:1234::5172.16.0.0 
0.15.255.255 any log
access-list jkl deny ipv6 2001:0CB8:0000:0001:FFFF:1234::5 0.0.255.255 any log
access-list jkl deny ipv6 2003:0DB8:0000:0001:FFFF:1234::5 0.0.0.31 any log
access-list jkl permit ipv6

ACL Logging with Unicast RPF

The following example demonstrates the use of ACLs and logging with Unicast RPF. In this example, extended ACL abc provides entries that deny or permit network traffic for specific address ranges. Unicast RPF is configured on interface Ethernet 0/0 to check packets arriving at that interface.

For example, packets with a source address of 8765:4321::1 arriving at Ethernet interface 0 are dropped because of the deny statement in ACL "abc." In this case, the ACL information is logged (the logging option is turned on for the ACL entry) and dropped packets are counted per-interface and globally. Packets with a source address of 1234:5678::1 arriving at Ethernet interface 0/0 are forwarded because of the permit statement in ACL abc. ACL information about dropped or suppressed packets is logged (the logging option is turned on for the ACL entry) to the log server.

interface ethernet 0/0
ipv6 address FE80::260:3EFF:FE11:6770/64 link-local
ipv6 verify unicast reverse-path abc
!
ipv6 access-list abc
permit ipv6 1234:5678::/64 any log-input
deny ipv6 8765:4321::/64 any log-input

Related Commands

Command
Description

ip cef

Enables Cisco Express Forwarding on the route processor card.

ip verify unicast reverse-path

Enables Unicast RPF for IPv4 traffic.

ipv6 cef

Enables Cisco Express Forwarding for IPv6 interfaces.


ipv6 verify unicast source reachable-via

To verify that a source address exists in the FIB table and enable Unicast Reverse Path Forwarding (Unicast RPF), use the ipv6 verify unicast source reachable-via command in interface configuration mode. To disable URPF, use the no form of this command.

ipv6 verify unicast source reachable-via {rx | any} [allow-default] [allow-self-ping] [access-list-name]

no ipv6 verify unicast

Syntax Description

rx

Source is reachable through the interface on which the packet was received.

any

Source is reachable through any interface.

allow-default

(Optional) Allows the lookup table to match the default route and use the route for verification.

allow-self-ping

(Optional) Allows the router to ping a secondary address.

access-list-name

(Optional) Name of the IPv6 access list. Names cannot contain a space or quotation mark, or begin with a numeral.


Command Default

Unicast RPF is disabled.

Command Modes

Interface configuration (config-if)

Command History

Release
Modification

12.2(25)S

This command was introduced.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

Cisco IOS XE Release 2.1

This command was introduced on Cisco ASR 1000 Series Aggregation Services Routers.

12.2(50)SY

This command was integrated into Cisco IOS Release 12.2(50)SY.


Usage Guidelines

The ipv6 verify unicast reverse-path command is used to enable Unicast RPF for IPv6 in loose checking mode.

Use the ipv6 verify unicast source reachable-via command to mitigate problems caused by malformed or forged (spoofed) IP source addresses that pass through an IPv6 router. Malformed or forged source addresses can indicate denial-of-service (DoS) attacks based on source IPv6 address spoofing.

The URPF feature checks to see if any packet received at a router interface arrives on one of the best return paths to the source of the packet. The feature does this by doing a reverse lookup in the CEF table. If URPF does not find a reverse path for the packet, U RPF can drop or forward the packet, depending on whether an access control list (ACL) is specified in the ipv6 verify unicast source reachable-via command. If an ACL is specified in the command, then when (and only when) a packet fails the URPF check, the ACL is checked to see if the packet should be dropped (using a deny statement in the ACL) or forwarded (using a permit statement in the ACL). Whether a packet is dropped or forwarded, the packet is counted in the global IP traffic statistics for U RPF drops and in the interface statistics for Unicast RPF.

If no ACL is specified in the ipv6 verify unicast source reachable-via command, the router drops the forged or malformed packet immediately and no ACL logging occurs. The router and interface Unicast RPF counters are updated.

U RPF events can be logged by specifying the logging option for the ACL entries used by the ipv6 verify unicast source reachable-via command. Log information can be used to gather information about the attack, such as source address, time, and so on.

Examples

The following example enables Unicast RPF on any interface:

ipv6 verify unicast source reachable-via any

Related Commands

Command
Description

ipv6 access-list

Defines an IPv6 access list and places the router in IPv6 access list configuration mode.

show ipv6 interface

Displays the usability status of interfaces configured for IPv6.


ipv6 virtual-reassembly

To enable Virtual Fragment Reassembly (VFR) on an interface, use the ipv6 virtual-reassembly command in global configuration mode. To remove VFR configuration, use the no form of this command.

ipv6 virtual-reassembly [in | out] [max-reassemblies maxreassemblies] [max-fragments max-fragments] [timeout seconds] [drop-fragments]

no ipv6 virtual-reassembly [in | out] [max-reassemblies maxreassemblies] [max-fragments max-fragments] [timeout seconds] [drop-fragments]

Syntax Description

in

(Optional) Enables VFR on the ingress direction of the interface.

out

(Optional) Enables VFR on the egress direction of the interface.

max-reassemblies maxreassemblies

(Optional) Sets the maximum number of concurrent reassemblies (fragment sets) that the Cisco IOS software can handle at a time. The default value is 64.

max-fragments max-fragments

(Optional) Sets the maximum number of fragments allowed per datagram (fragment set). The default is 16.

timeout seconds

(Optional) Sets the timeout value of the fragment state. The default timeout value is 2 seconds. If a datagram does not receive all its fragments within 2 seconds, all of the fragments received previously will be dropped and the fragment state will be deleted.

drop-fragments

(Optional) Turns the drop fragments feature on or off.


Command Default

Max-reassemblies = 64
Fragments = 16
If neither the in or out keyword is specified, VFR is enabled on the ingress direction of the interface only.
drop-fragments keyword is not enabled.

Command Modes

Interface configuration (config-if)

Command History

Release
Modification

12.3(7)T

This command was introduced.

15.1(1)T

The in and out keywords were added.

The out keyword must be used to configure or disable the egress direction of the interface.

Cisco IOS XE Release 3.4S

The drop-fragments keyword was added.


Usage Guidelines

When the ipv6 virtual-reassembly command is configured on an interface without using one of the command keywords, VFR is enabled on the ingress direction of the interface only. In Cisco IOS XE Release 3.4S, all VFR-related alert messages are suppressed by default.

Maximum Number of Reassemblies

Whenever the maximum number of 256 reassemblies (fragment sets) is crossed, all the fragments in the forthcoming fragment set will be dropped and an alert message VFR-4-FRAG_TABLE_OVERFLOW will be logged to the syslog server.

Maximum Number of Fragments per Fragment Set

If a datagram being reassembled receives more than eight fragments then, tall fragments will be dropped and an alert message VFR-4-TOO_MANY_FRAGMENTS will be logged to the syslog server.

Explicit Removal of Egress Configuration

As of the Cisco IOS 15.1(1)T release, the no ipv6 virtual-reassembly command, when used without keywords, removes ingress configuration only. To remove egress interface configuration, you must enter the out keyword.

Examples

The following example configures the ingress direction on the interface. It sets the maximum number of reassemblies to 32, maximum fragments to 4, and the timeout to 7 seconds:

Router(config)# interface Ethernet 0/0 
Router(config-if)# ipv6 virtual-reassembly max-reassemblies 32 max-fragments 4 timeout 7
 
   

The following example enables the VFR on the ingress direction of the interface. Note that even if the in keyword is not used, the configuration default is to configure the ingress direction on the interface:

Router(config)# interface Ethernet 0/0
Router(config-if)# ipv6 virtual-reassembly
Router(config-if)# end 
 
   
Router# show run interface Ethernet 0/0
 
   
interface Ethernet0/0
no ip address
ipv6 virtual-reassembly in
 
   

The following example enables egress configuration on the interface. Note that the out keyword must be used to enable and disable egress configuration on the interface:

Router(config)# interface Ethernet 0/0
Router(config-if)# ipv6 virtual-reassembly out 
Router(config-if)# end
 
   
Router# show run interface Ethernet 0/0
 
   
interface Ethernet0/0
no ip address
ipv6 virtual-reassembly out
end
 
   

The following example disables egress configuration on the interface:

Router(config)# interface Ethernet 0/0
Router(config-if)# no ipv6 virtual-reassembly out 
Router(config-if)# end
 
   
 
   

ipv6 virtual-reassembly drop-fragments

To drop all fragments on an interface, use the ipv6 virtual-reassembly drop-fragments command in global configuration mode. Use the no form of this command to remove the packet-dropping behavior.

ipv6 virtual-reassembly drop-fragments

no ipv6 virtual-reassembly drop-fragments

Syntax Description

This command has no arguments or keywords.

Command Default

Fragments on an interface are not dropped.

Command Modes

Global configuration

Command History

Release
Modification

12.3(7)T

This command was introduced.


Examples

The following example causes all fragments on an interface to be dropped:

ipv6 virtual-reassembly drop-fragments
 
   

isdn switch-type (BRI)

To specify the central office switch type on the ISDN interface, use the isdn switch-type command in global or interface configuration mode. To remove an ISDN switch type, use the no form of this command.

isdn switch-type switch-type

no isdn switch-type switch-type

Syntax Description

switch-type

ISDN service provider switch type. Table 33 in the "Usage Guidelines" section lists the supported switch types.


Defaults

No ISDN switch type is specified.

Command Modes

Global configuration or interface configuration


Note This command can be entered in either global configuration or interface configuration mode. When entered in global configuration mode, the basic-qsig switch type command specifies that the Cisco MC3810 use QSIG signaling on all BRI interfaces; when entered in interface configuration mode, the command specifies that an individual BRI voice interface use QSIG signaling. The interface configuration mode setting overrides the global configuration setting on individual interfaces.

Command History

Release
Modification

9.21

This command was introduced as a global command.

11.3 T

This command was introduced as an interface command.

12.0(3)XG

The basic-qsig and primary-qsig switch type options were added to support BRI QSIG voice signaling.


Usage Guidelines

For the Cisco AS5300 access server, you have the choice of configuring the isdn-switch-type command to support Q.SIG in either global configuration mode or interface configuration mode. When entered in global configuration mode, the setting applies to the entire Cisco AS5300 access server. When entered in interface configuration mode, the setting applies only to the T1/E1 interface specified. The interface configuration mode setting overrides the global configuration setting.

For example, if you have a Q.SIG connection on one line as well as on the PRI port, you can configure the ISDN switch type in one of the following combinations:

Set the global isdn-switch-type command to support Q.SIG and set the interface isdn-switch-type command for interface serial 0:23 to a PRI setting such as 5ess.

Set the global isdn-switch-type command to support PRI 5ess and set the interface isdn-switch-type command for interface serial 1:23 to support Q.SIG.

Configure the global isdn-switch-type command to another setting (such as switch type VN3), set the interface isdn-switch-type command for interface serial 0:23 to a PRI setting, and set the interface isdn-switch-type command for interface serial 1:23 to support Q.SIG.

For the Cisco MC3810 router, if you are using different Cisco MC3810 BRI port interfaces with different ISDN switch types, you can use global and interface commands in any combination, as long as you remember that interface commands always override a global command.

For example, if you have a BRI QSIG switch interface on BRI voice ports 1, 2, 3 and 4, but a BRI 5ess switch interface on BRI backup port 0, you can configure the ISDN switch types in any of the following combinations:

Enter the isdn switch-type basic-qsig global configuration command, and enter the
isdn switch-type bri-5ess command on interface 0.

Enter the isdn switch-type bri-5ess global configuration command, and enter the
isdn switch-type basic-qsig command on interfaces 1, 2, 3, and 4 individually.

Enter the isdn switch-type bri-5ess command on interface 0, and enter the isdn switch-type basic-qsig command on interfaces 1, 2, 3, and 4 individually.

If you use the no isdn switch-type global configuration command, any switch type that was originally entered in global configuration mode is canceled; however, any switch type originally entered on an interface is not affected. If you use the no isdn switch-type interface configuration command, any switch type configuration on the interface is canceled.


Note In the Cisco MC3810, ISDN BRI voice ports support only switch type basic-qsig; ISDN BRI backup ports support all other listed switch types, but not basic-qsig.

Note The dial-peer codec command must be configured before any calls can be placed over the connection to the PINX. The default codec type is G729a.

If you are using the Multiple ISDN Switch Types feature to apply ISDN switch types to different interfaces, refer to the chapters "Configuring ISDN BRI" and "Configuring ISDN PRI" in the Cisco IOS Dial Technologies Configuration Guide for additional details.

The Cisco IOS command parser accepts the following switch types: basic-nwnet3, vn2, and basic-net3; however, when viewing the NVRAM configuration, the basic-net3 or vn3 switch types are displayed, respectively.

To remove an ISDN switch type from an ISDN interface, specify the no isdn switch-type switch-type command.

Table 33 lists supported BRI switch types by geographic area.

 

Table 33 ISDN Service Provider BRI Switch Types 

Keywords by Area
Switch Type
Voice/PBX Systems

 basic-qsig

PINX (PBX) switches with QSIG signaling per Q.931

Australia, Europe, UK

 basic-1tr6

German 1TR6 ISDN switch

 basic-net3

NET3 ISDN BRI for Norway NET3, Australia NET3, and New Zealand NET3switch types; ETSI-compliant switch types for Euro-ISDN E-DSS1 signaling system

 vn3

French ISDN BRI switches

Japan

 ntt

Japanese NTT ISDN switches

North America

 basic-5ess

Lucent (AT&T) basic rate 5ESS switch

 basic-dms100

Northern Telecom DMS-100 basic rate switch

 basic-ni

National ISDN switches

All Users

 none

No switch defined


Examples

The following example configures the French VN3 ISDN switch type:

isdn switch-type vn3
 
   

The following example uses the Multiple ISDN Switch Types feature and shows use of the global ISDN switch type basic-ni keyword (formerly basic-ni1) and the basic-net3 interface-level switch type keyword. ISDN switch type basic-net3 is applied to BRI interface 0 and overrides the global switch setting.

isdn switch-type basic-ni 
! 
interface BRI0 
 isdn switch-type basic-net3
 
   

The following example configures the Cisco MC3810 router to use BRI QSIG signaling for all of its BRI voice ports:

isdn switch-type basic-qsig 

The following example configures the Cisco MC3810 to use BRI QSIG signaling for BRI voice
port 1. On port 1, this setting overrides any different signaling set in the previous example.

interface bri 1
 isdn switch-type basic-qsig

isis ipv6 metric

To configure the value of an Intermediate System-to-Intermediate System (IS-IS) IPv6 metric, use the isis ipv6 metric command in interface configuration mode. To return the metric to its default value, use the no form of this command.

isis ipv6 metric {metric-value | maximum} [level-1 | level-2]

no isis ipv6 metric {metric-value | maximum} [level-1 | level-2]

Syntax Description

metric-value

Value added to the metric of an IPv6 IS-IS route received in a report message. The default metric value is 10. The range is from 1 to 16777214.

maximum

Excludes a link or adjacency from the Shortest Path Tree (SPF) calculation.

level-1

(Optional) Enables this command on routing Level 1. If no optional keyword is specified, the metric is enabled on routing Level 1 and Level 2.

level-2

(Optional) Enables this command on routing Level 2. If no optional keyword is specified, the metric is enabled on routing Level 1 and Level 2.


Command Default

The default metric value is set to 10.

Command Modes

Interface configuration

Command History

Release
Modification

12.2(15)T

This command was introduced.

12.2(18)S

This command was integrated into Cisco IOS Release 12.2(18)S.

12.0(26)S

This command was integrated into Cisco IOS Release 12.0(26)S.

12.1

The maximum keyword was added.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Cisco IOS XE Release 2.6

This command was introduced on Cisco ASR 1000 Series Routers.


Usage Guidelines

The isis ipv6 metric command is used only in multitopology IS-IS.

Changing the metric allows differentiation between IPv4 and IPv6 traffic, forcing traffic onto different interfaces. This function allows you to use the lower-cost rather than the high-cost interface.

For using extended metrics, such as with the IS-IS multitopology for IPv6 feature, Cisco IOS software provides support of a 24-bit metric field, the so-called "wide metric." Using the new metric style, link metrics now have a maximum value of 16777214 with a total path metric of 4261412864.

Cisco IOS Release 12.4(13) and 12.4(13)T

Entering the maximum keyword will exclude the link from the SPF calculation. If a link is advertised with the maximum link metric, the link will not be considered during the normal SPF computation. When the link excluded from the SPF, it will not be advertised for calculating the normal SPF. An example would be a link that is available for traffic engineering, but not for hop-by-hop routing. If a link, such as one that is used for traffic engineering, should not be included in the SPF calculation, enter the isis ipv6 metric command with the maximum keyword.


Note The isis ipv6 metric maximum command applies only when the metric-style wide command has been entered. The metric-style wide command is used to configure IS-IS to use the new-style type, length, value (TLV) because TLVs that are used to advertise IPv6 information in link-state packets (LSPs) are defined to use only extended metrics.

Examples

The following example sets the value of an IS-IS IPv6 metric to 20:

Router(config)# interface Ethernet 0/0/1
Router(config-if)# isis ipv6 metric 20
 
   

The following example sets the IS-IS IPv6 metric for the link to maximum. SPF will ignore the link for both Level 1 and Level 2 routing because neither the level-1 keyword nor the level-2 keyword was entered.

Router(config)# interface fastethernet 0/0
Router(config-if)# isis ipv6 metric maximum

Related Commands

Command
Description

metric-style wide

Configures a router running IS-IS so that it generates and accepts only new-style TLVs.


keepalive target

To identify Session Initiation Protocol (SIP) servers that will receive keepalive packets from the SIP gateway, use the keepalive target command in SIP user-agent configuration mode. To disable the keepalive target command behavior, use the no form of this command.

keepalive target {{ipv4:address | ipv6:address}[:port] | dns:hostname} | [tcp [tls]] | [udp] | [secondary]

no keepalive target [secondary]

Syntax Description

ipv4:address

IP address (in IP version 4 format) of the primary or secondary SIP server to monitor.

ipv6:address

IPv6 address of the primary or secondary SIP server to monitor.

:port

(Optional) SIP port number. Default SIP port number is 5060.

dns:hostname

DNS hostname of the primary or secondary SIP server to monitor.

tcp

(Optional) Sends keepalive packets over TCP.

tls

(Optional) Sends keepalive packets over Transport Layer Security (TLS).

udp

(Optional) Sends keepalive packets over User Datagram Protocol (UDP).

secondary

(Optional) Associates the IP version 4 address or the domain name system (DNS) hostname to a secondary SIP server to monitor.


Command Default

No keepalives are sent by default from SIP gateway to SIP gateway. The SIP port number is 5060 by default.

Command Modes

SIP user-agent configuration (config-sip-ua)

Command History

Release
Modification

12.4(6)T

This command was introduced.

12.4(22)T

Support for IPv6 was added.


Usage Guidelines

The primary or secondary SIP server addresses are in the following forms: dns:example.sip.com or ipv4:172.16.0.10.

Examples

The following example sets the primary SIP server address and defaults to the UDP transport:

sip-ua
 keepalive target ipv4:172.16.0.10
 
   

The following example sets the primary SIP server address and the transport to UDP:

sip-ua
 keepalive target ipv4:172.16.0.10 udp
 
   

The following example sets both the primary and secondary SIP server address and the transport to UDP:

sip-ua
 keepalive target ipv4:172.16.0.10 udp
 keepalive target ipv4:172.16.0.20 udp secondary
 
   

The following example sets both the primary and secondary SIP server addresses and defaults to the UDP transport:

sip-ua
 keepalive target ipv4:172.16.0.10
 keepalive target ipv4:172.16.0.20 secondary
 
   

The following example sets the primary SIP server address and the transport to TCP:

sip-ua
 keepalive target ipv4:172.16.0.10 tcp
 
   

The following example sets both the primary and secondary SIP server addresses and the transport to TCP:

sip-ua
 keepalive target ipv4:172.16.0.10 tcp
 keepalive target ipv4:172.16.0.20 tcp secondary
 
   

The following example sets the primary SIP server address and the transport to TCP and sets security to TLS mode:

sip-ua
 keepalive target ipv4:172.16.0.10 tcp tls
 
   

The following example sets both the primary and secondary SIP server addresses and the transport to TCP and sets security to the TLS mode:

sip-ua
 keepalive target ipv4:172.16.0.10 tcp tls
 keepalive target ipv4:172.16.0.20 tcp tls secondary

Related Commands

Command
Description

busyout monitor keepalive

Selects a voice port or ports to be busied out in cases of a keepalive failure.

keepalive trigger

Sets the trigger count to the number of Options message requests that must consecutively receive responses from the SIP servers in order to unbusy the voice ports when in the down state.

retry keepalive

Sets the retry keepalive count for retransmission.

timers keepalive

Sets the timers keepalive interval between sending Options message requests when the SIP server is active or down.


key

To identify an authentication key on a key chain, use the key command in key-chain configuration mode. To remove the key from the key chain, use the no form of this command.

key key-id

no key key-id

Syntax Description

key-id

Identification number of an authentication key on a key chain. The range of keys is from 0 to 2147483647. The key identification numbers need not be consecutive.


Command Default

No key exists on the key chain.

Command Modes

Key-chain configuration (config-keychain)

Command History

Release
Modification

11.1

This command was introduced.

12.4(6)T

Support for IPv6 was added.

12.2(33)SRB

This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.2SX

This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.


Usage Guidelines

Only DRP Agent, Enhanced Interior Gateway Routing Protocol (EIGRP), and Routing Information Protocol (RIP) Version 2 use key chains.

It is useful to have multiple keys on a key chain so that the software can sequence through the keys as they become invalid after time, based on the accept-lifetime and send-lifetime key chain key command settings.

Each key has its own key identifier, which is stored locally. The combination of the key identifier and the interface associated with the message uniquely identifies the authentication algorithm and Message Digest 5 (MD5) authentication key in use. Only one authentication packet is sent, regardless of the number of valid keys. The software starts looking at the lowest key identifier number and uses the first valid key.

If the last key expires, authentication will continue and an error message will be generated. To disable authentication, you must manually delete the last valid key.

To remove all keys, remove the key chain by using the no key chain command.

