Table Of Contents

Configuring CSS Network Protocols

Configuring Domain Name Service

Specifying a Primary DNS Server

Using DNS Resolve

Specifying a Secondary DNS Server

Specifying a DNS Suffix

Specifying UDP Traffic on the DNS Server Port

Configuring Address Resolution Protocol

Configuring ARP

Configuring ARP Timeout

Configuring ARP Wait

Updating ARP Parameters

Clearing ARP Parameters

Showing ARP Information

Configuring Routing Information Protocol

Configuring RIP Advertise

Configuring RIP Redistribute

Configuring RIP Equal-Cost

Showing RIP Configurations

Configuring Internet Protocol

Configuring IP Record-Route

Configuring IP Redundancy

Configuring IP ECMP

Configuring an IP Route

Configuring IP Source-Route

Disabling an Implicit Service for Static Route Next Hop

Configuring IP Subnet-Broadcast

Showing IP Information

Showing IP Config

Showing IP Interfaces

Showing IP Routes

Showing IP Statistics

Showing IP Summary

Configuring Cisco Discovery Protocol (CDP)

Enabling CDP

Setting the CDP Hold Time

Setting the CDP Transmission Rate

Showing CDP Information

Configuring Spanning-Tree Bridging for the CSS

Configuring Spanning-TreeBridge Aging-Time

Configuring Spanning-Tree Bridge Forward-Time

Configuring Spanning-Tree Bridge Hello-Time

Configuring Spanning-Tree Bridge Max-Age

Configuring Spanning-Tree Bridge Priority for the CSS

Enabling and Disabling Bridge Spanning-Tree

Showing Bridge Configurations

Configuring Secure Shell Daemon

Enabling SSH

Configuring SSH Access

Configuring SSHD in the CSS

Configuring SSHD Keepalive

Configuring SSHD Port

Configuring SSHD Server-Keybits

Configuring Telnet Access When Using SSHD

Showing SSHD Configurations

Configuring Opportunistic Layer 3 Forwarding

Configuring the DHCP Relay Agent

Adding a DHCP Destination on a Circuit

Enabling and Disabling DHCP on the Circuit

Defining the Hops Field Value for Forwarding DHCP Messages

Displaying the DHCP Relay Configuration

Where to Go Next

Configuring CSS Network Protocols

---

This chapter describes how to configure the CSS DNS, ARP, RIP, IP, routing, spanning-tree bridging, SSH, and opportunistic Layer 3 forwarding functions. Information in this chapter applies to all CSS models, except where noted.

This chapter includes the following sections:

•Configuring Domain Name Service

•Configuring Address Resolution Protocol

•Configuring Routing Information Protocol

•Configuring Internet Protocol

•Configuring an IP Route

•Configuring IP Source-Route

•Disabling an Implicit Service for Static Route Next Hop

•Configuring IP Subnet-Broadcast

•Showing IP Information

•Configuring Cisco Discovery Protocol (CDP)

•Configuring Spanning-Tree Bridging for the CSS

•Configuring Secure Shell Daemon

•Configuring Opportunistic Layer 3 Forwarding

•Configuring the DHCP Relay Agent

Configuring Domain Name Service

Use the dns command to enter commands that control Domain Name Service (DNS), the facility that translates host names such as myhost.mydomain.com to IP
(Internet Protocol) addresses such as 192.168.11.1. The options for this global configuration mode command are:

•dns primary - Specify the primary DNS server

•dns resolve - Query DNS to resolve a host name

•dns secondary - Specify the secondary DNS server

•dns suffix - Specify the default suffix to use when querying DNS

•dnsflow - Set up UDP traffic to DNS server port 53 as a CSS flow or forward the traffic

Use the show running-config global command to display DNS configurations (refer to Chapter 1, Logging In and Getting Started, "Using the Running-Config and Startup-Config Files").

Specifying a Primary DNS Server

To specify the primary DNS server, use the dns primary command followed by the IP address of the DNS server you wish to specify as the primary DNS server. Enter the IP address in dotted-decimal notation (for example, 192.168.11.1).

For example:

(config)# dns primary 192.168.11.1

To remove the primary DNS server, enter:

(config)# no dns primary

Using DNS Resolve

To resolve a host name by querying the DNS server, use the dns resolve command followed by the host name you want to resolve. Enter the host name in mnemonic host-name format (for example, myhost.mydomain.com).

For example:

(config)# dns resolve fred.arrowpoint.com

Specifying a Secondary DNS Server

When a primary DNS server fails, the CSS uses the secondary DNS server to resolve host names to IP addresses. To specify a secondary DNS server, use the dns secondary command followed by the IP address of the secondary DNS server. Enter the IP address in dotted-decimal notation (for example, 192.168.11.1).