Examples

The following example configures a key chain named chain1. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# interface ethernet 0
Router(config-if)# ip rip authentication key-chain chain1
Router(config-if)# ip rip authentication mode md5
!
Router(config)# router rip
Router(config-router)# network 172.19.0.0
Router(config-router)# version 2
!
Router(config)# key chain chain1
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string key1
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain-key)# exit
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string key2
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600
 
   
 
   

The following named configuration example configures a key chain named chain1 for EIGRP address-family. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# router eigrp virtual-name
Router(config-router)# address-family ipv4 autonomous-system 4453
Router(config-router-af)# network 10.0.0.0
Router(config-router-af)# af-interface ethernet0/0
Router(config-router-af-interface)# authentication key-chain trees
Router(config-router-af-interface)# authentication mode md5
Router(config-router-af-interface)# exit
Router(config-router-af)# exit
Router(config-router)# exit
Router(config)# key chain chain1
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string key1
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain-key)# exit
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string key2
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600
 
   

The following named configuration example configures a key chain named chain1 for EIGRP service-family. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# eigrp virtual-name
Router(config-router)# service-family ipv4 autonomous-system 4453
Router(config-router-sf)# network 10.0.0.0
Router(config-router-sf)# sf-interface ethernet0/0
Router(config-router-sf-interface)# authentication key-chain trees
Router(config-router-sf-interface)# authentication mode md5
Router(config-router-sf-interface)# exit
Router(config-router-sf)# exit
Router(config-router)# exit
Router(config)# key chain chain1
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string key1
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain-key)# exit
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string key2
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600
 
   

Related Commands

Command
Description

accept-lifetime

Sets the time period during which the authentication key on a key chain is received as valid.

ip authentication key-chain eigrp

Enables authentication of EIGRP packets.

key chain

Defines an authentication key chain needed to enable authentication for routing protocols.

key-string (authentication)

Specifies the authentication string for a key.

send-lifetime

Sets the time period during which an authentication key on a key chain is valid to be sent.

show key chain

Displays authentication key information.


key (TACACS+)

To configure the per-server encryption key on the TACACS+ server, use the key command in TACACS+ server configuration mode. To remove the per-server encryption key, use the no form of this command.

key [0 | 7] key-string

no key [0 | 7] key-string

Syntax Description

0

(Optional) Specifies that an unencrypted key will follow.

7

(Optional) Specifies that a hidden key will follow.

key-string

Unencrypted shared key.


Command Default

No TACACS+ encryption key is configured.

Command Modes

TACACS+ server configuration (config-server-tacacs)

Command History

Release
Modification

Cisco IOS XE Release 3.2S

This command was introduced.


Usage Guidelines

The key command allows you to configure a per-server encryption key.

Examples

The following example shows how to specify an unencrypted shared key named key1:

Router (config)# tacacs server server1
Router(config-server-tacacs)# key 0 key1

Related Commands

Command
Description

tacacs server

Configures the TACACS+ server for IPv6 or IPv4 and enters TACACS+ server configuration mode.


key chain

To define an authentication key chain needed to enable authentication for routing protocols and enter key-chain configuration mode, use the key chain command in global configuration mode. To remove the key chain, use the no form of this command.

key chain name-of-chain

no key chain name-of-chain

Syntax Description

name-of-chain

Name of a key chain. A key chain must have at least one key and can have up to 2147483647 keys.


Command Default

No key chain exists.

Command Modes

Global configuration (config)

Command History

Release
Modification

11.1

This command was introduced.

12.4(6)T

Support for IPv6 was added.

12.2(33)SRB

This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.2SX

This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.


Usage Guidelines

Only DRP Agent, Enhanced Interior Gateway Routing Protocol (EIGRP), and Routing Information Protocol (RIP) Version 2 use key chains.

You must configure a key chain with keys to enable authentication.

Although you can identify multiple key chains, we recommend using one key chain per interface per routing protocol. Upon specifying the key chain command, you enter key chain configuration mode.

Examples

The following example configures a key chain named chain1. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# interface ethernet 0
Router(config-if)# ip rip authentication key-chain chain1
Router(config-if)# ip rip authentication mode md5
!
Router(config)# router rip
Router(config-router)# network 172.19.0.0
Router(config-router)# version 2
!
Router(config)# key chain chain1
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string key1
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain-key)# exit
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string key2
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600
 
   

The following named configuration example configures a key chain named chain1 for EIGRP address-family. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# router eigrp virtual-name
Router(config-router)# address-family ipv4 autonomous-system 4453
Router(config-router-af)# network 10.0.0.0
Router(config-router-af)# af-interface ethernet0/0
Router(config-router-af-interface)# authentication key-chain trees
Router(config-router-af-interface)# authentication mode md5
Router(config-router-af-interface)# exit
Router(config-router-af)# exit
Router(config-router)# exit
Router(config)# key chain chain1
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string key1
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain-key)# exit
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string key2
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600
 
   

The following named configuration example configures a key chain named trees for service-family. The key named chestnut will be accepted from 1:30 pm to 3:30 pm and be sent from 2:00 pm to 3:00 pm. The key birch will be accepted from 2:30 pm to 4:30 pm and be sent from 3:00 pm to 4:00 pm. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# router eigrp virtual-name
Router(config-router)# service-family ipv4 autonomous-system 4453
Router(config-router-sf)# sf-interface ethernet
Router(config-router-sf-interface)# authentication key chain trees
Router(config-router-sf-interface)# authentication mode md5
Router(config-router-sf-interface)# exit
Router(config-router-sf)# exit
Router(config-router)# exit
Router(config)# key chain chain1
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string chestnut
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain-key)# exit
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string birch
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600
 
   

Related Commands

Command
Description

accept-lifetime

Sets the time period during which the authentication key on a key chain is received as valid.

ip rip authentication key-chain

Enables authentication for RIP Version 2 packets and specifies the set of keys that can be used on an interface.

ip authentication key-chain eigrp

Enables authentication of EIGRP packets.

key

Identifies an authentication key on a key chain.

key-string (authentication)

Specifies the authentication string for a key.

send-lifetime

Sets the time period during which an authentication key on a key chain is valid to be sent.

show key chain

Displays authentication key information.


key-string (authentication)

To specify the authentication string for a key, use the key-string (authentication) command in key chain key configuration mode. To remove the authentication string, use the no form of this command.

key-string text

no key-string text

Syntax Description

text

Authentication string that must be sent and received in the packets using the routing protocol being authenticated. The string can contain from 1 to 80 uppercase and lowercase alphanumeric characters, except that the first character cannot be a number.


Command Default

No authentication string for a key exists.

Command Modes

Key chain key configuration (config-keychain-key)

Command History

Release
Modification

11.1

This command was introduced.

12.4(6)T

Support for IPv6 was added.

12.2(33)SRB

This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.2SX

This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.


Usage Guidelines

Only DRP Agent, Enhanced Interior Gateway Routing Protocol (EIGRP), and Routing Information Protocol (RIP) Version 2 use key chains. Each key can have only one key string.

If password encryption is configured (with the service password-encryption command), the software saves the key string as encrypted text. When you write to the terminal with the more system:running-config command, the software displays key-string 7 encrypted text.

Examples

The following example configures a key chain named chain1. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# interface ethernet 0
Router(config-if)# ip rip authentication key-chain chain1
Router(config-if)# ip rip authentication mode md5
!
Router(config)# router rip
Router(config-router)# network 172.19.0.0
Router(config-router)# version 2
!
Router(config)# key chain chain1
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string key1
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain-key)# exit
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string key2
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600
 
   

The following example configures a key chain named chain1 for EIGRP address-family. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# eigrp virtual-name
Router(config-router)# address-family ipv4 autonomous-system 4453
Router(config-router-af)# network 10.0.0.0
Router(config-router-af)# af-interface ethernet0/0
Router(config-router-af-interface)# authentication key-chain trees
Router(config-router-af-interface)# authentication mode md5
Router(config-router-af-interface)# exit
Router(config-router-af)# exit
Router(config-router)# exit
Router(config)# key chain chain1
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string key1
Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600
Router(config-keychain-key)# exit
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string key2
Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200
Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600
 
   

Related Commands

Command
Description

accept-lifetime

Sets the time period during which the authentication key on a key chain is received as valid.

ip authentication key-chain eigrp

Enables authentication of EIGRP packets.

key

Identifies an authentication key on a key chain.

key chain

Defines an authentication key-chain needed to enable authentication for routing protocols.

send-lifetime

Sets the time period during which an authentication key on a key chain is valid to be sent.

service password-encryption

Encrypts passwords.

show key chain

Displays authentication key information.


lifetime (IKE policy)

To specify the lifetime of an Internet Key Exchange (IKE) security association (SA), use the lifetime command in Internet Security Association Key Management Protocol (ISAKMP) policy configuration mode. To reset the SA lifetime to the default value, use the no form of this command.

lifetime seconds

no lifetime

Syntax Description

seconds

Number of many seconds for each SA should exist before expiring. Use an integer from 60 to 86,400 seconds, which is the default value.


Command Default

The default is 86,400 seconds (one day).

Command Modes

ISAKMP policy configuration

Command History

Release
Modification

11.3 T

This command was introduced.

12.2(33)SRA

This command was integrated into Cisco IOS release 12.(33)SRA.

12.2SX

This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.

Cisco IOS XE Release 2.1

This command was introduced on Cisco ASR 1000 Series Routers.


Usage Guidelines

Use this command to specify how long an IKE SA exists before expiring.

When IKE begins negotiations, the first thing it does is agree upon the security parameters for its own session. The agreed-upon parameters are then referenced by an SA at each peer. The SA is retained by each peer until the SA's lifetime expires. Before an SA expires, it can be reused by subsequent IKE negotiations, which can save time when setting up new IPSec SAs. Before an SA expires, it can be reused by subsequent IKE negotiations, which can save time when setting up new IPSec SAs. New IPSec SAs are negotiated before current IPSec SAs expire.

So, to save setup time for IPSec, configure a longer IKE SA lifetime. However, shorter lifetimes limit the exposure to attackers of this SA. The longer an SA is used, the more encrypted traffic can be gathered by an attacker and possibly used in an attack.

Note that when your local peer initiates an IKE negotiation between itself and a remote peer, an IKE policy can be selected only if the lifetime of the remote peer's policy is shorter than or equal to the lifetime of the local peer's policy. Then, if the lifetimes are not equal, the shorter lifetime will be selected. To restate this behavior: If the two peer's policies' lifetimes are not the same, the initiating peer's lifetime must be longer and the responding peer's lifetime must be shorter, and the shorter lifetime will be used.

Examples

The following example configures an IKE policy with a security association lifetime of 600 seconds (10 minutes), and all other parameters are set to the defaults:

crypto isakmp policy 15
 lifetime 600
 exit

Related Commands

Command
Description

authentication (IKE policy)

Specifies the authentication method within an IKE policy.

crypto isakmp policy

Defines an IKE policy.

encryption (IKE policy)

Specifies the encryption algorithm within an IKE policy.

group (IKE policy)

Specifies the Diffie-Hellman group identifier within an IKE policy.

hash (IKE policy)

Specifies the hash algorithm within an IKE policy.

show crypto isakmp policy

Displays the parameters for each IKE policy.


limit address-count

To limit the number of IPv6 addresses allowed to be used on the port, use the limit address-count command in Neighbor Discovery Protocol (NDP) inspection policy configuration mode.

limit address-count maximum

Syntax Description

maximum

Sets the role of the device to host.


Command Default

The device role is host.

Command Modes

ND inspection policy configuration (config-nd-inspection)
RA guard policy configuration (config-ra-guard)

Command History

Release
Modification

12.2(50)SY

This command was introduced.


Usage Guidelines

The limit address-count command limits the number of IPv6 addresses allowed to be used on the port on which the policy is applied. Limiting the number of IPv6 addresses on a port helps limit the binding table size.

Use the limit address-count command after enabling NDP inspection policy configuration mode using the ipv6 nd inspection policy command.

Examples

The following example defines an NDP policy name as policy1, places the router in NDP inspection policy configuration mode, and limits the number of IPv6 addresses allowed on the port to 25:

Router(config)# ipv6 nd inspection policy policy1
Router(config-nd-inspection)# limit address-count 25

Related Commands

Command
Description

ipv6 nd inspection policy

Defines the NDP inspection policy name and enters NDP inspection policy configuration mode.

ipv6 nd raguard policy

Defines the RA guard policy name and enter RA guard policy configuration mode.


log-adjacency-changes

To configure the router to send a syslog message when an Open Shortest Path First (OSPF) neighbor goes up or down, use the log-adjacency-changes command in router configuration mode. To turn off this function, use the no form of this command.

log-adjacency-changes [detail]

no log-adjacency-changes [detail]

Syntax Description

detail

(Optional) Sends a syslog message for each state change, not just when a neighbor goes up or down.


Command Default

Enabled

Command Modes

Router configuration (config-router)

Command History

Release
Modification

11.2

This command was introduced as ospf log-adjacency-changes.

12.1

The ospf keyword was omitted and the detail keyword was added.

12.2(15)T

Support for IPv6 was added.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2SX

This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.

15.1(2)S

This command was integrated into Cisco IOS Release 15.1(2)S.


Usage Guidelines

This command allows you to know about OSPF neighbors going up or down without turning on the debug ip ospf packet command or the debug ipv6 ospf adjacency command. The log-adjacency-changes command provides a higher level view of those changes of the peer relationship with less output than the debug command provides. The log-adjacency-changes command is on by default but only up/down (full/down) events are reported, unless the detail keyword is also used.

Examples

The following example configures the router to send a syslog message when an OSPF neighbor state changes:

log-adjacency-changes detail
 
   
 
   
 
   

Related Commands

Command
Description

debug ip ospf packet

Displays information about each OSPF packet received for IPv4.

debug ipv6 ospf

Displays debugging information for OSPF for IPv6.


log-adjacency-changes (OSPFv3)

To configure the router to send a syslog message when an Open Shortest Path First version 3 (OSPFv3) neighbor goes up or down, use the log-adjacency-changes command in router configuration mode. To turn off this function, use the no form of this command.

log-adjacency-changes [detail]

no log-adjacency-changes [detail]

Syntax Description

detail

(Optional) Sends a syslog message for each state change, not just when a neighbor goes up or down.


Command Default

This feature is enabled

Command Modes

OSPFv3 router configuration mode (config-router)

Command History

Release
Modification

15.1(3)S

This command was introduced.

Cisco IOS XE Release 3.4S

This command was integrated into Cisco IOS XE Release 3.4S.

15.2(1)T

This command was integrated into Cisco IOS Release 15.2(1)T.


Usage Guidelines

Use the log-adjacency changes command to notify you when OSPFv3 neighbors go up or down. The log-adjacency-changes command provides a higher level view of those changes of the peer relationship with less output than debug commands provide. The log-adjacency-changes command is on by default, but only up/down (full/down) events are reported unless the detail keyword is also used.

Examples

The following example configures the router to send a syslog message when an OSPFv3 neighbor state changes:

Router(config-router)# log-adjacency-changes

Related Commands

Command
Description

router ospfv3

Enables OSPFv3 router configuration mode for the IPv4 or IPv6 address family.


logging event link-status (interface configuration)

To enable link-status event messaging on an interface, use the logging event link-status command in interface configuration mode. To disable link-status event messaging, use the no form of this command.

logging event link-status [bchan | dchan | nfas]

no logging event link-status [bchan | dchan | nfas]

Syntax Description

bchan

(Optional) Logs B-channel status messages. This keyword is available only for integrated services digital network (ISDN) serial interfaces.

dchan

(Optional) Logs D-channel status messages. This keyword is available only for ISDN serial interfaces.

nfas

(Optional) Logs non-facility associated signaling (NFAS) D-channel status messages. This keyword is available only for ISDN serial interfaces.


Command Default

Interface state-change messages are not sent.

Command Modes

Interface configuration (config-if)

Command History

Release
Modification

12.2(14)SX

This command was introduced on the Supervisor Engine 720.

12.2(17d)SXB

This command was modified to support the Supervisor Engine 2.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.


Usage Guidelines

To enable system logging of interface state-change events on a specific interface, enter the logging event link-status command.

Examples

The following example shows how to enable link-status event messaging on an interface:

Router(config-if)# logging event link-status
 
   

This example shows how to disable link-status event messaging on an interface:

Router(config-if)# no logging event link-status 

logging host

To log system messages and debug output to a remote host, use the logging host command in global configuration mode. To remove a specified logging host from the configuration, use the no form of this command.

logging host {{ip-address | hostname} [vrf vrf-name] | ipv6 {ipv6-address | hostname}} [discriminator discr-name | [[filtered [stream stream-id] | xml]] [transport {[beep [audit] [channel chnl-number] [sasl profile-name] [tls cipher [cipher-num] trustpoint trustpt-name]]] | tcp [audit] | udp} [port port-num]] [sequence-num-session] [session-id {hostname | ipv4 | ipv6 | string custom-string}]

no logging host {{ip-address | hostname} | ipv6 {ipv6-address | hostname}}

Syntax Description

ip-address

IP address of the host that will receive the system logging (syslog) messages.

hostname

Name of the IP or IPv6 host that will receive the syslog messages.

vrf

(Optional) Specifies a virtual private network (VPN) routing and forwarding instance (VRF) that connects to the syslog server host.

vrf-name

(Optional) Name of the VRF that connects to the syslog server host.

ipv6

Indicates that an IPv6 address will be used for a host that will receive the syslog messages.

ipv6-address

IPv6 address of the host that will receive the syslog messages.

discriminator

(Optional) Specifies a message discriminator for the session.

discr-name

(Optional) Name of the message discriminator.

filtered

(Optional) Specifies that logging messages sent to this host should first be filtered by the Embedded Syslog Manager (ESM) syslog filter modules specified in the logging filter commands.

stream

(Optional) Specifies that only ESM filtered messages with the stream identification number specified in the stream-id argument should be sent to this host.

stream-id

(Optional) Number from 10 to 65535 that identifies the message stream.

xml

(Optional) Specifies that the logging output should be tagged using the Extensible Markup Language (XML) tags defined by Cisco.

transport

(Optional) Method of transport to be used. UDP is the default.

beep

(Optional) Specifies that the Blocks Extensible Exchange Protocol (BEEP) transport will be used.

audit

(Optional) Available only for BEEP and TCP. When the audit keyword is used, the specified host is identified for firewall audit logging.

channel

(Optional) Specifies the BEEP channel number to use.

chnl-number

(Optional) Number of the BEEP channel. Valid values are 1, 3, 5, 7, 9, 11, 13, and 15. The default is 1.

sasl

(Optional) Applies the Simple Authentication and Security Layer BEEP profile.

profile-name

(Optional) Name of the SASL profile.

tls cipher

(Optional) Specifies the cipher suites to be used for a connection. Cipher suites are referred to by mask values. Multiple cipher suites can be chosen by adding the mask values. The tls cipher cipher-num keyword and argument pair is available only in crypto images.

cipher-num

(Optional) Integer from 32 to 224 that is the mask value of a cipher suite (sum of up to three numbers: 32, 64, and 128) and refers to the following:

ENC_FLAG_TLS_RSA_WITH_NULL_SHA - 32

ENC_FLAG_TLS_RSA_WITH_RC4_128_MD5 - 64

ENC_FLAG_TLS_RSA_WITH_AES_128_CBC_SHA - 128

The tls cipher cipher-num keyword and argument pair is available only in crypto images.

trustpoint

(Optional) Specifies a trustpoint for identity information and certificates. The trustpoint trustpt-name keyword and argument pair is available only in crypto images.

trustpt-name

(Optional) Name of the trustpoint. If you previously declared the trustpoint and want only to update its characteristics, specify the name you previously created. The trustpoint trustpt-name keyword and argument pair is available only in crypto images.

tcp

(Optional) Specifies that the TCP transport will be used.

udp

(Optional) Specifies that the User Datagram Protocol (UDP) transport will be used.

port

(Optional) Specifies that a port will be used.

port-number

(Optional) Integer from 1 through 65535 that defines the port.

If a port number is not specified, the standard Cisco default port number for TCP is 601, for BEEP is 601, and for UDP is 514.

sequence- num-session

(Optional) Includes a session sequence number tag in the syslog message.

session-id

(Optional) Specifies syslog message session ID tagging.

hostname

Includes the hostname in the session ID tag.

ipv4

Includes the logging source IP address in the session ID tag.

ipv6

Includes the logging source IPv6 address in the session ID tag.

string

Includes the custom string in the session ID tag.

custom-string

Custom string in the s_id="custom_string" tag.


Command Default

System logging messages are not sent to any remote host.
When this command is entered without the xml or filtered keyword, messages are sent in the standard format.

Command Modes

Global configuration (config)

Command History

T Release
Modifications

10.0

The logging command was introduced.

12.2(15)T

The logging host command replaced the logging command.

The xml keyword was added.

12.3(2)T

The filtered [stream stream-id] syntax was added as part of the ESM feature.

12.3(14)T

The transport keyword was added.

12.4(4)T

The ipv6 ipv6-address keyword-argument pair was added.

12.4(11)T

Support for BEEP and the discriminator, sequence-num-session, and session-id keywords and discr-name argument were added.

S Release
Modifications

12.0(14)S

The logging host command replaced the logging command.

12.0(14)ST

The logging host command replaced the logging command.

12.2(25)S

This command was integrated into Cisco IOS Release 12.2(25)S and the vrf vrf-name keyword-argument pair was added.

SR Release
Modifications

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA. The vrf vrf-name and xml keywords were supported.

SX Release
Modifications

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH. The vrf vrf-name and xml keywords were supported.

12.2(33)SXI

Support for BEEP and the discriminator, sequence-num-session, and session-id keywords and discr-name argument were added.

XE Release
Modifications

12.3(2)XE

This command was integrated into Cisco IOS Release 12.3(2)XE.

SB Release
Modifications

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB. The vrf vrf-name and xml keywords were supported.

12.2(31)SB2

This command was implemented on the Cisco 10000 series routers. The vrf vrf-name and xml keywords were supported.


Usage Guidelines

Standard system logging is enabled by default. If logging is disabled on your system (using the no logging on command), you must enter the logging on command to reenable logging before you can use the logging host command.

The logging host command identifies a remote host (usually a device serving as a syslog server) to receive logging messages. By issuing this command more than once, you can build a list of hosts that receive logging messages.

To specify the severity level for logging to all hosts, use the logging trap command.

Use the vrf vrf-name keyword and argument to enable a syslog client (a provider edge [PE] router) to send syslog messages to a syslog server host connected through a VRF interface. To delete the configuration of the syslog server host from the VRF, use the no logging host command with the vrf vrf-name keyword and argument.

When XML-formatted syslog is enabled using the logging host command with the xml keyword, messages are sent to the specified host with the system-defined XML tags. These tags are predefined and cannot be configured by a user. XML formatting is not applied to debug output.

If you are using the ESM feature, you can enable ESM-filtered syslog messages to be sent to one or more hosts using the logging host filtered command. To use the ESM feature, you must first specify the syslog filter modules that should be applied to the messages using the logging filter command. See the description of the logging filter command for more information about the ESM feature.


Note ESM and message discriminator usage are mutually exclusive on a given syslog session.

Using the BEEP transport protocol, you can have reliable and secure delivery for syslog messages and configure multiple sessions over eight BEEP channels. The sasl profile-name, tls cipher cipher-num, trustpoint trustpt-name keywords and arguments are available only in crypto images.

To configure standard logging to a specific host after configuring XML-formatted or ESM-filtered logging to that host, use the logging host command without the xml or filtered keyword. Issuing the standard logging host command replaces an XML- or ESM- filtered logging host command, and vice versa, if the same host is specified.

You can configure the system to send standard messages to one or more hosts, XML-formatted messages to one or more hosts, and ESM-filtered messages to one or more hosts by repeating this command as many times as desired with the appropriate syntax. (See the "Examples" section.)

When the no logging host command is issued with or without the optional keywords, all logging to the specified host is disabled.

Examples

In the following example, messages at severity levels 0 (emergencies) through 5 (notifications) (logging trap command severity levels) are logged to a host at 192.168.202.169:

Router(config)# logging host 192.168.202.169 
Router(config)# logging trap 5 
 
   

In the following example, standard system logging messages are sent to the host at 192.168.200.225, XML-formatted system logging messages are sent to the host at 192.168.200.226, ESM-filtered logging messages with the stream 10 value are sent to the host at 192.168.200.227, and ESM-filtered logging messages with the stream 20 value are sent to host at 192.168.202.129:

Router(config)# logging host 192.168.200.225 
Router(config)# logging host 192.168.200.226 xml 
Router(config)# logging host 192.168.200.227 filtered stream 10 
Router(config)# logging host 192.168.202.129 filtered stream 20 
 
   

In the following example, messages are logged to a host with an IP address of 172.16.150.63 connected through a VRF named vpn1:

Router(config)# logging host 172.16.150.63 vrf vpn1
 
   

In the following example, the default UDP on an IPv6 server is set because no port number is specified. The default port number of 514 is used:

Router(config)# logging host ipv6 AAAA:BBBB:CCCC:DDDD::FFFF 
 
   

In the following example, TCP port 1774 on an IPv6 server is set:

Router(config)# logging host ipv6 BBBB:CCCC:DDDD:FFFF::1234 transport tcp port 1774
 
   

In the following example, the UDP port default is used on an IPv6 server with a hostname of v6-hostname:

Router(config)# logging host ipv6 v6-hostname transport udp port 514
 
   

In the following example, a message discriminator named fltr1 is specified as well as the BEEP protocol for port 600 and channel 3.

Router(config)# logging host host2 dicriminator fltr1 transport beep channel 3 port 600 

Related Commands

Command
Description

logging filter

Specifies a syslog filter module to be used by the ESM.

logging on

Globally controls (enables or disables) system message logging.

logging trap

Limits messages sent to the syslog servers based on severity level.

show logging

Displays the state of system message logging, followed by the contents of the standard syslog buffer.

show logging xml

Displays the state of XML-formatted system message logging, followed by the contents of the XML syslog buffer.


logging origin-id

To add an origin identifier to system logging messages sent to remote hosts, use the logging origin-id command in global configuration mode. To disable the origin identifier, use the no form of this command.

logging origin-id {hostname | ip | ipv6 | string user-defined-id}

no logging origin-id

Syntax Description

hostname

Specifies that the hostname will be used as the message origin identifier.

ip

Specifies that the IP address of the sending interface will be used as the message origin identifier.

ipv6

Specifies that the IPv6 address of the sending interface will be used as the message origin identifier.

string user-defined-id

Allows you to enter your own identifying description. The user-defined-id argument is a string you specify.

You can enter a string with no spaces or use delimiting quotation marks to enclose a string with spaces.


Command Default

This command is disabled.

Command Modes

Global configuration (config)

Command History

Release
Modification

12.2(15)T

This command was introduced.

12.3(1)

The string user-defined-id syntax was added.

12.3(2)XE

This command was integrated into Cisco IOS Release 12.3(2)XE.

12.2(25)S

This command was integrated into Cisco IOS Release 12.2(25)S.

12.4(4)T

The ipv6 keyword was added.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

12.2(33)SB

This command was integrated into Cisco IOS Release 12.2(33)SB.


Usage Guidelines

The origin identifier is added to the beginning of all system logging (syslog) messages sent to remote hosts. The identifier can be the hostname, the IP address, the IPv6 address, or any text that you specify. The origin identifier is not added to messages sent to local destinations (the console, monitor, or buffer).

The origin identifier is useful for identifying the source of system logging messages in cases where you send syslog output from multiple devices to a single syslog host.

When you specify your own identification string using the logging origin-id string user-defined-id command, the system expects a string without spaces. For example:

Router(config)# logging origin-id string Cisco_Systems 
 
   

To use spaces (multiple words) or additional syntax, enclose the string with quotation marks (" "). For example:

Router(config)# logging origin-id string "Cisco Systems, Inc." 

Examples

In the following example, the origin identifier "Domain 1, router B" will be added to the beginning of all system logging messages sent to remote hosts:

Router(config)# logging origin-id string Domain 1, router B
 
   

In the following example, all logging messages sent to remote hosts will have the IP address configured for serial interface 1 added to the beginning of the message:

Router(config)# logging host 209.165.200.225 
Router(config)# logging trap 5 
Router(config)# logging source-interface serial 1 
Router(config)# logging origin-id ip 

Related Commands

Command
Description

logging host

Enables system message logging to a remote host.

logging source-interface

Forces logging messages to be sent from a specified interface, instead of any available interface.

logging trap

Configures the severity level at or numerically below which logging messages should be sent to a remote host.


logging source-interface

To specify the source IPv4 or IPv6 address of system logging packets, use the logging source-interface command in global configuration mode. To remove the source designation, use the no form of this command.

logging source-interface type number vrf vrf_name

no logging source-interface

Syntax Description

type number

Interface type and number.

vrf vrf_name

Name of VRF.


Command Default

The wildcard interface address is used.

Command Modes

Global configuration (config)

Command History

Release
Modification

11.2

This command was introduced.

12.4(4)T

This command was modified. IPv6 support was added.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2SX

This command is supported in the Cisco IOS Release 12.2SX. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.2(33)SXJ1

This command was modified to include the vrf keyword and attribute.

15.1(3)S

This command was modified to include the vrf keyword and attribute.


Usage Guidelines

This command can be configured on the Virtual Routing and Forwarding (VRF) and non-VRF interfaces. Normally, a syslog message contains the IPv4 or IPv6 address of the interface used to exit the router. The logging source-interface command configures the syslog packets that contain the IPv4 or IPv6 address of a particular interface, regardless of which interface the packet uses to exit the router.

When no specific interface is configured, a wildcard interface address of 0.0.0.0 (for IPv4) or :: (for IPv6) is used, and the IP socket selects the best outbound interface.

If you configure the same VRF interface multiple times the newest configuration will override earlier configurations.

The maximum allowable source-interfaces commands is 200 since there can be only a maximum of 200 hosts.

Examples

The following example shows how to specify that the IP address of Ethernet interface 0 is the source IP address for all syslog messages:

Router(config)# logging source-interface ethernet 0 
 
   

The following example shows how to specify the IP address for Ethernet interface 2/1 is the source IP address for all syslog messages:

Router(config)# logging source-interface ethernet 2/1 

The following sample output displays that the logging source-interface command is configured on a VRF source interface:

Router# show running interface loopback49
             Building configuration...
 
   
             Current configuration : 84 bytes
             !
             interface Loopback49
              ip vrf forwarding black
              ip address 49.0.0.1 255.0.0.0
             end
Router# show running | includes logging
      logging source-interface Loopback49 vrf black
      logging host 130.0.0.1 vrf black

Related Commands

Command
Description

logging

Logs messages to a syslog server host.


log-neighbor-changes (IPv6 EIGRP)

To enable the logging of changes in Enhanced Interior Gateway Routing Protocol (EIGRP) IPv6 neighbor adjacencies, use the log-neighbor-changes command in router configuration mode. To disable the logging of changes in EIGRP IPv6 neighbor adjacencies, use the no form of this command.

log-neighbor-changes

no log-neighbor-changes

Syntax Description

This command has no arguments or keywords.

Command Default

Adjacency changes are logged.

Command Modes

Router configuration

Command History

Release
Modification

12.4(6)T

This command was introduced.

12.2(33)SRB

This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Cisco IOS XE Release 2.1

This command was introduced on Cisco ASR 1000 Series Routers.


Usage Guidelines

The log-neighbor-changes command enables the logging of neighbor adjacency changes to monitor the stability of the routing system and to help detect problems.

Logging is enabled by default. To disable the logging of neighbor adjacency changes, use the no form of this command.

Examples

The following example disables logging of neighbor changes for EIGRP process 1:

ipv6 router eigrp 1
 no log-neighbor-changes
 
   

The following configuration enables logging of neighbor changes for EIGRP process 1:

ipv6 router eigrp 1
 log-neighbor-changes

Related Commands

Command
Description

log-neighbor-
warnings

Enables the logging of EIGRP neighbor warning messages.


log-neighbor-warnings


Note Effective with Cisco IOS Release 15.0(1)M, 12.2(33)SRE and Cisco IOS XE Release 2.5, the log-neighbor-warnings command was replaced by the eigrp log-neighbor-warnings command for IPv4 and IPv6 configurations. The log-neighbor-warnings command is still available for IPX configurations.

To enable the logging of Enhanced Interior Gateway Routing Protocol (EIGRP) neighbor warning messages, use the log-neighbor-warnings command in router configuration mode. To disable the logging of EIGRP neighbor warning messages, use the no form of this command.

log-neighbor-warnings [seconds]

no log-neighbor-warnings

Syntax Description

seconds

(Optional) The time interval (in seconds) between repeated neighbor warning messages. The range of seconds is from 1 through 65535.


Command Default

Neighbor warning messages are logged.

Command Modes

Router configuration (config-router)

Command History

Release
Modification

12.4(6)T

This command was introduced.

12.2(33)SRB

This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Cisco IOS XE Release 2.1

This command was introduced on Cisco ASR 1000 Series Routers.

15.0(1)M

This command was replaced by the eigrp log-neighbor-warnings command for IPv4 and IPv6 configurations. The log-neighbor-warnings command is still available for IPX configurations.

12.2(33)SRE

This command was replaced by the eigrp log-neighbor-warnings command for IPv4 and IPv6 configurations. The log-neighbor-warnings command is still available for IPX configurations.

Cisco IOS XE Release 2.5

This command was replaced by the eigrp log-neighbor-warnings command for IPv4 and IPv6 configurations. The log-neighbor-warnings command is still available for IPX configurations.


Usage Guidelines

When neighbor warning messages occur, they are logged by default. With the log-neighbor-warnings command, you can disable and enable the logging of neighbor warning messages and configure the interval between repeated neighbor warning messages.

Examples

The following example shows that neighbor warning messages will be logged for EIGRP process 1 and warning messages will be repeated in 5-minute (300 seconds) intervals:

Router(config)# ipv6 router eigrp 1
Router(config-router)# log-neighbor-warnings 300

Related Commands

Command
Description

log-neighbor-changes

Enables the logging of changes in EIGRP neighbor adjacencies.


managed-config-flag

To verify the advertised managed address configuration parameter, use the managed-config-flag command in router advertisement (RA) guard policy configuration mode.

managed-config-flag {on | off}

Syntax Description

on

Verification is enabled.

off

Verification is disabled.


Command Default

Verification is not enabled.

Command Modes

RA guard policy configuration (config-ra-guard)

Command History

Release
Modification

12.2(50)SY

This command was introduced.


Usage Guidelines

The managed-config-flag command enables verification of the advertised managed address configuration parameter (or "M" flag). This flag could be set by an attacker to force hosts to obtain addresses through a potentially untrusted DHCPv6 server.

Examples

The following example defines an RA guard policy name as raguard1, places the router in RA guard policy configuration mode, and enables M flag verification:

Router(config)# ipv6 nd raguard policy raguard1
Router(config-ra-guard)# managed-config-flag on

Related Commands

Command
Description

ipv6 nd raguard policy

Defines the RA guard policy name and enter RA guard policy configuration mode.


mask

To specify the destination or source mask, use the mask command in aggregation cache configuration mode. To disable the destination mask, use the no form of this command.

mask {destination | source} minimum value

no mask destination minimum value

Syntax Description

destination

Specifies that the destination mask is to be used for determining the aggregation cache.

source

Specifies that the source mask is to be used for determining the aggregation cache.

value

Specifies the number of bits to record from the source or destination mask. Range is from 1 to 32.


Command Default

The default value of the minimum mask is zero.

Command Modes

Aggregation cache configuration

Command History

Release
Modification

12.1(2)T

This command was introduced.

12.3(7)T

Support was added for IPv6 source and destination addresses to be used for cache aggregation.

12.2(30)S

This command was integrated into Cisco IOS Release 12.2(30)S.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.


Usage Guidelines

This command is only available with router-based aggregation. Minimum masking capability is not available if router-based aggregation is not enabled.

Examples

The following example shows how to configure the mask to use the destination-prefix as the aggregation cache scheme with a minimum mask value of 32:

Router(config)# ipv6 flow-aggregation cache destination-prefix
Router(config-flow-cache)# mask destination minimum 32

Related Commands

Command
Description

ip flow-aggregation cache

Enables aggregation cache configuration mode.

ipv6 flow-aggregation cache

Enables aggregation cache configuration mode for IPv6 traffic.

show ip cache flow aggregation

Displays the aggregation cache configuration.

show ipv6 cache flow aggregation

Displays the aggregation cache configuration for IPv6 NetFlow configurations.


match (IKEv2 policy)

To match a policy based on Front-door VPN Routing and Forwarding (FVRF) or local parameters, such as an IP address, use the match command in IKEv2 policy configuration mode. To delete a match, use the no form of this command.

match address local {ipv4-address | ipv6-address | fvrf fvrf-name | any}

no match address local {ipv4-address | ipv6-address | fvrf fvrf-name | any}

Syntax Description

address local

Matches a policy based on the local IPv4 or IPv6 address.

ipv4-address

IPv4 address.

ipv6-address

IPv6 address.

fvrf

Matches a policy based on the user-defined FVRF.

frvf-name

FVRF name

any

Matches a policy based on any FVRF.


Command Default

If no match address is specified, the policy matches all local addresses.

Command Modes

IKEv2 policy configuration (crypto-ikev2-policy)

Command History

Release
Modification

15.1(1)T

This command was introduced.

15.1(4)M

This command was modified. Support was added for IPv6 addresses.

Cisco IOS XE Release 3.3S

This command was integrated into Cisco IOS XE Release 3.3S.


Usage Guidelines

Use this command to match a policy based on the FVRF or the local IP address (IPv4 or IPv6). The FVRF specifies the VRF in which the IKEv2 security association (SA) packets are negotiated. The default FVRF is the global FVRF. Use the match fvrf any command to match a policy based on any FVRF.

A policy with no match address local statement will match all local addresses. A policy with no match FVRF statement will match the global FVRF. If there are no match statements, an IKEv2 policy matches all local addresses in the global VRF.

Examples

The following example shows how to match an IKEv2 policy based on the FVRF and the local IPv4 address:

Router(config)# crypto ikev2 policy policy1
Router(config-ikev2-policy)# proposal proposal1
Router(config-ikev2-policy)# match fvrf fvrf1
Router(config-ikev2-policy)# match address local 10.0.0.1
 
   

The following example shows how to match an IKEv2 policy based on the FVRF and the local IPv6 address:

Router(config)# crypto ikev2 policy policy1
Router(config-ikev2-policy)# proposal proposal1
Router(config-ikev2-policy)# match fvrf fvrf1
Router(config-ikev2-policy)# match address local 2001:DB8:0:ABCD::1

Related Commands

Command
Description

crypto ikev2 policy

Defines an IKEv2 policy.

proposal

Specifies the proposals that must be used in the IKEv2 policy.

show crypto ikev2 policy

Displays the default or user-defined IKEv2 policy.


match (IKEv2 profile)

To match a profile on front-door VPN routing and forwarding (FVRF) or local parameters such as the IP address, the peer identity, or the peer certificate, use the match command in IKEv2 profile configuration mode. To delete a match, use the no form of this command.

match {address local {ipv4-address | ipv6-address | interface name} | certificate certificate-map | fvrf {fvrf-name | any} | identity remote {address {ipv4-address [mask] | ipv6-address prefix} | email [domain] string | fqdn [domain] string | key-id opaque-string}

no match {address local {ipv4-address | ipv6-address | interface name} | certificate certificate-map} | fvrf {fvrf-name | any} | identity remote {address {ipv4-address [mask] | ipv6-address prefix} | email [domain] string | fqdn [domain] string | key-id opaque-string}

Syntax Description

address local {ipv4-address | ipv6-address}

Matches the profile based on the local IPv4 or IPv6 address.

interface name

Matches the profile based on the local interface.

certificate certificate-map

Matches the profile based on fields in the certificate received from the peer.

fvrf fvrf-name

Matches the profile based on the user-defined FVRF. The default FVRF is global.

any

Matches the profile based on any FVRF.

Note The match vrf any command must be explicitly configured to match all VRFs.

identity remote

Match a profile based on the remote IKEv2 identity field in the AUTH exchange.

address {ipv4-address [mask] | ipv6-address prefix}

Matches a profile based on the identity of the type remote IPv4 address and its subnet mask or IPv6 address and its prefix length.

key-id opaque-string

Matches a profile based on the identity of the type remote key ID.

email

Matches a profile based on the identity of the type remote email ID.

fqdn fqdn-name

Matches a profile based on the identity of the type remote Fully Qualified Domain Name (FQDN).

domain string

Matches a profile based on the domain part of remote identities of the type FQDN or email.


Command Default

A match is not specified.

Command Modes

IKEv2 profile configuration (crypto-ikev2-profile)

Command History

Release
Modification

15.1(1)T

This command was introduced.

15.1(4)M

This command was modified. Support was added for IPv6 addresses.

Cisco IOS XE Release 3.3S

This command was integrated into Cisco IOS XE Release 3.3S.


Usage Guidelines

In an IKEv2 profile, multiple match statements of the same type are logically ORed and match statements of different types are logically ANDed.


Note The match identity remote and match certificate statements are considered the same type of statements and are ORed.

The result of configuring multiple match certificate statements is the same as configuring one match certificate statement. Hence, using a single match certificate statement as a certificate map caters to multiple certificates and is independent of trustpoints.


Note There can only be one match FVRF statement.

For example, the following command translates to the subsequent "and", "or" statement:

crypto ikev2 profile profile-1
 match vrf green
 match local address 10.0.0.1
 match local address 10.0.0.2
 match certificate remote CertMap
 
   

(vrf = green AND (local addr = 10.0.0.1 OR local addr = 10.0.0.1) AND remote certificate match CertMap).

There is no precedence between match statements of different types, and selection is based on the first match. Configuration of overlapping profiles is considered as a misconfiguration.

Examples

The following examples show how an IKEv2 profile is matched on the remote identity. The following profile caters to peers that identify using fqdn example.com and authenticate with rsa-signature using trustpoint-remote. The local node authenticates with pre-share using keyring-1.

Router(config)# crypto ikev2 profile profile2
Router(config-ikev2-profile)# match identity remote fqdn example.com
Router(config-ikev2-profile)# identity local email router2@example.com
Router(config-ikev2-profile)# authentication local pre-share
Router(config-ikev2-profile)# authentication remote rsa-sig
Router(config-ikev2-profile)# keyring keyring-1
Router(config-ikev2-profile)# pki trustpoint trustpoint-remote verify
Router(config-ikev2-profile)# lifetime 300
Router(config-ikev2-profile)# dpd 5 10 on-demand
Router(config-ikev2-profile)# virtual-template 1

Related Commands 

Command
Description

crypto ikev2 profile

Defines an IKEv2 profile.

identity (IKEv2 profile)

Specifies how the local or remote router identifies itself to the peer and communicates with the peer in the RSA authentication exchange.

authentication (IKEv2 profile)

Specifies the local and remote authentication methods in an IKEv2 profile.

keyring (IKEv2 profile)

Specifies a locally defined or AAA-based keyring.

pki trustpoint

Specifies the router to use the PKI trustpoints in the RSA signature authentication.


match access-group name

To specify the name of an IPv6 access list against whose contents packets are checked to determine if they belong to the traffic class, use the match access-group name command in class-map configuration mode. To remove the name of the IPv6 access list, use the no form of this command.

match access-group name ipv6-access-group

no match access-group name ipv6-access-group

Syntax Description

ipv6-access-group

Name of the IPv6 access group. Names cannot contain a space or quotation mark, or begin with a numeric.


Command Default

No match criteria are configured.

Command Modes

Class-map configuration

Command History

Release
Modification

12.0(28)S

This command was introduced.

Cisco IOS XE Release 2.1

This command was introduced on Cisco ASR 1000 Series Routers.


Usage Guidelines

For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria including access control lists (ACLs), protocols, input interfaces, QoS labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

The match access-group name command specifies an IPv6 named ACL only. The contents of the ACL are used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.

To use the match access-group name command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:

match access-group

match dscp

match mpls experimental

match precedence

match protocol

If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.

Examples

The following example specifies an access list named ipv6acl against whose contents packets will be checked to determine if they belong to the traffic class:

class-map ipv6_acl_class
match access-group name ipv6acl

Related Commands

Command
Description

match access-group

Configures the match criteria for a class map on the basis of the specified ACL.

match dscp

Identifies a specific IP DSCP value as a match criterion.

match mpls experimental

Configures a class map to use the specified value of the experimental (EXP) field as a match criterion.

match precedence

Identifies IP precedence values as match criteria.

match protocol

Configures the match criteria for a class map on the basis of the specified protocol.


match dscp

To identify one or more differentiated service code point (DSCP), Assured Forwarding (AF), and Certificate Server (CS) values as a match criterion, use the match dscp command in class-map configuration or policy inline configuration mode. To remove a specific DSCP value from a class map, use the no form of this command.

match [ip] dscp dscp-value [dscp-value dscp-value dscp-value dscp-value dscp-value dscp-value dscp-value]

no match [ip] dscp dscp-value

Syntax Description

ip

(Optional) Specifies that the match is for IPv4 packets only. If not used, the match is on both IPv4 and IPv6 packets.

Note For the Cisco 10000 series routers, the ip keyword is required.

dscp-value

The DSCP value used to identify a DSCP value. For valid values, see the "Usage Guidelines."