(config)# dns secondary 192.158.3.6

You can specify a maximum of two secondary servers. To specify each additional server, repeat the dns secondary command. The order in which you enter the IP addresses is the order in which they are used.

To remove a secondary DNS server, enter the no version of the command followed by the IP address of the DNS server you wish to remove. For example:

(config)# no dns secondary 192.158.3.6

Specifying a DNS Suffix

To specify the default suffix to use when querying the DNS facility, use the dns suffix command followed by the suffix you wish to use. Enter the default suffix as an unquoted text string with no spaces and a maximum of 64 characters.

For example:

(config)# dns suffix arrowpoint.com

To remove the default DNS suffix, enter:

(config)# no dns suffix

Specifying UDP Traffic on the DNS Server Port

For DNS UDP traffic on port 53, use the dnsflow command to determine whether the CSS uses flow control blocks (FCBs) for DNS requests and responses. This command provides the following options:

•enable (default) - Causes the CSS to set up flows using FCBs for DNS requests and responses. Because UDP traffic is connectionless, the DNS flows remain active until the flow manager reclaims the flow resources.

•disable - Causes the CSS to not use FCBs for the DNS requests and responses. Use this setting for sites with heavy DNS traffic or sites where the DNS clients use a source and destination port of 53.

For example:

(config)# dnsflow disable

Configuring Address Resolution Protocol

Use the arp command and its options to statically configure the IP to Media Access Control (MAC) translations necessary for the CSS to send data to network nodes. The following sections discuss configuring Address Resolution Protocol (ARP) for the CSS.

•Configuring ARP

•Configuring ARP Timeout

•Configuring ARP Wait

•Updating ARP Parameters

•Clearing ARP Parameters

•Showing ARP Information

Configuring ARP

To define a static ARP mapping, use the arp command. The syntax for this global configuration mode command is:

•arp ip_address mac_address interface {vlan}

•arp hostname mac_address interface {vlan}

The variables and options are:

•ip_address - The address of the system for static mapping. Enter an IP address in dotted-decimal notation (for example, 192.168.11.1) or in mnemonic host-name format (for example, myhost.mydomain.com).

•hostname - The address of the system for static mapping. Enter a host name in mnemonic host-name format (for example, myhost.mydomain.com). You must configure DNS and the host name must be resolved to an IP address for hostname to work.

•interface - The CSS interface that you want to configure. For a CSS 11501, CSS 11050, or CSS 11150, enter the interface name in interface port format (for example, e2). For a CSS 11503, CSS 11506, or CSS 11800, the interface format is slot/port (for example, 3/1).

•vlan - The number of the VLAN configured in a trunked interface on which the ARP address is configured (assuming trunking is enabled for the CSS Gigabit Interface port, refer to Chapter 2, Configuring Interfaces and Circuits, "Specifying VLAN Trunking to an Interface"). This argument is optional. Enter an integer from 1 to 4094 as the VLAN number.

---

Note To show static ARP mapping when you use the show arp command, the IP route must exist in the routing table.

---

For example:

(config)# arp 192.168.11.1 00-60-97-d5-26-ab ethernet-2

To remove a static mapping address, use the no arp command. For example:

(config)# no arp 192.168.11.1

---

Note The CSS discards ARP requests from hosts that are not on the same network as the CSS circuit IP address. Thus, if a CSS and a host are within the same VLAN but configured for different IP networks, the CSS does not respond to ARP requests from the host.

---

Configuring ARP Timeout

To set the time in seconds to hold an ARP resolution result, use the arp timeout command. When you change the timeout value, it only affects new ARP entries. All previous ARP entries retain the old timeout value. To remove all entries with the old timeout value, enter the clear arp cache command.

The timeout value is the number of seconds the CSS holds an ARP resolution result. To set a timeout value, enter an integer from 60 to 86400 (24 hours) seconds. The default is 14400 seconds (4 hours). If you do not want the ARP entries to timeout, enter none or 86401.

For example:

(config)# arp timeout 120

To restore the default timeout value of 14400 seconds, enter:

(config)# no arp timeout

Configuring ARP Wait

To set the time in seconds to wait for an ARP resolution, use the arp wait command with a wait time. The wait time is the number of seconds the CSS waits for an ARP resolution in response to an ARP request to the network. Enter an integer from 5 to 30 seconds. The default is 5.