Command Default

No match criteria are configured.
If you do not enter the ip keyword, matching occurs on both IPv4 and IPv6 packets.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Release
Modification

12.2(13)T

This command was introduced. This command replaces the match ip dscp command.

12.0(28)S

This command was integrated into Cisco IOS Release 12.0(28)S for support in IPv6.

12.0(17)SL

This command was integrated into Cisco IOS Release 12.0(17)SL and implemented on the Cisco 10000 series routers.

12.2(31)SB

This command was integrated into Cisco IOS Release 12.2(31)SB.

Cisco IOS XE Release 2.1

This command was integrated into Cisco IOS XE Release 2.1 and introduced on Cisco ASR 1000 Series Routers.

15.1(3)T

This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor. Support was added for policy inline configuration mode.

12.2(58)SE

This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor.


Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policy type performance-monitor inline command.

DSCP Values

You must enter one or more differentiated service code point (DSCP) values. The command may include any combination of the following:

Numbers (0 to 63) representing differentiated services code point values

AF numbers (for example, af11) identifying specific AF DSCPs

CS numbers (for example, cs1) identifying specific CS DSCPs

default—Matches packets with the default DSCP.

ef—Matches packets with EF DSCP.

For example, if you wanted the DCSP values of 0, 1, 2, 3, 4, 5, 6, or 7 (note that only one of the IP DSCP values must be a successful match criterion, not all of the specified DSCP values), enter the match dscp 0 1 2 3 4 5 6 7 command.

This command is used by the class map to identify a specific DSCP value marking on a packet. In this context, dscp-value arguments are used as markings only and have no mathematical significance. For instance, the dscp-value of 2 is not greater than 1. The value simply indicates that a packet marked with the dscp-value of 2 is different than a packet marked with the dscp-value of 1. The treatment of these marked packets is defined by the user through the setting of Quality of Service (QoS) policies in policy-map class configuration mode.

Match Packets on DSCP Values

To match DSCP values for IPv6 packets only, the match protocol ipv6 command must also be used. Without that command, the DSCP match defaults to match both IPv4 and IPv6 packets.

To match DSCP values for IPv4 packets only, use the ip keyword. Without the ip keyword the match occurs on both IPv4 and IPv6 packets. Alternatively, the match protocol ip command may be used with match dscp to classify only IPv4 packets.

After the DSCP bit is set, other QoS features can then operate on the bit settings.

The network can give priority (or some type of expedited handling) to marked traffic. Typically, you set the precedence value at the edge of the network (or administrative domain); data is then queued according to the precedence. Weighted fair queueing (WFQ) can speed up handling for high-precedence traffic at congestion points. Weighted Random Early Detection (WRED) can ensure that high-precedence traffic has lower loss rates than other traffic during times of congestion.

Cisco 10000 Series Routers

The Cisco 10000 series routers support DSCP matching of IPv4 packets only. You must include the ip keyword when specifying the DSCP values to use as match criterion.

You cannot use the set ip dscp command with the set ip precedence command to mark the same packet. DSCP and precedence values are mutually exclusive. A packet can have one value or the other, but not both.

Examples

The following example shows how to set multiple match criteria. In this case, two IP DSCP value and one AF value.

Router(config)# class-map map1
Router(config-cmap)# match dscp 1 2 af11

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

The following example shows how to use the policy inline configuration mode to configure a service policy for Performance Monitor. The policy specifies that packets traversing Ethernet interface 0/0 that match the criteria specified by DSCP value 2 will be monitored based on the parameters specified in the flow monitor configuration named fm-2:

Router(config)# interface ethernet 0/0

Router(config-if)# service-policy type performance-monitor inline input
Router(config-if-spolicy-inline)# match dscp 2

Router(config-if-spolicy-inline)# flow monitor fm-2

Router(config-if-spolicy-inline)# exit

Related Commands

Command
Description

class-map

Creates a class map to be used for matching packets to a specified class.

service-policy type performance-monitor

Associates a Performance Monitor policy with an interface.

match protocol ip

Matches DSCP values for packets.

match protocol ipv6

Matches DSCP values for IPv6 packets.

policy-map

Creates or modifies a policy map that can be attached to one or more interfaces to specify a service policy.

service-policy

Attaches a policy map to an input interface or VC, or an output interface or VC, to be used as the service policy for that interface or VC.

set dscp

Marks the DSCP value for packets within a traffic class.

show class-map

Displays all class maps and their matching criteria.


match identity

To match an identity from a peer in an Internet Security Association and Key Management Protocol (ISAKMP) profile, use the match identity command in ISAKMP profile configuration mode. To remove the identity, use the no form of this command.

match identity {group group-name | address {address [mask] [fvrf] | ipv6 ipv6-address} | host host-name | host domain domain-name | user user-fqdn | user domain domain-name}

no match identity {group group-name | address {address [mask] [fvrf] | ipv6 ipv6-address} | host host-name | host domain domain-name | user user-fqdn | user domain domain-name}

Syntax Description

group group-name

A Unity group that matches identification (ID) type ID_KEY_ID. If Unity and main mode Rivest, Shamir, and Adelman (RSA) signatures are used, the group-name argument matches the Organizational Unit (OU) field of the Distinguished Name (DN).

address address [mask] [fvrf]

Identity that matches the identity of type ID_IPV4_ADDR.

mask—Use to match the range of the address.

fvrf—Use to match the address in the front door Virtual Route Forwarding (FVRF) Virtual Private Network (VPN) space.

ipv6 ipv6-address

Identity that matches the identity of type ID_IPV6_ADDR.

host host-name

Identity that matches an identity of the type ID_FQDN.

host domain domain-name

Identity that matches an identity of the type ID_FQDN, whose fully qualified domain name (FQDN) ends with the domain name.

user user-fqdn

Identity that matches the FQDN.

user domain domain-name

Identity that matches the identities of the type ID_USER_FQDN. When the user domain keyword is present, all users having identities of the type ID_USER_FQDN and ending with "domain-name" will be matched.


Command Default

No default behavior or values

Command Modes

ISAKMP profile configuration (conf-isa-prof)

Command History

Release
Modification

12.2(15)T

This command was introduced.

12.2(18)SXD

This command was integrated into Cisco IOS Release 12.2(18)SXD.

12.4(4)T

The ipv6 keyword and ipv6-address argument were added.

12.2(33)SRA

This command was integrated into Cisco IOS release 12.(33)SRA.

Cisco IOS XE Release 2.1

This command was introduced on Cisco ASR 1000 Series Routers.


Usage Guidelines

There must be at least one match identity command in an ISAKMP profile configuration. The peers are mapped to an ISAKMP profile when their identities are matched (as given in the ID payload of the Internet Key Exchange [IKE] exchange) against the identities that are defined in the ISAKMP profile. To uniquely map to an ISAKMP profile, no two ISAKMP profiles should match the same identity. If the peer identity is matched in two ISAKMP profiles, the configuration is invalid.

Examples

The following example shows that the match identity command is configured:

crypto isakmp profile vpnprofile
 match identity group vpngroup
 match identity address 10.53.11.1
 match identity host domain example.com
 match identity host server.example.com

Related Commands

Command
Description

crypto isakmp profile

Defines an ISAKMP profile and audits IPSec user sessions.


match ipv6

To configure one or more of the IPv6 fields as a key field for a Flexible NetFlow flow record, use the match ipv6 command in Flexible NetFlow flow record configuration mode. To disable the use of one or more of the IPv6 fields as a key field for a Flexible NetFlow flow record, use the no form of this command.

match ipv6 {dscp | flow-label | next-header | payload-length | precedence | protocol | traffic-class | version}

no match ipv6 {dscp | flow-label | next-header | payload-length | precedence | protocol | traffic-class | version}

Cisco Catalyst 6500 Switches in Cisco IOS Release 12.2(50)SY

match ipv6 {dscp | precedence | protocol | tos}

no match ipv6 {dscp | precedence | protocol | tos}

Syntax Description

dscp

Configures the IPv6 differentiated services code point DSCP (part of type of service (ToS)) as a key field.

flow-label

Configures the IPv6 flow label as a key field.

next-header

Configures the IPv6 next header as a key field.

payload-length

Configures the IPv6 payload length as a key field.

precedence

Configures the IPv6 precedence (part of ToS) as a key field.

protocol

Configures the IPv6 protocol as a key field.

tos

Configures the IPv6 ToS as a key field.

traffic-class

Configures the IPv6 traffic class as a key field.

version

Configures the IPv6 version from IPv6 header as a key field.


Command Default

The IPv6 fields are not configured as a key field.

Command Modes

Flexible NetFlow flow record configuration (config-flow-record)

Command History

Release
Modification

12.4(20)T

This command was introduced.

12.2(33)SRE

This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers.

12.2(50)SY

This command was modified. The flow-label, next-header, payload-length, traffic-class ,and version keywords were not supported in Cisco IOS Release 12.2(50)SY.


Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.


Note Some of the keywords of the match ipv6 command are documented as separate commands. All of the keywords for the match ipv6 command that are documented separately start with match ipv6. For example, for information about configuring the IPv6 hop limit as a key field for a Flexible NetFlow flow record, refer to the match ipv6 hop-limit command.

Examples

The following example configures the IPv6 DSCP field as a key field:

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 dscp

Related Commands

Command
Description

flow record

Creates a flow record.


match ipv6 access-list

To verify the sender's IPv6 address in inspected messages from the authorized prefix list, use the match ipv6 access-list command in router advertisement (RA) guard policy configuration mode.

match ipv6 access-list ipv6-access-list-name

Syntax Description

ipv6-access-list-name

Defines the IPv6 access list to be matched.


Command Default

Senders' IPv6 addresses are not verified.

Command Modes

RA guard policy configuration (config-ra-guard)

Command History

Release
Modification

12.2(50)SY

This command was introduced.


Usage Guidelines

The match ipv6 access-list command enables verification of the sender's IPv6 address in inspected messages from the configured authorized router source access list. If the match ipv6 access-list command is not configured, this authorization is bypassed.

An access list is configured using the ipv6 access-list command. For instance, to authorize the router with link-local address FE80::A8BB:CCFF:FE01:F700 only, define the following IPv6 access list:

Router(config)# ipv6 access-list list1
Router(config-ipv6-acl)# permit host FE80::A8BB:CCFF:FE01:F700 any

Examples

The following example defines an RA guard policy name as raguard1, places the router in RA guard policy configuration mode, and matches the IPv6 addresses in the access list named list1:

Router(config)# ipv6 nd raguard policy raguard1
Router(config-ra-guard)# match ipv6 access-list list1

Related Commands

Command
Description

ipv6 nd raguard policy

Defines the RA guard policy name and enter RA guard policy configuration mode.

ipv6 access-list

Defines an IPv6 access list and places the router in IPv6 access list configuration mode.


match ipv6 address

To distribute IPv6 routes that have a prefix permitted by a prefix list or to specify an IPv6 access list to use to match packets for policy-based routing (PBR) for IPv6, use the match ipv6 address command in route-map configuration mode. To remove the match ipv6 address entry, use the no form of this command.

match ipv6 address {prefix-list prefix-list-name | access-list-name}

no match ipv6 address

Syntax Description

prefix-list prefix-list-name

Specifies the name of an IPv6 prefix list.

access-list-name

Specifies the name of the IPv6 access list. Names cannot contain a space or quotation mark, or begin with a numeric.


Command Default

No routes are distributed based on destination network number.
No routes are distributed based on an access list.

Command Modes

Route-map configuration

Command History

Release
Modification

12.2(2)T

This command was introduced.

12.0(21)ST

This command was integrated into Cisco IOS Release 12.0(21)ST.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.3(7)T

The access-list-name argument was added.

12.2(30)S

This command was integrated into Cisco IOS Release 12.2(30)S.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SXI4

The prefix-list keyword and prefix-list-name argument are not supported in Cisco IOS Release 12.2(33)SXI4.

Cisco IOS XE Release 3.2S

This command was integrated into Cisco IOS XE Release 3.2S.


Usage Guidelines

Use the route-map command, and the match and set commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria enforced by the match commands are met.

The match ipv6 address command can be used to specify either an access list or a prefix list. When using PBR, you must use the access-list-name argument—the prefix-list keyword and prefix-list-name argument will not work.

Examples

In the following example, IPv6 routes that have addresses specified by the prefix list named marketing are matched:

Router(config)# route-map name
Router(config-route-map)# match ipv6 address prefix-list marketing
 
   

In the following example, IPv6 routes that have addresses specified by an access list named marketing are matched:

Router(config-route-map)# match ipv6 address marketing

Related Commands

Command
Description

match as-path

Matches a BGP autonomous system path access list.

match community

Matches a BGP community.

match ipv6 address

Specifies an IPv6 access list to use to match packets for PBR for IPv6.

match ipv6 next-hop

Distributes IPv6 routes that have a next hop prefix permitted by a prefix list.

match ipv6 route-source

Distributes IPv6 routes that have been advertised by routers at an address specified by a prefix list.

match length

Bases policy routing on the Level 3 length of a packet.

match metric

Redistributes routes with the metric specified.

match route-type

Redistributes routes of the specified type.

route-map

Defines the conditions for redistributing routes from one routing protocol into another.

set as-path

Modifies an autonomous system path for BGP routes.

set community

Sets the BGP community attribute.

set default interface

Indicates where to output packets that pass a match clause of a route map for policy routing and have no explicit route to the destination.

set interface

Indicates where to output packets that pass a match clause of a route map for policy routing.

set ipv6 default next-hop

Specifies an IPv6 default next hop to which matching packets will be forwarded.

set ipv6 next-hop (PBR)

Indicates where to output IPv6 packets that pass a match clause of a route map for policy routing.

set ipv6 precedence

Sets the precedence value in the IPv6 packet header.

set level

Indicates where to import routes.

set local preference

Specifies a preference value for the autonomous system path.

set metric

Sets the metric value for a routing protocol.

set metric-type

Sets the metric type for the destination routing protocol.

set tag

Sets a tag value of the destination routing protocol.

set weight

Specifies the BGP weight for the routing table.


match ipv6 destination

To configure the IPv6 destination address as a key field for a Flexible NetFlow flow record, use the match ipv6 destination command in Flexible NetFlow flow record configuration mode. To disable the IPv6 destination address as a key field for a Flexible NetFlow flow record, use the no form of this command.

match ipv6 destination {address | {mask | prefix} [minimum-mask mask]}

no match ipv6 destination {address | {mask | prefix} [minimum-mask mask]}

Cisco Catalyst 6500 Switches in Cisco IOS Release 12.2(50)SY

match ipv6 destination address

no match ipv6 destination address

Syntax Description

address

Configures the IPv6 destination address as a key field.

mask

Configures the mask for the IPv6 destination address as a key field.

prefix

Configures the prefix for the IPv6 destination address as a key field.

minimum-mask mask

(Optional) Specifies the size, in bits, of the minimum mask. Range 1 to 128.


Command Default

The IPv6 destination address is not configured as a key field.

Command Modes

Flexible NetFlow flow record configuration (config-flow-record)

Command History

Release
Modification

12.4(20)T

This command was introduced.

12.2(33)SRE

This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers.

12.2(50)SY

This command was modified. The mask, prefix, and minimum-mask keywords were not supported in Cisco IOS Release 12.2(50)SY.


Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures a 16-bit IPv6 destination address prefix as a key field:

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 destination prefix minimum-mask 16
 
   

The following example specifies a 16-bit IPv6 destination address mask as a key field:

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 destination mask minimum-mask 16

Related Commands

Command
Description

flow record

Creates a flow record.


match ipv6 extension map

To configure the bitmap of the IPv6 extension header map as a key field for a Flexible NetFlow flow record, use the match ipv6 extension map command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv6 bitmap of the IPv6 extension header map as a key field for a Flexible NetFlow flow record, use the no form of this command.

match ipv6 extension map

no match ipv6 extension map

Syntax Description

This command has no arguments or keywords.

Command Default

The use of the bitmap of the IPv6 extension header map as a key field for a user-defined Flexible NetFlow flow record is not enabled by default.

Command Modes

Flexible NetFlow flow record configuration (config-flow-record)

Command History

Release
Modification

12.4(20)T

This command was introduced.

12.2(33)SRE

This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers.


Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Bitmap of the IPv6 Extension Header Map

The bitmap of IPv6 extension header map is made up of 32 bits.

    0     1     2     3     4     5     6     7
+-----+-----+-----+-----+-----+-----+-----+-----+
| Res | FRA1| RH  | FRA0| UNK | Res | HOP | DST |
+-----+-----+-----+-----+-----+-----+-----+-----+
    8     9    10    11    12    13    14    15
+-----+-----+-----+-----+-----+-----+-----+-----+
| PAY | AH  | ESP |         Reserved            |
+-----+-----+-----+-----+-----+-----+-----+-----+
   16    17    18    19    20    21    22    23
+-----+-----+-----+-----+-----+-----+-----+-----+
|                  Reserved                     |
+-----+-----+-----+-----+-----+-----+-----+-----+
   24    25    26    27    28    29    30    31
+-----+-----+-----+-----+-----+-----+-----+-----+
|                  Reserved                     |
+-----+-----+-----+-----+-----+-----+-----+-----+
0  Res  Reserved
1  FRA1 Fragmentation header - not first fragment
2  RH   Routing header
3  FRA0 Fragment header - first fragment
4  UNK  Unknown Layer 4 header
        (compressed, encrypted, not supported)
5  Res  Reserved
6  HOP  Hop-by-hop option header
7  DST  Destination option header
8  PAY Payload compression header
9  AH  Authentication Header
10 ESP Encrypted security payload
11 to 31 Reserved
 
   

For more information on IPv6 headers, refer to RFC 2460 Internet Protocol, Version 6 (IPv6) at the following URL: http://www.ietf.org/rfc/rfc2460.txt.

Examples

The following example configures the IPv6 bitmap of the IPv6 extension header map of the packets in the flow as a key field:

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 extension map

Related Commands

Command
Description

flow record

Creates a flow record.


match ipv6 fragmentation

To configure one or more of the IPv6 fragmentation fields as a key field for a Flexible NetFlow flow record, use the match ipv6 fragmentation command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv6 fragmentation field as a key field for a Flexible NetFlow flow record, use the no form of this command.

match IPv6 fragmentation {flags | id | offset}

no match IPv6 fragmentation {flags | id | offset}

Syntax Description

flags

Configures the IPv6 fragmentation flags as a key field.

id

Configures the IPv6 fragmentation ID as a key field.

offset

Configures the IPv6 fragmentation offset value as a key field.


Command Default

The IPv6 fragmentation field is not configured as a key field.

Command Modes

Flexible NetFlow flow record configuration (config-flow-record)

Command History

Release
Modification

12.4(20)T

This command was introduced.

12.2(33)SRE

This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers.


Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the IPv6 fragmentation flags a key field:

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 fragmentation flags 
 
   

The following example configures the IPv6 offset value a key field:

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 fragmentation offset

Related Commands

Command
Description

flow record

Creates a flow record.


match ipv6 hop-limit

To configure the IPv6 hop limit as a key field for a Flexible NetFlow flow record, use the match ipv6 hop-limit command in Flexible NetFlow flow record configuration mode. To disable the use of a section of an IPv6 packet as a key field for a Flexible NetFlow flow record, use the no form of this command.

match ipv6 hop-limit

no match ipv6 hop-limit

Syntax Description

This command has no arguments or keywords.

Command Default

The use of the IPv6 hop limit as a key field for a user-defined Flexible NetFlow flow record is not enabled by default.

Command Modes

Flexible NetFlow flow record configuration (config-flow-record)

Command History

Release
Modification

12.4(20)T

This command was introduced.

12.2(33)SRE

This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers.


Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the hop limit of the packets in the flow as a key field:

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 hop-limit
 
   

Related Commands

Command
Description

flow record

Creates a flow record.


match ipv6 length

To configure one or more of the IPv6 length fields as a key field for a Flexible NetFlow flow record, use the match ipv6 length command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv6 length field as a key field for a Flexible NetFlow flow record, use the no form of this command.

match ipv6 length {header | payload | total}

no match ipv6 length {header | payload | total}

Syntax Description

header

Configures the length in bytes of the IPv6 header, not including any extension headers as a key field.

payload

Configures the length in bytes of the IPv6 payload, including any extension header as a key field.

total

Configures the total length in bytes of the IPv6 header and payload as a key field.


Command Default

The IPv6 length field is not configured as a key field.

Command Modes

Flexible NetFlow flow record configuration (config-flow-record)

Command History

Release
Modification

12.4(20)T

This command was introduced.

12.2(33)SRE

This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers.


Usage Guidelines

A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Examples

The following example configures the length of the IPv6 header in bytes, not including any extension headers, as a key field:

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 length header
 
   

Related Commands

Command
Description

flow record

Creates a flow record.


match ipv6 next-hop

To distribute IPv6 routes that have a next hop prefix permitted by a prefix list, use the match ipv6 next-hop command in route-map configuration mode. To remove the match ipv6 next-hop entry, use the no form of this command.

match ipv6 next-hop prefix-list prefix-list-name

no match ipv6 next-hop

Syntax Description

prefix-list prefix-list-name

Name of an IPv6 prefix list.


Command Default

Routes are distributed freely, without being required to match a next hop address.

Command Modes

Route-map configuration

Command History

Release
Modification

12.2(2)T

This command was introduced.

12.0(21)ST

This command was integrated into Cisco IOS Release 12.0(21)ST.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.


Usage Guidelines

The match ipv6 next-hop command is similar to the match ip next-hop command, except that it is IPv6-specific.

Use the route-map command, and the match and set commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

When you are passing routes through a route map, a route map can have several parts. Any route that does not match at least one match command relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure a second route map section with an explicit match specified.


Note A permit route map containing only set commands and no match commands permits all routes.

Examples

The following example distributes routes that have a next hop IPv6 address passed by the prefix list named marketing:

Router(config)# route-map name
Router(config-route-map)# match ipv6 next-hop prefix-list marketing

Related Commands

Command
Description

match as-path

Matches a BGP autonomous system path access list.

match community

Matches a BGP community.

match ipv6 address

Distributes IPv6 routes that have a prefix permitted by a prefix list.

match ipv6 route-source

Distributes IPv6 routes that have been advertised by routers at an address specified by a prefix list.

match metric

Redistributes routes with the metric specified.

match route-type

Redistributes routes of the specified type.

route-map

Defines the conditions for redistributing routes from one routing protocol into another.

set as-path

Modifies an autonomous system path for BGP routes.

set community

Sets the BGP community attribute.

set level

Indicates where to import routes.

set local preference

Specifies a preference value for the autonomous system path.

set metric

Sets the metric value for a routing protocol.

set metric-type

Sets the metric type for the destination routing protocol.

set tag

Sets a tag value of the destination routing protocol.

set weight

Specifies the BGP weight for the routing table.


match ipv6 route-source

To distribute IPv6 routes that have been advertised by routers at an address specified by a prefix list, use the match ipv6 route-source command in route-map configuration mode. To remove the match ipv6 route-source entry, use the no form of this command.

match ipv6 route-source prefix-list prefix-list-name

no match ipv6 route-source

Syntax Description

prefix-list prefix-list-name

Name of an IPv6 prefix list.


Command Default

No filtering on route source.

Command Modes

Route-map configuration

Command History

Release
Modification

12.2(2)T

This command was introduced.

12.0(21)ST

This command was integrated into Cisco IOS Release 12.0(21)ST.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.


Usage Guidelines

The match ipv6 route-source command is similar to the match ip route-source command, except that it is IPv6-specific.

Use the route-map command, and the match and set commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

When you are passing routes through a route map, a route map can have several parts. Any route that does not match at least one match command relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure a second route map section with an explicit match specified.

There are situations in which the next hop for a route and the source networking device address are not the same.


Note A permit route map containing only set commands and no match commands permits all routes.

Examples

The following example distributes routes that have been advertised by networking devices at the addresses specified by the prefix list named marketing:

Router(config)# route-map name
Router(config-route-map)# match ipv6 route-source prefix-list marketing

Related Commands

Command
Description

match as-path

Matches a BGP autonomous system path access list.

match community

Matches a BGP community.

match ipv6 address

Distributes IPv6 routes that have a prefix permitted by a prefix list.

match ipv6 next-hop

Distributes IPv6 routes that have a next hop prefix permitted by a prefix list.

match metric

Redistributes routes with the metric specified.

match route-type

Redistributes routes of the specified type.

route-map

Defines the conditions for redistributing routes from one routing protocol into another.

set as-path

Modifies an autonomous system path for BGP routes.

set community

Sets the BGP community attribute.

set level

Indicates where to import routes.

set local preference

Specifies a preference value for the autonomous system path.

set metric

Sets the metric value for a routing protocol.

set metric-type

Sets the metric type for the destination routing protocol.

set tag

Sets a tag value of the destination routing protocol.

set weight

Specifies the BGP weight for the routing table.


match length

To base policy routing on the Level 3 length of a packet, use the match length command in route-map configuration mode. To remove the entry, use the no form of this command.

match length minimum-length maximum-length

no match length minimum-length maximum-length

Syntax Description

minimum-length

Minimum Level 3 length of the packet, inclusive, allowed for a match. Range is from 0 to 0x7FFFFFFF.

maximum-length

Maximum Level 3 length of the packet, inclusive, allowed for a match. Range is from 0 to 0x7FFFFFFF.


Command Default

No policy routing occurs on the length of a packet.

Command Modes

Route-map configuration

Command History

Release
Modification

10.0

This command was introduced.

12.3(7)T

This command was updated for use in configuring IPv6 policy-based routing (PBR).

12.2SX

This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.

Cisco IOS XE Release 3.2S

This command was modified. It was integrated into Cisco IOS XE Release 3.2S.


Usage Guidelines

In IPv4, use the ip policy route-map interface configuration command, the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for policy routing packets. The ip policy route-map command identifies a route map by name. Each route-map has a list of match and set commands associated with it. The match commands specify the match criteria—the conditions under which policy routing occurs. The set commands specify the set actions—the particular routing actions to perform if the criteria enforced by the match commands are met.

In PBR for IPv6, use the ipv6 policy route-map or ipv6 local policy route-map command to define conditions for policy routing packets.

In IPv4, the match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the packet to be routed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

In IPv4, you might want to base your policy routing on the length of packets so that your interactive traffic and bulk traffic are directed to different routers.

Examples

In the following example, packets 3 to 200 bytes long, inclusive, will be routed to FDDI interface 0:

interface serial 0
 ip policy route-map interactive
!
route-map interactive
 match length 3 200
 set interface fddi 0
 
   

In the following example for IPv6, packets 3 to 200 bytes long, inclusive, will be routed to FDDI interface 0:

interface Ethernet0/0
  ipv6 policy-route-map interactive
!
route-map interactive
 match length 3 200
 set interface fddi 0
 
   

Related Commands

Command
Description

ip local policy route-map

Identifies a route map to use for policy routing on an interface.

ipv6 local policy route-map

Configures PBR for IPv6 for originated packets.

ipv6 policy route-map

Configures IPv6 PBR on an interface.

match ip address

Distributes any routes that have a destination network number address that is permitted by a standard or extended access list, and performs policy routing on packets.

match ipv6 address

Specifies an IPv6 access list to use to match packets for PBR for IPv6.

match length

Bases policy routing on the Level 3 length of a packet.

route-map (IP)

Defines the conditions for redistributing routes from one routing protocol into another, or enables policy routing.

set default interface

Indicates where to output packets that pass a match clause of a route map for policy routing and have no explicit route to the destination.

set interface

Indicates where to output packets that pass a match clause of route map for policy routing.

set ip default next-hop

Indicates where to output packets that pass a match clause of a route map for policy routing and for which the Cisco IOS software has no explicit route to a destination.

set ipv6 default next-hop

Specifies an IPv6 default next hop to which matching packets will be forwarded.

set ip next-hop

Indicates where to output packets that pass a match clause of a route map for policy routing.

set ipv6 next-hop (PBR)

Indicates where to output IPv6 packets that pass a match clause of a route map for policy routing.

set ipv6 precedence

Sets the precedence value in the IPv6 packet header.


match mpls-label

To redistribute routes that include Multiprotocol Label Switching (MPLS) labels if the routes meet the conditions specified in the route map, use the match mpls-label command in route-map configuration mode. To disable this function, use the no form of this command.

match mpls-label

no match mpls-label

Syntax Description

This command has no arguments or keywords.

Command Default

Routes with MPLS labels are not redistributed.

Command Modes

Route-map configuration

Command History

Release
Modification

12.0(21)ST

This command was introduced.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S.

12.2(11)S

This command was integrated into Cisco IOS Release 12.2(11)S.

12.2(13)T

This command was integrated into Cisco IOS Release 12.2(13)T.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXI

This command was integrated into Cisco IOS Release 12.2(33)SXI.


Usage Guidelines

A route map that includes this command can be used in the following instances:

With the neighbor route-map in command to manage inbound route maps in BGP

With the redistribute bgp command to redistribute route maps in an IGP

Use the route-map global configuration command, and the match and set route map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

When you are passing routes through a route map, a route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure a second route map section with an explicit match specified.

Examples

The following example shows how to create a route map that redistributes routes if the following conditions are met:

The IP address of the route matches an IP address in access control list 2.

The route includes an MPLS label.

Router(config-router)# route-map incoming permit 10
Router(config-route-map)# match ip address 2
Router(config-route-map)# match mpls-label

Related Commands

Command
Description

match ip address

Distributes any routes that have a destination network number address that is permitted by a standard or extended access list.

route-map (IP)

Defines the conditions for redistributing routes from one routing protocol into another, or enables policy routing.

set mpls-label

Enables a route to be distributed with an MPLS label if the route matches the conditions specified in the route map.


match precedence

To identify IP precedence values to use as the match criterion, use the match precedence command in class-map configuration or policy inline configuration mode. To remove IP precedence values from a class map, use the no form of this command.

match [ip] precedence {precedence-criteria1 | precedence-criteria2 | precedence-criteria3 | precedence-criteria4}

no match [ip] precedence {precedence-criteria1 | precedence-criteria2 | precedence-criteria3 | precedence-criteria4}

Syntax Description

ip

(Optional) Specifies that the match is for IPv4 packets only. If not used, the match is on both IP and IPv6 packets.

Note For the Cisco 10000 series routers, the ip keyword is required.

precedence-criteria1

precedence-criteria2

precedence-criteria3

precedence-criteria4

Identifies the precedence value. You can enter up to four different values, separated by a space. See the "Usage Guidelines" for valid values.


Command Default

No match criterion is configured.
If you do not enter the ip keyword, matching occurs on both IPv4 and IPv6 packets.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Release
Modification

12.2(13)T

This command was introduced. This command replaces the match ip precedence command.

12.0(17)SL

This command was integrated into Cisco IOS Release 12.0(17)SL and implemented on the Cisco 10000 series routers.

12.0(28)S

This command was integrated into Cisco IOS Release 12.0(28)S for IPv6.

12.2(31)SB

This command was integrated into Cisco IOS Release 12.2(31)SB.

15.1(3)T

This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor. Support was added for policy inline configuration mode.

12.2(58)SE

This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor.


Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

You can enter up to four matching criteria, as number abbreviation (0 to 7) or criteria names (critical, flash, and so on), in a single match statement. For example, if you wanted the precedence values of 0, 1, 2, or 3 (note that only one of the precedence values must be a successful match criterion, not all of the specified precedence values), enter the match ip precedence 0 1 2 3 command. The precedence-criteria numbers are not mathematically significant; that is, the precedence-criteria of 2 is not greater than 1. The way that these different packets are treated depends upon quality of service (QoS) policies, set in the policy-map configuration mode.

You can configure a QoS policy to include IP precedence marking for packets entering the network. Devices within your network can then use the newly marked IP precedence values to determine how to treat the packets. For example, class-based weighted random early detection (WRED) uses IP precedence values to determine the probability that a packet is dropped. You can also mark voice packets with a particular precedence. You can then configure low-latency queueing (LLQ) to place all packets of that precedence into the priority queue.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policy type performance-monitor inline command.

Matching Precedence for IPv6 and IPv4 Packets on the Cisco 10000 and 7600 Series Routers

On the Cisco 7600 series and 10000 series routers, you set matching criteria based on precedence values for only IPv6 packets using the match protocol command with the ipv6 keyword. Without that keyword, the precedence match defaults to match both IPv4 and IPv6 packets. You set matching criteria based on precedence values for IPv4 packets only, use the ip keyword. Without the ip keyword the match occurs on both IPv4 and IPv6 packets.

Precedence Values and Names

The following table lists all criteria conditions by value, name, binary value, and recommended use. You may enter up to four criteria, each separated by a space. Only one of the precedence values must be a successful match criterion. Table 34 lists the IP precedence values.

Table 34 IP Precedence Values 

Precedence Value
Precedence Name
Binary Value
Recommended Use

0

routine

000

Default marking value

1

priority

001

Data applications

2

immediate

010

Data applications

3

flash

011

Call signaling

4

flash-override

100

Video conferencing and streaming video

5

critical

101

Voice

6

internet (control)

110

Network control traffic (such as routing, which is typically precedence 6)

7

network (control)

111


Do not use IP precedence 6 or 7 to mark packets, unless you are marking control packets.

Examples

IPv4-Specific Traffic Match

The following example shows how to configure the service policy named priority50 and attach service policy priority50 to an interface, matching for IPv4 traffic only. In a network where both IPv4 and IPv6 are running, you might find it necessary to distinguish between the protocols for matching and traffic segregation. In this example, the class map named ipprec5 will evaluate all IPv4 packets entering Fast Ethernet interface 1/0/0 for a precedence value of 5. If the incoming IPv4 packet has been marked with the precedence value of 5, the packet will be treated as priority traffic and will be allocated with bandwidth of 50 kbps.

Router(config)# class-map ipprec5
Router(config-cmap)# match ip precedence 5
Router(config)# exit
Router(config)# policy-map priority50
Router(config-pmap)# class ipprec5
Router(config-pmap-c)# priority 50
Router(config-pmap-c)# exit
Router(config-pmap)# exit
Router(config)# interface fa1/0/0
Router(config-if)# service-policy input priority50

IPv6-Specific Traffic Match

The following example shows the same service policy matching on precedence for IPv6 traffic only. Notice that the match protocol command with the ipv6 keyword precedes the match precedence command. The match protocol command is required to perform matches on IPv6 traffic alone.

Router(config)# class-map ipprec5
Router(config-cmap)# match protocol ipv6
Router(config-cmap)# match precedence 5
Router(config)# exit
Router(config)# policy-map priority50
Router(config-pmap)# class ipprec5
Router(config-pmap-c)# priority 50
Router(config-pmap-c)# exit
Router(config-pmap)# exit
Router(config)# interface fa1/0/0
Router(config-if)# service-policy input priority50

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

The following example shows how to use the policy inline configuration mode to configure a service policy for Performance Monitor. The policy specifies that packets traversing Ethernet interface 0/0 that match the criteria of a match precedence of 4 will be monitored based on the parameters specified in the flow monitor configuration named fm-2:

Router(config)# interface ethernet 0/0

Router(config-if)# service-policy type performance-monitor inline input
Router(config-if-spolicy-inline)# match precedence 4

Router(config-if-spolicy-inline)# flow monitor fm-2

Router(config-if-spolicy-inline)# exit

Related Commands

Command
Description

class-map

Creates a class map to be used for matching packets to a specified class.

service-policy type performance-monitor

Associates a Performance Monitor policy with an interface.

match protocol

Configures the match criteria for a class map on the basis of a specified protocol.

policy-map

Creates or modifies a policy map that can be attached to one or more interfaces to specify a service policy.

service-policy

Attaches a policy map to an input interface or VC, or an output interface or VC, to be used as the service policy for that interface or VC.

set ip precedence

Sets the precedence value in the IP header.

show class-map

Displays all class maps and their matching criteria, or a specified class map and its matching criteria.


match protocol

To configure the match criterion for a class map on the basis of a specified protocol, use the match protocol command in class-map configuration or policy inline configuration mode. To remove the protocol-based match criterion from the class map, use the no form of this command.

match protocol protocol-name

no match protocol protocol-name

Syntax Description

protocol-name

Name of the protocol (for example, bgp) used as a matching criterion. See the "Usage Guidelines" for a list of protocols supported by most routers.


Command Default

No match criterion is configured.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Release
Modification

12.0(5)T

This command was introduced.

12.0(5)XE

This command was integrated into Cisco IOS Release 12.0(5)XE.

12.0(7)S

This command was integrated into Cisco IOS Release 12.0(7)S.

12.1(1)E

This command was integrated into Cisco IOS Release 12.1(1)E.

12.1(13)E

This command was integrated into Cisco IOS Release 12.1(13)E and implemented on Catalyst 6000 family switches without FlexWAN modules.

12.2(8)T

This command was integrated into Cisco IOS Release 12.2(8)T.

12.2(13)T

This command was modified to remove apollo, vines, and xns from the list of protocols used as matching criteria. These protocols were removed because Apollo Domain, Banyan VINES, and Xerox Network Systems (XNS) were removed in this release. The IPv6 protocol was added to support matching on IPv6 packets.

12.0(28)S

This command was integrated into Cisco IOS Release 12.0(28)S for IPv6.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(17a)SX1

This command was integrated into Cisco IOS Release 12.2(17a)SX1.

12.2(18)SXE

This command was integrated into Cisco IOS Release 12.2(18)SXE and implemented on the Supervisor Engine 720.

12.4(6)T

This command was modified. The Napster protocol was removed because it is no longer supported.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(31)SB2

This command was integrated into Cisco IOS Release 12.2(31)SB2 and implemented on the Cisco 10000 series routers.

12.2(18)ZY

This command was integrated into Cisco IOS Release 12.2(18)ZY. This command was modified to enhance Network-Based Application Recognition (NBAR) functionality on the Catalyst 6500 series switch that is equipped with the Supervisor 32/programmable intelligent services accelerator (PISA) engine.

12.4(15)XZ

This command was integrated into Cisco IOS Release 12.4(15)XZ.

12.4(20)T

This command was integrated into Cisco IOS Release 12.4(20)T and implemented on the Cisco 1700, Cisco 1800, Cisco 2600, Cisco 2800, Cisco 3700, Cisco 3800, Cisco 7200, and Cisco 7300 series routers.

Cisco IOS XE Release 2.2

This command was integrated into Cisco IOS XE Release 2.2 and implemented on the Cisco ASR 1000 Series Routers.

Cisco IOS XE Release 3.1S

This command was modified. Support for more protocols was added.

15.1(3)T

This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor. Support was added for policy inline configuration mode.

12.2(58)SE

This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor.


Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policy type performance-monitor inline command.

Supported Platforms Other Than Cisco 7600 Routers and Cisco 10000 Series Routers

For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria protocols, access control lists (ACLs), input interfaces, quality of service (QoS) labels, and Experimental (EXP) field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

The match protocol command specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.

The match protocol ipx command matches packets in the output direction only.

To use the match protocol command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:

match access-group

match input-interface

match mpls experimental

If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.

To configure NBAR to match protocol types that are supported by NBAR traffic, use the match protocol (NBAR) command.

Cisco 7600 Series Routers

The match protocol command in QoS class-map configuration configures NBAR and sends all traffic on the port, both ingress and egress, to be processed in the software on the Multilayer Switch Feature Card 2 (MSFC2).

For CBWFQ, you define traffic classes based on match criteria like protocols, ACLs, input interfaces, QoS labels, and Multiprotocol Label Switching (MPLS) EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

The match protocol command specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.

If you want to use the match protocol command, you must first enter the class-map command to specify the name of the class to which you want to establish the match criteria.

If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.

This command can be used to match protocols that are known to the NBAR feature. For a list of protocols supported by NBAR, see the "Classification" part of the Cisco IOS Quality of Service Solutions Configuration Guide.

Cisco 10000 Series Routers

For CBWFQ, you define traffic classes based on match criteria including protocols, ACLs, input interfaces, QoS labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

The match protocol command specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.

The match protocol ipx command matches packets in the output direction only.

To use the match protocol command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.

If you are matching NBAR protocols, use the match protocol (NBAR) command.

Match Protocol Command Restrictions (Catalyst 6500 Series Switches Only)

Policy maps contain traffic classes. Traffic classes contain one or more match commands that can be used to match packets (and organize them into groups) on the basis of a protocol type or application. You can create as many traffic classes as needed.

Cisco IOS Release 12.2(18)ZY includes software intended for use on the Catalyst 6500 series switch that is equipped with a Supervisor 32/PISA engine. For this release and platform, note the following restrictions for using policy maps and match protocol commands:

A single traffic class can be configured to match a maximum of 8 protocols or applications.

Multiple traffic classes can be configured to match a cumulative maximum of 95 protocols or applications.

Supported Protocols

Table 35 lists the protocols supported by most routers. Some routers support a few additional protocols. For example, the Cisco 7600 router supports the AARP and DECnet protocols, while the Cisco 7200 router supports the directconnect and PPPOE protocols. For a complete list of supported protocols, see the online help for the match protocol command on the router that you are using.

Table 35 Supported Protocols 

Protocol Name
Description

802-11-iapp

IEEE 802.11 Wireless Local Area Networks Working Group Internet Access Point Protocol

ace-svr

ACE Server/Propagation

aol

America-Online Instant Messenger

appleqtc

Apple QuickTime

arp*

IP Address Resolution Protocol (ARP)

bgp

Border Gateway Protocol

biff

Biff mail notification

bootpc

Bootstrap Protocol Client

bootps

Bootstrap Protocol Server

bridge*

bridging

cddbp

CD Database Protocol

cdp*

Cisco Discovery Protocol

cifs

CIFS

cisco-fna

Cisco FNATIVE

cisco-net-mgmt

cisco-net-mgmt

cisco-svcs

Cisco license/perf/GDP/X.25/ident svcs

cisco-sys

Cisco SYSMAINT

cisco-tdp

cisco-tdp

cisco-tna

Cisco TNATIVE

citrix

Citrix Systems Metaframe

citriximaclient

Citrix IMA Client

clns*

ISO Connectionless Network Service

clns_es*

ISO CLNS End System

clns_is*

ISO CLNS Intermediate System

clp

Cisco Line Protocol

cmns*

ISO Connection-Mode Network Service

cmp

Cluster Membership Protocol

compressedtcp*

Compressed TCP

creativepartnr

Creative Partner

creativeserver

Creative Server

cuseeme

CU-SeeMe desktop video conference

daytime

Daytime (RFC 867)

dbase

dBASE Unix

dbcontrol_agent

Oracle Database Control Agent

ddns-v3

Dynamic DNS Version 3

dhcp

Dynamic Host Configuration

dhcp-failover

DHCP Failover

directconnect

Direct Connect

discard

Discard port

dns

Domain Name Server lookup

dnsix

DNSIX Security Attribute Token Map

echo

Echo port

edonkey

eDonkey

egp

Exterior Gateway Protocol

eigrp

Enhanced Interior Gateway Routing Protocol

entrust-svc-handler

Entrust KM/Admin Service Handler

entrust-svcs

Entrust sps/aaas/aams

exec

Remote Process Execution

exchange

Microsoft RPC for Exchange

fasttrack

FastTrack Traffic (KaZaA, Morpheus, Grokster, and so on)

fcip-port

FCIP

finger

Finger

ftp

File Transfer Protocol

ftps

FTP over TLS/SSL

gdoi

Group Domain of Interpretation

giop

Oracle GIOP/SSL

gnutella

Gnutella Version 2 Traffic (BearShare, Shareeza, Morpheus, and so on)

gopher

Gopher

gre

Generic Routing Encapsulation

gtpv0

GPRS Tunneling Protocol Version 0

gtpv1

GPRS Tunneling Protocol Version 1

h225ras

H225 RAS over Unicast

h323

H323 Protocol

h323callsigalt

H323 Call Signal Alternate

hp-alarm-mgr

HP Performance data alarm manager

hp-collector

HP Performance data collector

hp-managed-node

HP Performance data managed node

hsrp

Hot Standby Router Protocol

http

Hypertext Transfer Protocol

https

Secure Hypertext Transfer Protocol

ica

ica (Citrix)

icabrowser

icabrowser (Citrix)

icmp

Internet Control Message Protocol

ident

Authentication Service

igmpv3lite

IGMP over UDP for SSM

imap

Internet Message Access Protocol

imap3

Interactive Mail Access Protocol 3

imaps

IMAP over TLS/SSL

ip*

IP (version 4)

ipass

IPASS

ipinip

IP in IP (encapsulation)

ipsec

IP Security Protocol (ESP/AH)

ipsec-msft

Microsoft IPsec NAT-T

ipv6*

IP (version 6)

ipx

IPX

irc

Internet Relay Chat

irc-serv

IRC-SERV

ircs

IRC over TLS/SSL

ircu

IRCU

isakmp

ISAKMP

iscsi

iSCSI

iscsi-target

iSCSI port

kazaa2

Kazaa Version 2

kerberos

Kerberos

l2tp

Layer 2 Tunnel Protocol

ldap

Lightweight Directory Access Protocol

ldap-admin

LDAP admin server port

ldaps

LDAP over TLS/SSL

llc2*

llc2

login

Remote login

lotusmtap

Lotus Mail Tracking Agent Protocol

lotusnote

Lotus Notes

mgcp

Media Gateway Control Protocol

microsoft-ds

Microsoft-DS

msexch-routing

Microsoft Exchange Routing

msnmsgr

MSN Instant Messenger

msrpc

Microsoft Remote Procedure Call

msrpc-smb-netbios

MSRPC over TCP port 445

ms-cluster-net

MS Cluster Net

ms-dotnetster

Microsoft .NETster Port

ms-sna

Microsoft SNA Server/Base

ms-sql

Microsoft SQL

ms-sql-m

Microsoft SQL Monitor

mysql

MySQL

n2h2server

N2H2 Filter Service Port

ncp

NCP (Novell)

net8-cman

Oracle Net8 Cman/Admin

netbios

Network Basic Input/Output System

netbios-dgm

NETBIOS Datagram Service

netbios-ns

NETBIOS Name Service

netbios-ssn

NETBIOS Session Service

netshow

Microsoft Netshow

netstat

Variant of systat

nfs

Network File System

nntp

Network News Transfer Protocol

novadigm

Novadigm Enterprise Desktop Manager (EDM)

ntp

Network Time Protocol

oem-agent

OEM Agent (Oracle)

oracle

Oracle

oracle-em-vp

Oracle EM/VP

oraclenames

Oracle Names

orasrv

Oracle SQL*Net v1/v2

ospf

Open Shortest Path First

pad*

Packet assembler/disassembler (PAD) links

pcanywhere

Symantec pcANYWHERE

pcanywheredata

pcANYWHEREdata

pcanywherestat

pcANYWHEREstat

pop3

Post Office Protocol

pop3s

POP3 over TLS/SSL

pppoe

Point-to-Point Protocol over Ethernet

pptp

Point-to-Point Tunneling Protocol

printer

Print spooler/ldp

pwdgen

Password Generator Protocol

qmtp

Quick Mail Transfer Protocol

radius

RADIUS & Accounting

rcmd

Berkeley Software Distribution (BSD) r-commands (rsh, rlogin, rexec)

rdb-dbs-disp

Oracle RDB

realmedia

RealNetwork's Realmedia Protocol

realsecure

ISS Real Secure Console Service Port

rip

Routing Information Protocol

router

Local Routing Process

rsrb*

Remote Source-Route Bridging

rsvd

RSVD

rsvp

Resource Reservation Protocol

rsvp-encap

RSVP ENCAPSULATION-1/2

rsvp_tunnel

RSVP Tunnel

rtc-pm-port

Oracle RTC-PM port

rtelnet

Remote Telnet Service

rtp

Real-Time Protocol

rtsp

Real-Time Streaming Protocol

r-winsock

remote-winsock

secure-ftp

FTP over Transport Layer Security/Secure Sockets Layer (TLS/SSL)

secure-http

Secured HTTP

secure-imap

Internet Message Access Protocol over TLS/SSL

secure-irc

Internet Relay Chat over TLS/SSL

secure-ldap

Lightweight Directory Access Protocol over TLS/SSL

secure-nntp

Network News Transfer Protocol over TLS/SSL

secure-pop3

Post Office Protocol over TLS/SSL

secure-telnet

Telnet over TLS/SSL

send

SEND

shell

Remote command

sip

Session Initiation Protocol

sip-tls

Session Initiation Protocol-Transport Layer Security

skinny

Skinny Client Control Protocol

sms

SMS RCINFO/XFER/CHAT

smtp

Simple Mail Transfer Protocol

snapshot

Snapshot routing support

snmp

Simple Network Protocol

snmptrap

SNMP Trap

socks

Sockets network proxy protocol (SOCKS)

sqlnet

Structured Query Language (SQL)*NET for Oracle

sqlserv

SQL Services

sqlsrv

SQL Service

sqlserver

Microsoft SQL Server

ssh

Secure shell

sshell

SSLshell

ssp

State Sync Protocol

streamwork

Xing Technology StreamWorks player

stun

cisco Serial Tunnel

sunrpc

Sun remote-procedure call (RPC)

syslog

System Logging Utility

syslog-conn

Reliable Syslog Service

tacacs

Login Host Protocol (TACACS)

tacacs-ds

TACACS-Database Service

tarantella

Tarantella

tcp

Transport Control Protocol

telnet

Telnet

telnets

Telnet over TLS/SSL

tftp

Trivial File Transfer Protocol

time

Time

timed

Time server

tr-rsrb

cisco RSRB

tto

Oracle TTC/SSL

udp

User Datagram Protocol

uucp

UUCPD/UUCP-RLOGIN

vdolive

VDOLive streaming video

vofr*

Voice over Frame Relay

vqp

VLAN Query Protocol

webster

Network Dictionary

who

Who's service

wins

Microsoft WINS

x11

X Window System

xdmcp

XDM Control Protocol

xwindows*

X-Windows remote access

ymsgr

Yahoo! Instant Messenger


* This protocol is not supported on the Catalyst 6500 series switch that is equipped with a Supervisor 32/PISA engine.

Examples

The following example specifies a class map named ftp and configures the FTP protocol as a match criterion:

Router(config)# class-map ftp
Router(config-cmap)# match protocol ftp

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

The following example shows how to use the policy inline configuration mode to configure a service policy for Performance Monitor. The policy specifies that packets traversing Ethernet interface 0/0 for the IP protocol will be monitored based on the parameters specified in the flow monitor configuration named fm-2:

Router(config)# interface ethernet 0/0

Router(config-if)# service-policy type performance-monitor inline input
Router(config-if-spolicy-inline)# match protocol ip

Router(config-if-spolicy-inline)# flow monitor fm-2

Router(config-if-spolicy-inline)# exit

Related Commands

Command
Description

class-map

Creates a class map to be used for matching packets to a specified class.

service-policy type performance-monitor

Associates a Performance Monitor policy with an interface.

match access-group

Configures the match criteria for a class map based on the specified ACL.

match input-interface

Configures a class map to use the specified input interface as a match criterion.

match mpls experimental

Configures a class map to use the specified value of the experimental field as a match criterion.

match precedence

Identifies IP precedence values as match criteria.

match protocol (NBAR)

Configures NBAR to match traffic by a protocol type known to NBAR.

match qos-group

Configures a class map to use the specified EXP field value as a match criterion.


match protocol (zone)

To configure the match criterion for a class map on the basis of the specified protocol, use the match protocol command in class-map configuration mode. To remove the protocol-based match criterion from a class map, use the no form of this command.

match protocol protocol-name [parameter-map] [signature]

no match protocol protocol-name [parameter-map] [signature]

Syntax Description

protocol-name

Name of the protocol used as a matching criterion.

For a list of supported protocols, use the CLI help option (?) on your platform.

parameter-map

(Optional) Protocol-specific parameter map.

signature

(Optional) Enables signature-based classification for peer-to-peer (P2P) packets.

Note This option is available only for P2P traffic.


Command Default

No protocol-based match criterion for a class map is configured.

Command Modes

class-map configuration (config-cmap)

Command History

Release
Modification

12.4(6)T

This command was introduced for the zone-based policy firewall.

12.4(9)T

This command was modified. Support for the following protocols was added:

P2P protocols: bittorrent, directconnect, edonkey, fasttrack, gnutella, kazaa2, and winmx

Instant Messenger (IM) protocols: aol, msnmsgr, and ymsgr

Also, the signature keyword was added to be used only with P2P protocols.

12.4(11)T

This command was modified. Support for the H.225 Remote Access Services (RAS) protocol and the h225ras keyword was added.

12.4(20)T

This command was modified. Support for the I Seek You (ICQ) and Windows Messenger IM protocols and the following keywords was added: icq, winmsgr

Support for the H.323 protocol and the h323 keyword was added.

Support for the Session Initiation Protocol (SIP) protocol and the sip keyword was added.

Cisco IOS XE Release 2.4

This command was integrated into Cisco IOS XE Release 2.4.

15.0(1)M

This command was modified. The extended keyword was removed from the protocol name.

15.1(1)T

This command was modified. Support for the CU-SeeMe protocol and cuseeme keyword was removed.

15.0(1)S

This command was integrated into Cisco IOS Release 15.0(1)S. The following keywords were added: netbios-dgm, netbios-ns, and netbios-ssn.


Usage Guidelines

Use the match protocol command to specify the traffic based on a particular protocol. You can use this command in conjunction with the match access-group and match class-map commands to build sophisticated traffic classes.

The match protocol command is available under the class-map type inspect command.

If you enter the match protocol command under the class-map type inspect command, the Port to Application Mappings (PAM) are honored when the protocol field in the packet is matched against this command. All the port mappings configured in the PAM table appear under the class map.

When packets are matched to a protocol, a traffic rate is generated for these packets. In a zone-based firewall policy, only the first packet that creates a session matches the policy. Subsequent packets in this flow do not match the filters in the configured policy, but instead match the session directly. The statistics related to subsequent packets are shown as part of the inspect action.

In Cisco IOS Release 12.4(15)T only, if Simple Mail Transfer Protocol (SMTP) is currently configured for inspection in a class map and the inspection of Extended SMTP (ESMTP) needs to be configured, then the no match protocol smtp command must be entered before adding the match protocol smtp extended command. To revert to regular SMTP inspection, use the no match protocol smtp extended command and then enter the match protocol smtp command.

In Cisco IOS Release 12.4(15)T, if these commands are not configured in the proper order, then the following error displays:

%Cannot add this filter.Remove match protocol smtp filter and then add this filter

In Cisco IOS Release 15.0(1)M and later releases, the extended keyword was removed from the match protocol smtp command.

Examples

The following example shows how to specify a class map called c1 and configure the HTTP protocol as a match criterion:

class-map type inspect c1 
 match protocol http 
 
   

The following example shows how to specify different class maps for ICQ and Windows Messenger IM applications:

! Define the servers for ICQ. 
parameter-map type protocol-info icq-servers 
 server name *.icq.com snoop
 server name oam-d09a.blue.aol.com
 
   
! Define the servers for Windows Messenger.
parameter-map type protocol-info winmsgr-servers
 server name messenger.msn.com snoop
 
! Define servers for yahoo.
parameter-map type protocol-info yahoo-servers
 server name scs*.msg.yahoo.com snoop
 server name c*.msg.yahoo.com snoop
 
! Define class-map to match ICQ traffic.
class-map type inspect icq-traffic
 match protocol icq icq-servers
 
! Define class-map to match windows Messenger traffic. 
class-map type inspect winmsgr-traffic
 match protocol winmsgr winmsgr-servers
!
 
! Define class-map to match text-chat for windows messenger.
class-map type inspect winmsgr winmsgr-textchat
 match service text-chat
!
 
Define class-map to match default service
class-map type inspect winmsgr winmsgr-defaultservice
 match service any
!
 
   

The following example shows how to specify a class map called c1 and configure the netbios-dgm protocol as a match criterion:

class-map type inspect c1 
 match protocol netbios-dgm 

Related Commands

Command
Description

class-map type inspect

Creates a Layer 3 or Layer 4 inspect type class map.

match access-group

Configures the match criteria for a class map based on the specified ACL.


match ra prefix-list

To verify the advertised prefixes in inspected messages from the authorized prefix list, use the match ra prefix-list command in router advertisement (RA) guard policy configuration mode.

match ra prefix-list ipv6-prefix-list-name

Syntax Description

ipv6-prefix-list-name

Defines the IPv6 prefix list to be matched.


Command Default

Advertised prefixes are not verified.

Command Modes

RA guard policy configuration (config-ra-guard)

Command History

Release
Modification

12.2(50)SY

This command was introduced.


Usage Guidelines

The match ra prefix-list command enables verification of the advertised prefixes in inspected messages from the configured authorized prefix list. Use the ipv6 prefix-list command to configure an IPv6 prefix list. For instance, to authorize the 2001:100::/64 prefixes and deny the 2002:100::/64 prefixes, define the following IPv6 prefix list:

Router(config)# ipv6 prefix-list listname1 deny 2001:0DB8:101:/64
Router(config)# ipv6 prefix-list listname1 permit 2001:0DB8:100::/64

Examples

The following example defines an RA guard policy name as raguard1, places the router in RA guard policy configuration mode, and verifies the advertised prefixes in listname1:

Router(config)# ipv6 nd raguard policy raguard1
Router(config-ra-guard)# match ra prefix-list listname1

Related Commands

Command
Description

ipv6 nd raguard policy

Defines the RA guard policy name and enter RA guard policy configuration mode.

ipv6 prefix-list

Creates an entry in an IPv6 prefix list.


max-metric router-lsa

To configure a router that is running the Open Shortest Path First (OSPF) protocol to advertise a maximum metric so that other routers do not prefer the router as an intermediate hop in their shortest path first (SPF) calculations, use the max-metric router-lsa command in router address family topology or router configuration mode. To disable the advertisement of a maximum metric, use the no form of this command.

max-metric router-lsa [external-lsa [max-metric-value]] [include-stub] [inter-area-lsas [max-metric-value]] [on-startup {seconds | wait-for-bgp}] [prefix-lsa] [stub-prefix-lsa [max-metric-value]] [summary-lsa [max-metric-value]]

no max-metric router-lsa [external-lsa [max-metric-value]] [include-stub] [inter-area-lsas [max-metric-value]] [on-startup {seconds | wait-for-bgp}] [prefix-lsa] [stub-prefix-lsa [max-metric-value]] [summary-lsa [max-metric-value]]

Syntax Description

external-lsa

(Optional) Configures the router to override the external LSA metric with the maximum metric value.

max-metric-value

(Optional) Maximum metric value for LSAs. The configurable range is from 1 to 16777215. The default value is 16711680.

include-stub

(Optional) Configures the router to advertise the maximum metric for stub links in router LSAs.

inter-area-lsas

(Optional) Configures the router to override the inter-area LSA metric with the maximum metric value.

on-startup

(Optional) Configures the router to advertise a maximum metric at startup.

seconds

(Optional) Maximum metric value for the specified time interval. The configurable range is from 5 to 86400 seconds. There is no default timer value for this configuration option.

wait-for-bgp

(Optional) Configures the router to advertise a maximum metric until Border Gateway Protocol (BGP) routing tables have converged or the default timer has expired. The default timer is 600 seconds.

prefix-lsa

(Optional) Configures the router to advertise the maximum metric for prefix links in router LSAs.

stub-prefix-lsa

(Optional) Configures the router to set the maximum metric for stub links in prefix LSAs.

summary-lsa

(Optional) Configures the router to override the summary LSA metric with the maximum metric value.


Command Default

Router link-state advertisements (LSAs) are originated with normal link metrics.

Command Modes

Router address family topology configuration (config-router-af-topology)
Router configuration (config-router)
OSPFv3 router configuration mode (config-router)

Command History

Release
Modification

12.0(15)S

This command was introduced.

12.0(16)ST

This command was integrated into Cisco IOS Release 12.0(16)ST.

12.2(4)T

This command was integrated into Cisco IOS Release 12.2(4)T.

12.4(10)

The include-stub, summary-lsa, and external-lsa keywords and the max-metric-value argument were made available under router configuration mode.

12.4(11)T

The include-stub, summary-lsa, and external-lsa keywords and the max-metric-value argument were made available under router configuration mode.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(31)SB2

The include-stub, summary-lsa, and external-lsa keywords and the max-metric-value argument were made available under router configuration mode.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SRB

This command was made available in router address family topology configuration mode. The include-stub, summary-lsa, and external-lsa keywords and the max-metric-value argument were made available under router configuration mode.

15.1(3)S

This command was modified. Support for IPv6 and OSPF version 3 (OSPFv3) was added.

Cisco IOS XE Release 3.4S

This command was modified. Support for IPv6 and OSPF version 3 (OSPFv3) was added.


Usage Guidelines

Enabling the max-metric router-lsa command will cause a router to originate LSAs with a maximum metric (LSInfinity: 0xFFFF) through all nonstub links, which allows BGP routing tables to converge without attracting transit traffic (if there are not alternate lower cost paths around the router). The router will advertise accurate (normal) metrics after the configured or default timers expire or after BGP sends a notification that routing tables have converged.


Note Directly connected links in a stub network are not affected by the configuration of a maximum or infinite metric because the cost of a stub link is always set to the output interface cost.

The max-metric router-lsa command is useful in the following situations:

Reloading a router. After a router is reloaded, Interior Gateway Protocols (IGPs) converge very quickly, and other routers may try to forward traffic through the newly reloaded router. If the router is still building BGP routing tables, packets destined for other networks that the router has not learned through BGP may be dropped. In the case of an Internet backbone router, a large number of packets may be dropped.

Introducing a router into a network without routing traffic through it. You may want to connect a router to an OSPF network but not want real traffic flowing through the router if there are better alternate paths. If there are no alternate paths, this router would still accept transit traffic as before.

Gracefully removing a router from a network. This feature allows you to gracefully remove a router from the network by advertising a maximum metric through all links, which allows other routers to select alternate paths for transit traffic to follow before the router is shut down.


Note You should not save the running configuration of a router when it is configured for a graceful shutdown because the router will continue to advertise a maximum metric after it is reloaded.

Note In older OSPF implementations (RFC 1247 and earlier implementations), the router link costs in received LSAs with a metric of LSInfinity are not used during SPF calculations, which means that no transit traffic will be sent to the routers that originate these LSAs.

Examples

The following example configures a router that is running OSPF to advertise a maximum metric for 100 seconds:

Router(config)# router ospfv3 100
Router(config-router)# max-metric router-lsa on-startup 100
 
   

The following example configures a router to advertise a maximum metric until BGP routing tables converge or until the default timer expires (600 seconds):

Router(config)# router ospfv3 100
Router(config-router)# max-metric router-lsa on-startup wait-for-bgp
 
   

The following example configures a router that is running OSPF to advertise a maximum metric, which causes neighbor routers to select alternate paths for transit traffic before the router shuts down:

Router(config)# router ospfv3 100
Router(config-router)# max-metric router-lsa
Router(config-router)# end
 
   

The following example configures stub links to be advertised with the maximum-metric in routers LSAs.

Router(config)# router ospfv3 1
Router(config-router)# router-id 10.1.1.1
Router(config-router)# max-metric router-lsa include-stub
Router(config-router)# end
 
   

Entering the show ip ospf max-metric or show ospfv3 max-metric command with the include-stub keyword displays output that confirms that stub links are advertised with the maximum metric. The example provides output for the show ip ospf max-metric command:

Router# show ip ospf max-metric
 
   
Routing Process "ospf 1" with ID 10.1.1.1
 Start time: 00:00:03.524, Time elapsed: 01:02:28.292
 Originating router-LSAs with maximum metric
    Condition: always, State: active
    Advertise stub links with maximum metric in router-LSAs

Related Commands

Command
Description

show ip ospf

Displays general information about OSPF routing processes.

show ip ospf database

Displays lists of information related to the OSPF database for a specific router.


maximum routes

To limit the maximum number of routes in a Virtual Private Network (VPN) routing and forwarding (VRF) instance to prevent a provider edge (PE) router from importing too many routes, use the maximum routes command in VRF configuration mode or in VRF address family configuration mode. To remove the limit on the maximum number of routes allowed, use the no form of this command.

maximum routes limit {warning-only | warn-threshold [reinstall reinstall-threshold]}

no maximum routes

Syntax Description

limit

The maximum number of routes allowed in a VRF. The valid range is from 1 to 4294967295 routes.

All values within this range can be configured for IPv4. For IPv6, however, only values greater than the current number of IPv6 routes present in the Routing Information Base (RIB) for the specified VRF is allowed.

warn-threshold

The warning threshold value expressed as a percentage (from 1 to 100) of the limit value. When the number of routes reaches the specified percentage of the limit, a warning message is generated.

warning-only

Issues a system message logging (syslog) error message when the maximum number of routes allowed for a VRF exceeds the threshold. However, additional routes are still allowed.

reinstall reinstall-threshold

(Optional) Specifies reinstallation of a route previously rejected because the maximum route limit was exceeded.

The reinstall-threshold is expressed as a percentage (from 1 to 100) of the limit value, but it does not take effect until the limit has been reached.

When the number of routes reaches the specified percentage of the limit, a warning message is generated, but routes are still accepted. When the number of routes reaches the limit, the router rejects new routes and does not accept any more until the number of routes drops below the specified percentage of the reinstall-threshold.


Command Default

No limit is set on the maximum number of routes allowed.

Command Modes

VRF address family configuration (config-vrf-af)
VRF configuration (config-vrf)

Command History

Release
Modification

12.0(7)T

This command was introduced.

12.2(13)T

Support for Simple Network Management Protocol (SNMP) notifications was added.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA. The reinstall reinstall-threshold keyword and argument were added.

12.2(33)SRB

Support for IPv6 was added.

12.2(33)SRC

Support for this command was added for IPv6 address families under the vrf definition command.

12.2(33)SB

This command was integrated into Cisco IOS Release 12.2(33)SB.

12.2(33)SXI

This command was integrated into Cisco IOS Release 12.2(33)SXI.

Cisco IOS XE Release 3.1S

This command was integrated into Cisco IOS XE Release 3.1S.


Usage Guidelines

All values within the range for the limit argument can be configured for IPv4. For IPv6, however, only values greater than the current number of IPv6 routes present in the RIB for the specified VRF is allowed.

The maximum routes command can be configured in one of two ways:

Generate a warning message when the limit value is exceeded

Generate a warning message when the warn-threshold value is reached

To limit the number of routes allowed in the VRF, use the maximum routes limit command with the warn-threshold argument. The warn-threshold argument generates a warning and does not allow the addition of routes to the VRF when the maximum number set by the limit argument is reached. The software generates a warning message every time a route is added to a VRF when the VRF route count is above the warning threshold. The software also generates a route rejection notification when the maximum threshold is reached and every time a route is rejected after the limit is reached.

To set a number of routes at which you receive a notification, but which does not limit the number of routes that can be imported into the VRF, use the maximum routes limit command with the warn-only keyword.

To configure the router to generate SNMP notifications (traps or informs) for these values, use the snmp-server enable traps mpls vpn command in global configuration mode.

Examples

The following example shows how to set a limit threshold of VRF routes to 1000. When the number of routes for the VRF reaches 1000, the router issues a syslog error message, but continues to accept new VRF routes.

Router(config)# ip vrf vrf1 
Router(config-vrf)# rd 100:1 
Router(config-vrf)# route-target import 100:1 
Router(config-vrf)# maximum routes 1000 warning-only 
 
   

The following example shows how to set the maximum number of VRF routes allowed to 1000 and set the warning threshold at 80 percent of the maximum. When the number of routes for the VRF reaches 800, the router issues a warning message. When the number of routes for the VRF reaches 1000, the router issues a syslog error message and rejects any new routes.

Router(config)# ip vrf vrf2
Router(config-vrf)# rd 200:1
Router(config-vrf)# route-target import 200:1
Router(config-vrf)# maximum routes 1000 80
 
   

The following example shows how to use the reinstall keyword to control the maximum number of VRF routes allowed. In this example, the router issues a warning when the number of routes exceeds 800 (80% of 1000 routes), but it still accept routes. When the number of new routes reaches 1000 (the limit), the router rejects them and does not accept more until the number of routes drops below 900 (90% of 1000) installed routes.

Router(config)# ip vrf vrf2
Router(config-vrf)# rd 200:1
Router(config-vrf)# route-target import 200:1
Router(config-vrf)# maximum routes 1000 80 reinstall 90
 
   

The following example for an IPv6 address family defined under the vrf definition command shows how to set the maximum number of VRF routes allowed to 500 and set the warning threshold at 50 percent of the maximum. When the number of routes for the VRF reaches 250, the router issues a warning message. When the number of routes for the VRF reaches 500, the router issues a syslog error message and rejects any new routes.

Router(config)# vrf definition vrf1
Router(config-vrf)# address-family ipv6
Router(config-vrf-af)# maximum routes 500 50 

Related Commands

Command
Description

address-family (VRF)

Selects an address family type for a VRF table and enters VRF address family configuration mode.

import map

Configures an import route map for a specified VRF for more control over routes imported into the VRF.

ip vrf

Specifies a name for a VRF routing table and enters VRF configuration mode (for IPv4 only).

rd

Creates VRF routing and forwarding tables and specifies the default route distinguisher for a VPN.

route-target

Configures a VRF route target community for importing and exporting extended community attributes.

snmp-server enable traps mpls vpn

Enables the router to send MPLS VPN-specific SNMP notifications (traps and informs).

vrf definition

Configures a VRF routing table instance and enters VRF configuration mode.


maximum-paths (IPv6)

To control the maximum number of equal-cost routes that a process for IPv6 Border Gateway Protocol (BGP), a process for IPv6 Intermediate System-to-Intermediate System (IS-IS), a process for IPv6 Routing Information Protocol (RIP), a process for Open Shortest Path First (OSPF) for IPv6, or a process for Enhanced Interior Gateway Routing Protocol (EIGRP) for IPv6 routing can support, use the maximum-paths command in address family configuration or router configuration mode. To restore the default value, use the no form of this command.

maximum-paths number-paths

no maximum-paths

Syntax Description

number-paths

Maximum number of equal-cost paths to a destination learned via IPv6 BGP, IS-IS, RIP, OSPF, or EIGRP installed in the IPv6 routing table, in the range from 1 to 64.


Command Default

The default for BGP is 1 path, the default for IS-IS and RIP is 4 paths, and the default for OSPF for IPv6 is 16 paths.

Command Modes

Address family configuration
Router configuration

Command History

Release
Modification

12.2(8)T

This command was introduced.

12.0(21)ST

This command was integrated into Cisco IOS Release 12.0(21)ST.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S and support for IPv6 RIP was added.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(15)T

Support for IPv6 OSPF was added.

12.4(6)T

Support for EIGRP for IPv6 was added.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.


Usage Guidelines

To configure the maximum-paths command for IPv6 BGP and IS-IS, enter address family configuration mode.

Examples

The following example shows a maximum of three paths to an external destination for the IPv6 BGP autonomous system 65000, and a maximum of two paths to an IPv6 internal BGP destination being configured:

Router(config)# router bgp 65000
Router(config-router)# address-family ipv6
Router(config-router-af)# maximum-paths 3
Router(config-router-af)# maximum-paths ibgp 2
 
   

The following example shows a maximum of two paths to a destination for the IPv6 IS-IS routing process named area01 being configured:

Router(config)# router isis area01
Router(config-router)# address-family ipv6
Router(config-router-af)# maximum-paths 2
 
   

The following example shows a maximum of one path to a destination for the IPv6 RIP routing process named one being configured:

Router(config)# ipv6 router rip one
Router(config-router-rip)# maximum-paths 1
 
   

The following example shows a maximum of four paths to a destination for an IPv6 OSPF routing process:

Router(config) ipv6 router ospf 1
Router(config-router)# maximum-paths 4
 
   

The following example shows a maximum of two paths to a destination for an EIGRP for IPv6 routing process:

Router(config) ipv6 router eigrp 1 
Router(config-router)# maximum-paths 2 

Related Commands

Command
Description

address-family ipv6

Enters address family configuration mode for configuring routing sessions such as BGP that use standard IPv6 address prefixes.

ipv6 router eigrp

Configures the EIGRP routing process in IPv6.

ipv6 router ospf

Enables OSPF for IPv6 router configuration mode.

ipv6 router rip

Configures an IPv6 RIP routing process.

router bgp

Configures the BGP routing process.

router isis

Enables the IS-IS routing protocol and specifies an IS-IS process.


maximum-paths (OSPFv3)

To control the maximum number of equal-cost routes that a process for Open Shortest Path First version 3 (OSPFv3) routing can support, use the maximum-paths command in IPv6 or IPv4 address family configuration mode. To restore the default value, use the no form of this command.

maximum-paths number-paths

no maximum-paths

Syntax Description

number-paths

Maximum number of equal-cost paths to a destination learned through OSPFv3. The range is from 1 through 64.


Command Default

16 equal-cost paths

Command Modes

IPv6 address family configuration (config-router-af)
IPv4 address family configuration (config-router-af)

Command History

Release
Modification

15.1(3)S

This command was introduced.

Cisco IOS XE Release 3.4S

This command was integrated into Cisco IOS XE Release 3.4S.

15.2(1)T

This command was integrated into Cisco IOS Release 15.2(1)T.


Usage Guidelines

.

Examples

The following example shows how to configure a maximum of four paths to a destination for an OSPFv3 routing process:

Router(config-router)# address-family ipv6 unicast
Router(config-router-af)# maximum-paths 4

maximum-paths ibgp

To control the maximum number of parallel internal Border Gateway Protocol (iBGP) routes that can be installed in a routing table, use the maximum-paths ibgp command in router or address family configuration mode. To restore the default value, use the no form of this command.

Router Configuration Mode

maximum-paths ibgp number-of-paths

no maximum-paths ibgp number-of-paths

Under VRF in Address Family Configuration Mode

maximum-paths ibgp {number-of-paths [import number-of-import-paths] | unequal-cost number-of-import-paths}

no maximum-paths ibgp {number-of-paths [import number-of-import-paths] | unequal-cost number-of-import-paths}

Syntax Description

number-of-paths

Number of routes to install to the routing table. See the "Usage Guidelines" section for the number of paths that can be configured with this argument.

import number-of-import-paths

(Optional) Specifies the number of redundant paths that can be configured as backup multipaths for a virtual routing and forwarding (VRF) instance. This keyword can be configured only under a VRF in address family configuration mode.

Note We recommend that this keyword is enabled only where needed and that the number of import paths be kept to the minimum (typically, not more than two paths). For more information, see the related note in the "Usage Guidelines" section of this command page.

unequal-cost number-of-import-paths

Specifies the number of unequal-cost routes to install in the routing table. See the "Usage Guidelines" section for the number of paths that can be configured. This keyword can be configured only under a VRF instance in address family configuration mode.


Command Default

BGP, by default, will install only one best path in the routing table.

Command Modes

Address family configuration (config-router-af)
Router configuration (config-router)

Command History

Release
Modification

12.2(2)T

This command was introduced.

12.0(25)S

The import keyword was added.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(14)SX

This command was integrated into Cisco IOS Release 12.2(14)SX.

12.3

The import keyword was added.

12.3(2)T

The maximum number of parallel routes was increased from 6 to 16.

12.2(25)S

This command was integrated into Cisco IOS Release 12.2(25)S for use in IPv6.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

15.0(1)M

This command was modified. The import keyword was replaced by the import path selection and import path limit commands.

12.2(33)SRE

This command was modified. The import keyword was replaced by the import path selection and import path limit commands.

Cisco IOS XE 2.6

This command was integrated into Cisco IOS XE Release 2.6.


Usage Guidelines

The maximum-paths ibgp command is used to configure equal-cost or unequal-cost multipath load sharing for iBGP peering sessions. In order for a route to be installed as a multipath in the BGP routing table, the route cannot have a next hop that is the same as another route that is already installed. The BGP routing process will still advertise a best path to iBGP peers when iBGP multipath load sharing is configured. For equal-cost routes, the path from the neighbor with the lowest router ID is advertised as the best path.

To configure BGP equal-cost multipath load sharing, all path attributes must be the same. The path attributes include weight, local preference, autonomous system path (entire attribute and not just the length), origin code, Multi Exit Discriminator (MED), and Interior Gateway Protocol (IGP) distance.

The number of paths that can be configured is determined by the version of Cisco IOS software as shown in the following list:

Cisco IOS Release 12.0S-based software: 8 paths

Cisco IOS Release 12.3T, 12.4, 12.4T, and 15.0-based software: 16 paths

Cisco IOS Release 12.2S-based software: 32 paths


Note In IPv6, the maximum-paths ibgp command does not work for prefixes learned from iBGP neighbors that have been configured to distribute a Multiprotocol Label Switching (MPLS) label with its IPv6 prefix advertisements. If multiple routes exist for such prefixes, all of them are inserted into the Routing Information Base (RIB) when the maximum-paths ibgp command is configured, but only one is used and no load balancing occurs between equal-cost paths. The maximum-paths ibgp command works with 6PE only in Cisco IOS Release 12.2(25)S and subsequent 12.2S releases.

Configuring VRF Import Paths

A VRF will import only one path (the best path) per prefix from the source VRF table, unless the prefix is exported with a different route target. If the best path goes down, the destination will not be reachable until the next import event occurs, and then a new best path will be imported into the VRF table. The import event runs every 15 seconds by default.

The import keyword allows the network operator to configure the VRF table to accept multiple redundant paths in addition to the best path. An import path is a redundant path, and it can have a next hop that matches an installed multipath. This keyword should be used when multiple paths with identical next hops are available to ensure optimal convergence times. A typical application of this keyword is to configure redundant paths in a network that has multiple route reflectors for redundancy.

The maximum number of import paths that can be configured in Cisco IOS Release 12.2SY-based software is 16.


Note Configuring redundant paths with the import keyword can increase CPU and memory utilization significantly, especially in a network where there are many prefixes to learn and a large number of configured VRFs. It is recommended that this keyword be configured only as necessary and that the minimum number of redundant paths be configured (typically, not more than two).

In Cisco IOS Releases 15.0(1)M and 12.2(33)SRE, and in later releases, the import keyword was replaced by the import path selection and import path limit commands. If the import keyword is configured, the configuration is converted to the new commands, as show in the following example:

Router(config-router-af)# maximum-paths ibgp import 3 
%NOTE: Import option has been deprecated.
%      Converting to 'import path selection all; import path limit 3'.

Examples

The following example configuration installs three parallel iBGP paths in a non-MPLS topology:

Router(config)# router bgp 100 
Router(config-router)# maximum-paths ibgp 3 
 
   

The following example configuration installs three parallel iBGP paths in an MPLS Virtual Private Network (VPN) topology:

Router(config)# router bgp 100 
Router(config-router)# address-family ipv4 unicast vrf vrf-A 
Router(config-route-af)# maximum-paths ibgp 3 
 
   

The following example configuration installs two parallel routes in the VRF table:

Router(config)# router bgp 100 
Router(config-router)# address-family ipv4 vrf vrf-B 
Router(config-router-af)# maximum-paths ibgp 2 import 2 
Router(config-router-af)# end 
 
   

The following example configuration installs two parallel routes in the VRF table:

Router(config)# router bgp 100 
Router(config-router)# address-family ipv4 vrf vrf-C 
Router(config-router-af)# maximum-paths ibgp import 2 
Router(config-router-af)# end 

Related Commands

Command
Description

import path limit

Specifies the maximum number of BGP paths, per VRF importing net, that can be imported from an exporting net.

import path selection

Specifies the BGP import path selection policy for a specific VRF instance.

maximum-paths

Controls the maximum number of parallel routes an IP routing protocol can support.

maximum-paths ibgp

Configures the number of equal-cost or unequal-cost routes that BGP will install in the routing table.

show ip bgp

Displays entries in the BGP routing table.

show ip bgp vpnv4

Displays VPNv4 address information from the BGP table entries in the BGP routing table.


maximum sessions (DSP farm profile)

To specify the maximum number of sessions that are supported by the profile, use the maximum sessions command in DSP farm profile configuration mode. To reset to the default, use the no form of this command.

Command Syntax When Conferencing or Transcoding Is Configured

maximum sessions number

no maximum sessions

Command Syntax When MTP Is Configured

maximum sessions {hardware | software} number

no maximum sessions

Syntax Description

number

Number of session supported by the profile. Range is 0 to x. Default is 0. The x value is determined at run time depending on the number of resources available with the resource provider.

hardware

Number of sessions that media termination points (MTP) hardware resources will support.

software

Number of sessions that MTP software resources will support.


Command Default

The maximum number of supported sessions is 0.

Command Modes

DSP farm profile configuration

Command History

Release
Modification

12.3(8)T

This command was introduced.

12.4(22)T

Support for IPv6 was added.


Usage Guidelines

When using the MTP service type, you must specify the number of sessions separately for software MTP and hardware MTP. The hardware MTP needs digital signal processor (DSP) resources. Use hardware MTP when the codecs are the same and the packetization period is different.

Active profiles must be shut down before any parameters can be changed.


Note The syntax of the command will vary based on the type of profile that you are configuring. The keywords work only when MTP is configured.

Examples

The following example shows that four sessions are supported by the DSP farm profile:

Router(config-dspfarm-profile)# maximum sessions 

Related Commands

Command
Description

associate application

Associates the SCCP protocol to the DSP farm profile.

codec (dspfarm-profile)

Specifies the codecs supported by a DSP farm profile.

description (dspfarm-profile)

Includes a specific description about the DSP farm profile.

dspfarm profile

Enters DSP farm profile configuration mode and defines a profile for DSP farm services.

shutdown (dspfarm-profile)

Allocates DSP farm resources and associates with the application.

voice-card

Enters voice-card configuration mode.


metric weights (EIGRP)

To tune Enhanced Interior Gateway Routing Protocol (EIGRP) metric calculations, use the metric weights command in router configuration mode or address family configuration mode. To reset the values to their defaults, use the no form of this command.

metric weights tos k1 k2 k3 k4 k5

no metric weights

Syntax Description

tos

Type of service. This value must always be zero.

k1 k2 k3 k4 k5

Constants that convert an EIGRP metric vector into a scalar quantity. Valid values are 0 to 255. Default values are:

tos: 0

k1: 1

k2: 0

k3: 1

k4: 0

k5: 0


Command Default

EIGRP metric K values are set to their default values.

Command Modes

Router configuration (config-router)
Address family configuration (config-router-af)

Command History

Release
Modification

10.0

This command was introduced.

12.4(6)T

Support for IPv6 was added.

12.2(33)SRB

This command was integrated into Cisco IOS Release 12.2(33)SRB.

Cisco IOS XE Release 2.1

This command was integrated into Cisco IOS XE Release 2.1.

12.2SX

This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.

15.0(1)M

This command was modified. The address-family configuration mode was added.

12.2(33)SRE

This command was modified. The address-family configuration mode was added.

12.2(33)XNE

This command was integrated into Cisco IOS Release 12.2(33)XNE.

Cisco IOS XE Release 2.5

This command was modified. The address-family configuration mode was added.


Usage Guidelines

Use this command to alter the default behavior of EIGRP routing and metric computation and allow the tuning of the EIGRP metric calculation for a particular type of service (ToS).

If k5 equals 0, the composite EIGRP metric is computed according to the following formula:

metric = [k1 * bandwidth + (k2 * bandwidth)/(256 - load) + k3 * delay]

If k5 does not equal zero, an additional operation is performed:

metric = metric * [k5/(reliability + k4)]

Bandwidth is inverse minimum bandwidth of the path in bps scaled by a factor of 2.56 * 1012. The range is from a 1200-bps line to 10 terabits per second.

Delay is in units of 10 microseconds. The range of delay is from 10 microseconds to 168 seconds. A delay of all ones indicates that the network is unreachable.

The delay parameter is stored in a 32-bit field, in increments of 39.1 nanoseconds. The range of delay is from 1 (39.1 nanoseconds) to hexadecimal FFFFFFFF (decimal 4,294,967,040 nanoseconds). A delay of all ones (that is, a delay of hexadecimal FFFFFFFF) indicates that the network is unreachable.

Table 36 lists the default values used for several common media.

Table 36 Bandwidth Values by Media Type 

Media Type
Delay
Bandwidth

Satellite

51,200,000 (2 seconds)

5120 (500 megabits)

Ethernet

25600 (1 millisecond [ms])

256,000 (10 megabits)

1.544 Mbps

51,200,000 (20 ms)

1,657,856 bits

64 kbps

51,200,000 (20 ms)

40,000,000 bits

56 kbps

51,200,000 (20 ms)

45,714,176 bits

10 kbps

51,20,000 (20 ms)

256,000,000 bits

1 kbps

51,200,000 (20 ms)

2,560,000,000 bits


Reliability is given as a fraction of 255. That is, 255 is 100 percent reliability or a perfectly stable link.

Load is given as a fraction of 255. A load of 255 indicates a completely saturated link.

Examples

The following example sets the metric weights to slightly different values than the defaults:

Router(config)# router eigrp 109
Router(config-router)# network 192.168.0.0
Router(config-router)# metric weights 0 2 0 2 0 0
 
   

The following example configures an address-family metric weight to tos: 0; K1: 2; K2: 0; K3: 2; K4: 0; K5: 0.

Router(config)# router eigrp virtual-name
Router(config-router)# address-family ipv4 autonomous-system 4533
Router(config-router-af)# metric weights 0 2 0 2 0 0

Related Commands

Command
Description

address-family (EIGRP)

Enters address-family configuration mode to configure an EIGRP routing instance.

bandwidth (interface)

Sets a bandwidth value for an interface.

delay (interface)

Sets a delay value for an interface.

ipv6 router eigrp

Configures the EIGRP for IPv6 routing process.

metric holddown

Keeps new EIGRP routing information from being used for a certain period of time.

metric maximum-hops

Causes the IP routing software advertise as unreachable routes with a hop count higher than is specified by the command (EIGRP only).

router eigrp

Configures the EIGRP address-family process.


mls cef maximum-routes

To limit the maximum number of the routes that can be programmed in the hardware allowed per protocol, use the mls cef maximum-routes command in global configuration mode. To return to the default settings, use the no form of this command.

mls cef maximum-routes {ip | ip-multicast | ipv6 | mpls} maximum-routes

no mls cef maximum-routes {ip | ip-multicast | ipv6 | mpls}

Syntax Description

ip

Specifies the maximum number of IP routes.

maximum-routes

Maximum number of the routes that can be programmed in the hardware allowed per protocol.

ip-multicast

Specifies the maximum number of multicast routes.

ipv6

Specifies the maximum number of IPv6 routes.

mpls

Specifies the maximum number of Multiprotocol Label Switching (MPLS) labels.


Command Default

The defaults are as follows:

For XL-mode systems:

IPv4 unicast and MPLS—512,000 routes

IPv6 unicast and IPv4 multicast—256,000 routes

For non-XL mode systems:

IPv4 unicast and MPLS—192,000 routes

IPv6 unicast and IPv4 multicast—32,000 routes


Note See the "Usage Guidelines" section for information on XL and non-XL mode systems.

Command Modes

Global configuration (config)

Command History

Release
Modification

12.2(17b)SXA

This command was introduced on the Supervisor Engine 720.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.


Usage Guidelines


Note If you copy a configuration file that contains the multilayer switching (MLS) Cisco Express Forwarding maximum routes into the startup-config file and reload the Cisco 7600 series router, the Cisco 7600 series router reloads after it reboots.

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

The mls cef maximum-routes command limits the maximum number of the routes that can be programmed in the hardware. If routes are detected that exceed the limit for that protocol, an exception condition is generated.

The determination of XL and non-XL mode is based on the type of Policy Feature Card (PFC) or Distributed Forwarding Card (DFC) modules that are installed in your system. For additional information on systems running Cisco IOS software release 12.2SXF and earlier releases see:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/release/notes/OL_4164.html#Policy_Feature_Card_Guidelines_and_Restrictions

For additional information on systems running Cisco IOS software release 12.2SXH and later releases see:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/ol_14271.html#Policy_Feature_Card_Guidelines_and_Restrictions

The valid values for the maximum-routes argument depend on the system mode—XL mode or non-XL mode. The valid values are as follows:

XL mode

IP and MPLS—Up to 1,007,000 routes

IP multicast and IPv6—Up to 503,000 routes

Non-XL mode

IP and MPLS—Up to 239,000 routes

IP multicast and IPv6—Up to 119,000 routes


Note The maximum values that you are permitted to configure is not fixed but varies depending on the values that are allocated for other protocols.

An example of how to enter the maximum routes argument is as follows:

mls cef maximum-routes ip 4
 
   

where 4 is 4096 IP routes (1024 x4 = 4096).

The new configurations are applied after a system reload only and do not take effect if a switchover occurs.

In RPR mode, if you change and save the maximum-routes configuration, the redundant supervisor engine reloads when it becomes active from either a switchover or a system reload. The reload occurs 5 minutes after the supervisor engine becomes active.

Use the show mls cef maximum-routes command to display the current maximum routes system configuration.

Examples

This example shows how to set the maximum number of routes that are allowed per protocol:

Router(config)# mls cef maximum-routes ip 100 
 
   

This example shows how to return to the default setting for a specific protocol:

Router(config)# no mls cef maximum-routes ip

Related Commands

Command
Description

show mls cef maximum-routes

Displays the current maximum-route system configuration.


mls erm priority

To assign the priorities to define an order in which protocols attempt to recover from the exception status, use the mls erm priority command in global configuration mode. To return to the default settings, use the no form of this command.


Note The mls erm priority command is not available in Cisco IOS Release 12.2(33)SXJ and later Cisco IOS 12.2SX releases.

mls erm priority ipv4 value ipv6 value mpls value

no mls erm priority ipv4 value ipv6 value mpls value

Syntax Description

ipv4

Prioritizes the IPv4 protocol. The default priority is 1.

value

Priority value; valid values are from 1 to 3.

ipv6

Prioritizes the IPv6 protocol. The default priority is 2.

mpls

Prioritizes the Multiprotocol Label Switching (MPLS) protocol. The default priority is 3.


Command Default

The default priority settings are used.

Command Modes

Global configuration (config)

Command History

Release
Modification

12.2(14)SX

This command was introduced on the Supervisor Engine 720.

12.2(17a)SX

This command was changed to support the ipv6 keyword.

12.2(17b)SXA

This command was changed to support the mpls keyword.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXJ

This command was removed. It is not available in Cisco IOS Release 12.2(33)SXJ and later Cisco IOS 12.2SX releases.


Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

A lower value indicates a higher priority.

When a protocol sees a Forwarding Information Base (FIB) table exception, the protocol notifies the FIB Embedded Resource Manager (ERM). The FIB ERM periodically polls the FIB table exception status and decides which protocol gets priority over another protocol when multiple protocols are running under the exception. Only one protocol can attempt to recover from an exception at any time.

If there is sufficient FIB space, the protocol with the highest priority tries to recover first. Other protocols under the exception do not start to recover until the previous protocol completes the recovery process by reloading the appropriate FIB table.

Examples

This example shows how to set the ERM exception-recovery priority:

Router(config)# mls erm priority ipv4 2 ipv6 1 mpls 3
 
   

This example shows how to return to the default setting:

Router(config)# no mls erm priority ipv4 2 ipv6 1 mpls 3

Related Commands

Command
Description

show mls cef exception

Displays information about the Cisco Express Forwarding exception.


mls ipv6 acl compress address unicast

To enable the compression of compressible IPv6 addresses, use the mls ipv6 acl compress address unicast command in global configuration mode. To disable the compression of compressible IPv6 addresses, use the no form of this command.

mls ipv6 acl compress address unicast

no mls ipv6 acl compress address unicast

Syntax Description

This command has no arguments or keywords.

Command Default

This command is disabled.

Command Modes

Global configuration

Command History

Release
Modification

12.2(17a)SX

This command was introduced on the Supervisor Engine 720.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.


Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.


Note Do not enable the compression mode if you have noncompressible address types in your network. Compressible address types and the address compression method are listed in Table 37.

Table 37 Compressible Address Types and Methods 

Address Type
Compression Method

EUI-64 based on MAC address

This address is compressed by removing 16 bits from bit locations [39:24]. No information is lost when the hardware compresses these addresses.

Embedded IPv4 address

This address is compressed by removing the upper 16 bits. No information is lost when the hardware compresses these addresses.

Link Local

These addresses are compressed by removing the zeros in bits [95:80] and are identified using the same packet type as the embedded IPv4 address. No information is lost when the hardware compresses these addresses.

Other

If the IPv6 address does not fall into any of the categories, it is classified as Other. If the IPv6 address is classified as Other, the following occurs:

If the compress mode is on, the IPv6 address is compressed similarly to the EUI-64 compression method (removal of bits [39:24]) to allow for the Layer 4 port information to be used as part of the key used to look up the quality of service (QoS) ternary content addressable memory (TCAM), but Layer 3 information is lost.

If the global compression mode is off, the entire 128 bits of the IPv6 address are used. The Layer 4 port information cannot be included in the key to look up the QoS TCAM because of the size constraints on the IPv6 lookup key.


Examples

This example shows how to turn on the compression of compressible IPv6 addresses:

Router(config)# mls ipv6 acl compress address unicast
 
   

This example shows how to turn off the compression of compressible IPv6 addresses:

Router(config)# no mls ipv6 acl compress address unicast

Related Commands

Command
Description

show fm ipv6 traffic-filter

Displays the IPv6 information.

show mls netflow ipv6

Displays configuration information about the NetFlow hardware.


mls ipv6 acl source

To deny all IPv6 packets from a source-specific address, use the mls ipv6 acl source command in global configuration mode. To accept all IPv6 packets from a source-specific address, use the no form of this command.

mls ipv6 acl source {loopback | multicast}

no mls ipv6 acl source {loopback | multicast}

Syntax Description

loopback

Denies all IPv6 packets with a source loopback address.

multicast

Denies all IPv6 packets with a source multicast address.


Command Default

This command is disabled.

Command Modes

Global configuration

Command History

Release
Modification

12.2(17b)SXA

This command was introduced on the Supervisor Engine 720.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.


Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

Examples

This example shows how to deny all IPv6 packets with a source loopback address:

Router(config)# mls ipv6 acl source loopback
 
   

This example shows how to deny all IPv6 packets with a source multicast address:

Router(config)# no mls ipv6 acl source multicast

Related Commands

Command
Description

show mls netflow ipv6

Displays configuration information about the NetFlow hardware.


mls ipv6 vrf

To enable IPv6 globally in a virtual routing and forwarding (VRF) instance, use the mls ipv6 vrf command in global configuration mode. To remove this functionality, use the no form of the command.

mls ipv6 vrf

no mls ipv6 vrf

Syntax Description

This command has no arguments or keywords.

Command Default

VRFs are supported only for IPv4 addresses.

Command Modes

Global configuration

Command History

Release
Modification

12.2(33)SRB1

This command was introduced on the Cisco 7600 series routers.

12.2(33)SB

This command was integrated into Cisco IOS Release 12.2(33)SB.

12.2(33)SXI

This command was integrated into Cisco IOS Release 12.2(33)SXI and implemented on the Catalyst 6500 series switches.

Cisco IOS XE Release 3.1S

This command was introduced on Cisco ASR 1000 series routers.


Usage Guidelines

You must enable the mls ipv6 vrf command in global configuration mode in order to enable IPv6 in a VRF. If this command is not used, a VRF is supported only for the IPv4 address family.

Configuring the mls ipv6 vrf command makes the router reserve the lower 255 hardware IDs for IPv6 regardless of whether IPv6 is enabled. Other applications that make use of these hardware IDs then cannot use that space.

To remove the mls ipv6 vrf command from the running configuration, the user needs to remove all IPv6 VRFs from the router and reload the system.

Examples

The following example shows how to enable IPv6 in a VRF globally:

Router(config)# mls ipv6 vrf

Related Commands

Command
Description

vrf definition

Configure a VRF routing table instance and enters VRF configuration mode.

show running-config vrf

Displays the subset of the running configuration of a router that is linked to a specific VRF instance or to all VRFs configured on the router.


mls rate-limit multicast ipv6

To configure the IPv6 multicast rate limiters, use the mls rate-limit multicast ipv6 command in global configuration mode. To disable the rate limiters, use the no form of this command.

mls rate-limit multicast ipv6 {connected pps [packets-in-burst] | rate-limiter-name {share {auto | target-rate-limiter}}

no mls rate-limit multicast ipv6 {connected | rate-limiter-name}

Syntax Description

connected pps

Enables and sets the rate limiters for the IPv6 multicast packets from a directly connected source; valid values are from 10 to 1000000 packets per second.

packets-in-burst

(Optional) Packets in burst; valid values are from 1 to 255.

rate-limiter-name

Rate-limiter name; valid values are default-drop, route-cntl, secondary-drop, sg, starg-bridge, and starg-m-bridge. See the "Usage Guidelines" section for additional information.

share

Specifies the sharing policy for IPv6 rate limiters; see the "Usage Guidelines" section for additional information.

auto

Decides the sharing policy automatically.

target-rate-limiter

Rate-limiter name that was the first rate-limiter name programmed in the hardware for the group; valid values are default-drop, route-cntl, secondary-drop, sg, starg-bridge, and starg-m-bridge. See the "Usage Guidelines" section for additional information.


Command Default

If the burst is not set, a default of 100 is programmed for multicast cases.

Command Modes

Global configuration

Command History

Release
Modification

12.2(18)SXD

This command was introduced on the Supervisor Engine 720.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.


Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

The rate-limiter-name argument must be a rate limiter that is not currently programmed.

The target-rate-limiter argument must be a rate limiter that is programmed in the hardware and must be the first rate limiter programmed for its group.

Table 38 lists the IPv6 rate limiters and the class of traffic that each rate limiter serves.

Table 38 IPv6 Rate Limiters

Rate-Limiter ID
Traffic Classes to be Rate Limited

Connected

Directly connected source traffic

Default-drop

* (*, G/m)SSM

* (*, G/m)SSM non-rpf

Route-control

* (*, FF02::X/128)

Secondary-drop

* (*, G/128) SPT threshold is infinity

SG

* (S, G) RP-RPF post-switchover

* (*, FFx2/16)

Starg-bridge

* (*, G/128) SM

* SM non-rpf traffic when (*, G) exists

Starg-M-bridge

* (*, G/m) SM

* (*, FF/8)

* SM non-rpf traffic when (*, G) does not exist


You can configure rate limiters for IPv6 multicast traffic using one of the following methods:

Direct association of the rate limiters for a traffic class—Select a rate and associate the rate with a rate limiter. This example shows how to pick a rate of 1000 pps and 20 packets per burst and associate the rate with the default-drop rate limiter:

Router(config)# mls rate-limit multicast ipv6 default-drop 1000 20
 
   

Static sharing of a rate limiter with another preconfigured rate limiter—When there are not enough adjacency-based rate limiters available, you can share a rate limiter with an already configured rate limiter (target rate limiter). This example shows how to share the route-cntl rate limiter with the default-drop target rate limiter:

Router(config)# mls rate-limit multicast ipv6 route-cntl share default-drop
 
   

If the target rate limiter is not configured, a message displays that the target rate limiter must be configured for it to be shared with other rate limiters.

Dynamic sharing of rate limiters—If you are not sure about which rate limiter to share with, use the share auto keywords to enable dynamic sharing. When you enable dynamic sharing, the system picks a preconfigured rate limiter and shares the given rate limiter with the preconfigured rate limiter. This example shows how to choose dynamic sharing for the route-cntrl rate limiter:

Router(config)# mls rate-limit multicast ipv6 route-cntl share auto

Examples

This example shows how to set the rate limiters for the IPv6 multicast packets from a directly connected source:

Router(config)# mls rate-limit multicast ipv6 connected 1500 20
Router(config)# 
 
   

This example shows how to configure a direct association of the rate limiters for a traffic class:

Router(config)# mls rate-limit multicast ipv6 default-drop 1000 20
Router(config)# 
 
   

This example shows how to configure the static sharing of a rate limiter with another preconfigured rate limiter:

Router(config)# mls rate-limit multicast ipv6 route-cntl share default-drop
Router(config)# 
 
   

This example shows how to enable dynamic sharing for the route-cntrl rate limiter:

Router(config)# mls rate-limit multicast ipv6 route-cntl share auto
Router(config)# 

Related Commands

Command
Description

show mls rate-limit

Displays information about the MLS rate limiter.


monitor event-trace cef ipv6 (global)

To configure event tracing for Cisco Express Forwarding IPv6 events, use the monitor event-trace cef ipv6 command in global configuration mode. To disable event tracing for Cisco Express Forwarding, use the no form of this command.

monitor event-trace cef ipv6 {disable | distribution | dump-file dump-file-name | enable | match {global | ipv6-address/n} | size number | stacktrace [depth] | vrf vrf-name [distribution | match {global | ipv6-address/n}]}

no monitor event-trace cef ipv6 {disable | distribution | dump-file dump-file-name | enable | match | size | stacktrace [depth] | vrf}

Syntax Description

disable

Turns off event tracing for Cisco Express Forwarding IPv6 events.

distribution

Logs events related to the distribution of Cisco Express Forwarding Forwarding Information Base (FIB) tables to the line cards.

dump-file dump-file-name

Specifies the file to which event trace messages are written from memory on the networking device. The maximum length of the filename (path and filename) is 100 characters, and the path can point to flash memory on the networking device or to a TFTP or FTP server.

enable

Turns on event tracing for Cisco Express Forwarding IPv6 events if it had been enabled with the monitor event-trace cef ipv6 command.

match

Turns on event tracing for Cisco Express Forwarding IPv6 that matches global events or events that match a specific network address.

global

Specifies global events.

ipv6-address/n

Specifies an IPv6 address. This address must be in the form documented in RFC 2373: the address is specified in hexadecimals using 16-bit values between colons. The slash followed by a number (/n) indicates the number of bits that do not change. Range: 0 to 128.

size number

Sets the number of messages that can be written to memory for a single instance of a trace. Range: 1 to 65536.

Note Some Cisco IOS software subsystem components set the size by default. To display the size parameter, use the show monitor event-trace cef parameters command.

When the number of event trace messages in memory exceeds the configured size, new messages will begin to overwrite the older messages in the file.

stacktrace

Enables the stack trace at tracepoints.

depth

(Optional) Specifies the depth of the stack trace stored. Range: 1 to 16.

vrf vrf-name

Turns on event tracing for a Cisco Express Forwarding IPv6 Virtual Private Network (VPN) routing and forwarding (VRF) table. The vrf-name argument specifies the name of the VRF.


Command Default

Event tracing for Cisco Express Forwarding IPv6 events is enabled by default.

Command Modes

Global configuration (config)

Command History

Release
Modification

12.2(25)S

This command was introduced.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB and implemented on the Cisco 10000 series routers.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Cisco IOS XE Release 2.1

This command was integrated into Cisco IOS XE Release 2.1 and implemented on the Cisco ASR 1000 Series Aggregation Services Routers.


Usage Guidelines

Use the monitor event-trace cef ipv6 command to enable or disable event tracing for Cisco Express Forwarding IPv6 events.

The Cisco IOS software allows Cisco Express Forwarding to define whether support for event tracing is enabled or disabled by default. The command interface for event tracing allows you to change the default value in one of two ways: using the monitor event-trace cef ipv6 command in privileged EXEC mode or using the monitor event-trace cef ipv6 command in global configuration mode.


Note The amount of data collected from the trace depends on the trace message size configured using the monitor event-trace cef ipv6 command for each instance of a trace.

To determine whether event tracing is enabled by default for Cisco Express Forwarding IPv6 events, use the show monitor event-trace cef ipv6 command to display trace messages.

To specify the trace call stack at tracepoints, you must first clear the trace buffer.

Examples

The following example shows how to enable event tracing for Cisco Express Forwarding IPv6 events and configure the buffer size to 10000 messages.

Router(config)# monitor event-trace cef ipv6 enable
 
   
Router(config)# monitor event-trace cef ipv6 size 10000

Related Commands

Command
Description

monitor event-trace cef (EXEC)

Monitors and controls the event trace function for Cisco Express Forwarding.

monitor event-trace cef (global)

Configures event tracing for Cisco Express Forwarding.

monitor event-trace cef ipv4 (global)

Configures event tracing for Cisco Express Forwarding IPv4 events.

show monitor event-trace cef

Displays event trace messages for Cisco Express Forwarding.

show monitor event-trace cef events

Displays event trace messages for Cisco Express Forwarding events.

show monitor event-trace cef interface

Displays event trace messages for Cisco Express Forwarding interface events.

show monitor event-trace cef ipv4

Displays event trace messages for Cisco Express Forwarding IPv4 events.

show monitor event-trace cef ipv6

Displays event trace messages for Cisco Express Forwarding IPv6 events.


monitor event-trace ipv6 spd

To monitor Selective Packet Discard (SPD) state transition events, use the monitor event-trace ipv6 spd command in privileged EXEC mode. To disable this function, use the no form of this command.

monitor event-trace ipv6 spd

no monitor event-trace ipv6 spd

Syntax Description

This command has no arguments or keywords.

Command Default

This command is disabled.

Command Modes

Privileged EXEC (#)

Command History

Release
Modification

15.1(3)T

This command was introduced.


Usage Guidelines

Use the monitor event-trace ipv6 spd command to check SPD state transition events.

mpls ipv6 source-interface


Note Effective with Cisco IOS Release 12.2(25)S, the mpls ipv6 source-interface command is not available in Cisco IOS 12.2S releases.
Effective with Cisco IOS Release 12.4(15)T, the mpls ipv6 source-interface command is not available in Cisco IOS 12.4T releases.

To specify an IPv6 address of an interface to be used as the source address for locally generated IPv6 packets to be sent over a Multiprotocol Label Switching (MPLS) network, use the mpls ipv6 source-interface command in global configuration mode. To disable this feature, use the no form of this command.

mpls ipv6 source-interface type number

no mpls ipv6 source-interface

Syntax Description

type number

The interface type and number whose IPv6 address is to be used as the source for locally generated IPv6 packets to be sent over an MPLS backbone.

Note A space between the type and number arguments is not required.


Command Default

This command is disabled.

Command Modes

Global configuration

Command History

Release
Modification

12.0(22)S

This command was introduced.

12.2(15)T

This command was integrated into Cisco IOS Release 12.2(15)T.

12.2(20)S

This command was integrated into Cisco IOS Release 12.2(20)S.

12.2(25)S

This command was removed from Cisco IOS Release 12.2(25)S.

12.4(15)T

This command was removed from Cisco IOS Release 12.4(15)T.


Usage Guidelines

Use the mpls ipv6 source-interface command with the neighbor send-label address family configuration command to allow IPv6 traffic to run over an IPv4 MPLS network without any software or hardware configuration changes in the backbone. Edge routers, configured to run both IPv4 and IPv6, forward IPv6 traffic using MPLS and multiprotocol internal BGP (MP-iBGP).

The mpls ipv6 source-interface command was removed from Cisco IOS software as per RFC 3484, which defines how the source address of a locally generated packet must be chosen. This command will be removed from the other Cisco IOS release trains in which it currently appears.

Examples

The following example shows loopback interface 0 being configured as a source address for locally generated IPv6 packets:

interface Loopback0
 ip address 192.168.99.5 255.255.255.255
 ipv6 address 2001:0DB8::1/32
!
mpls ipv6 source-interface loopback0

Related Commands

Command
Description

neighbor send-label

Advertises the capability of the router to send MPLS labels with BGP routes.


mpls ldp router-id

To specify a preferred interface for the Label Distribution Protocol (LDP) router ID, use the mpls ldp router-id command in global configuration mode. To disable the interface from being used as the LDP router ID, use the no form of this command.

mpls ldp router-id [vrf vrf-name] interface [force]

no mpls ldp router-id [vrf vrf-name] [interface [force]]

Cisco CMTS Routers

mpls ldp router-id gigabitethernet slot/subslot/port [force]

no mpls ldp router-id gigabitethernet slot/subslot/port [force]

Syntax Description

vrf vrf-name

(Optional) Selects the interface as the LDP router ID for the named Virtual Private Network (VPN) routing and forwarding (VRF) table. The selected interface must be associated with the named VRF.

interface

The specified interface to be used as the LDP router ID, provided that the interface is operational.

gigabitethernet slot/subslot/port

Specifies the location of the Gigabit Ethernet interface.

force

(Optional) Alters the behavior of the mpls ldp router-id command, as described in the "Usage Guidelines" section.


Command Default

If the mpls ldp router-id command is not executed, the router determines the LDP router ID as follows:

1. The router examines the IP addresses of all operational interfaces.

2. If these IP addresses include loopback interface addresses, the router selects the largest loopback address as the LDP router ID.

3. Otherwise, the router selects the largest IP address pertaining to an operational interface as the LDP router ID.

Command Modes

Global configuration

Command History

Release
Modification

12.0(10)ST

This command was introduced.

12.0(14)ST

The force keyword was added.

12.1(2)T

This command was integrated into Cisco IOS Release 12.1(2)T.

12.1(8a)E

This command was integrated into Cisco IOS Release 12.1(8a)E.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S.

12.4(5)

The vrf vrf-name keyword/argument pair was added.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SB

This command was integrated into Cisco IOS Release 12.2(33)SB.

12.2(33)SXI

This command was integrated into Cisco IOS Release 12.2(33)SXI.

12.2(33)SCC

This command was integrated into Cisco IOS Release 12.2(33)SCC.


Usage Guidelines

The mpls ldp router-id command allows you to use the IP address of an interface as the LDP router ID.

The following steps describe the normal process for determining the LDP router ID:

1. The router considers all the IP addresses of all operational interfaces.

2. If these addresses include loopback interface addresses, the router selects the largest loopback address. Configuring a loopback address helps ensure a stable LDP ID for the router, because the state of loopback addresses does not change. However, configuring a loopback interface and IP address on each router is not required.

The loopback IP address does not become the router ID of the local LDP ID under the following circumstances:

If the loopback interface has been explicitly shut down.

If the mpls ldp router-id command specifies that a different interface should be used as the LDP router ID.

If you use a loopback interface, make sure that the IP address for the loopback interface is configured with a /32 network mask. In addition, make sure that the routing protocol in use is configured to advertise the corresponding /32 network.

3. Otherwise, the router selects the largest interface address.

The router might select a router ID that is not usable in certain situations. For example, the router might select an IP address that the routing protocol cannot advertise to a neighboring router.

The router implements the router ID the next time it is necessary to select an LDP router ID. The effect of the command is delayed until the next time it is necessary to select an LDP router ID, which is typically the next time the interface is shut down or the address is deconfigured.

If you use the force keyword with the mpls ldp router-id command, the router ID takes effect more quickly. However, implementing the router ID depends on the current state of the specified interface:

If the interface is up (operational) and its IP address is not currently the LDP router ID, the LDP router ID is forcibly changed to the IP address of the interface. This forced change in the LDP router ID tears down any existing LDP sessions, releases label bindings learned via the LDP sessions, and interrupts MPLS forwarding activity associated with the bindings.

If the interface is down, the LDP router ID is forcibly changed to the IP address of the interface when the interface transitions to up. This forced change in the LDP router ID tears down any existing LDP sessions, releases label bindings learned via the LDP sessions, and interrupts MPLS forwarding activity associated with the bindings.

The following behaviors apply to the default VRF as well as to VRFs that you explicitly configure with the vrf vrf-name keyword/argument pair:

The interface you select as the router ID of the VRF must be associated with the VRF.

If the interface is no longer associated with the VRF, the mpls ldp router-id command that uses the interface is removed.

If the selected interface is deleted, the mpls ldp router-id command that uses the interface is removed.

If you delete a VRF that you configured, the mpls ldp router-id command for the deleted VRF is removed. The default VRF cannot be deleted.

Examples

The following example shows that the POS2/0/0 interface has been specified as the preferred interface for the LDP router ID. The IP address of that interface is used as the LDP router ID.

Router(config)# mpls ldp router-id pos2/0/0
 
   

The following example shows that the Ethernet 1/0 interface, which is associated with the VRF vpn-1, is the preferred interface. The IP address of the interface is used as the LDP router ID.

Router(config)# mpls ldp router-id vrf vpn-1 eth1/0

Related Commands

Command
Description

show mpls ldp discovery

Displays the status of the LDP discovery process.