For example:

(config)# arp wait 15

To restore the default wait time of 5 seconds, enter:

(config)# no arp wait

Updating ARP Parameters

To update the file containing hosts reachable through ARP, use the update arp command. This command is available in SuperUser mode. For example:

# update arp file

Clearing ARP Parameters

The CSS enables you to clear ARP parameters for the ARP file or ARP cache. To clear the file that contains known hosts reachable through ARP, use the clear arp file command. For example:

# clear arp file

To delete dynamic entries from the ARP cache, use the clear arp cache command with an IP address or hostname. The syntax and options for this command are:

•clear arp cache - Clear the entire ARP cache

•clear arp cache ip_address - Clear a single ARP IP address entry

•clear arp cache hostname - Clear a single ARP hostname entry

For example:

# clear arp cache

Showing ARP Information

To display ARP information, use the show arp command. The syntax and options for the command are:

•show arp - Display the complete ARP resolution table with IP addresses, MAC addresses, and resolution type, excluding entries from the CSS Ethernet management port.

•show arp ip_address - Display the resolution for the IP address. You cannot enter an ARP entry derived from the management port.

•show arp hostname - Display the resolution for the host name.

•show arp summary - Display the total number of static entries, total number of dynamic entries, and total number of entries in the ARP resolution table, excluding the entries from the CSS management port.

•show arp config - Display ARP global configuration parameters. The screen displays the response timeout and the flush timeout in seconds.

•show arp file - Display the hosts reachable using ARP. The screen displays the IP addresses of the host systems.

•show arp management-port - Display the ARP entries from the CSS Ethernet management port. The ARP resolution table displayed through the show arp command does display these entries.

---

Note The CSS Ethernet Management Port IP address appears as an entry in the Management Port ARP cache. This is a normal CSS behavior.

---

To display the complete ARP resolution table, enter:

# show arp

Table 3-1 describes the fields in the show arp output.

Table 3-1 Field Descriptions for the show arp Command

Field	Description
IP Address	The IP address of the system for ARP mapping.
MAC Address	The MAC address of the system mapped to the IP address.
Type	The resolution type for the entry (dynamic or static). Dynamic indicates that the entry was discovered through the ARP protocol. Static indicates that the resolution is from a static configuration.
Port	The CSS interface configured as the egress logical port.

To display a summary of entries in the ARP resolution table, enter:

# show arp summary

Table 3-2 describes the fields in the show arp summary output.

Table 3-2 Field Descriptions for the show arp summary Command

Field	Description
Static Entry	The total number of static map entries in the ARP resolution table (from a static configuration).
Dynamic Entry	The total number of dynamic map entries in the ARP resolution table (entries discovered through the ARP protocol).
Total Entry	The total number of static and dynamic entries in the ARP resolution table.

To display the global ARP configuration, enter:

# show arp config

Table 3-3 describes the fields in the show arp config output.

Table 3-3 Field Descriptions for the show arp config Command

Field	Description
ARP Response Timeout	The time in seconds to wait for an ARP resolution response before discarding the packet waiting to be forwarded to an address. The time can be from 5 to 30 seconds. The default is 5 seconds.
ARP Flush Timeout	The time in seconds to hold an ARP resolution result in the ARP cache. The timeout period can be from 60 to 86400 (24 hours). The default is 14400 (4 hours). An entry of none or 86401 indicates that the ARP entries will not timeout.

To display the host IP addresses entered at initialization or boot time through ARP, enter:

# show arp file

To display the ARP entries from the CSS management port, enter:

# show arp management-port

Table 3-4 describes the fields in the show arp management-port output.

Table 3-4 Field Descriptions for the show arp management-port Command 

Field	Description
IP Address	The IP address of the system for ARP mapping.
MAC Address	The MAC address of the system mapped to the IP address.
Port	The CSS Ethernet management port.

To display the resolution for a host IP address, enter:

# show arp 192.50.1.6

To display the host IP addresses entered at initialization or boot time through ARP, enter:

# show arp file

Configuring Routing Information Protocol

The CSS enables you to configure the following global Routing Information Protocol (RIP) attributes:

•rip advertise - Advertise a route through RIP on the CSS

•rip redistribute - Advertise routes from other protocols through RIP

•rip equal-cost - Specify how many equal-cost routes RIP can insert into the routing table

By default, RIP advertises RIP routes and local routes for interfaces running RIP. The rip command advertises other routes.

The timers used by RIP in the CSS include the following default values. These RIP timer values are not user-configurable in the CSS.

•Transmit (TX) time that is random between 15 and 45 seconds to avoid router synchronization problems

•Route expiration time of 180 seconds (if the CSS loses the link to the next hop router the route is immediately removed).

•Hold down time (the amount of time the CSS transmits with an infinite metric) of 120 seconds.

---

Note If you prefer to configure OSPF instead of RIP on the CSS, refer to Chapter 4, Configuring OSPF.

---

Configuring RIP Advertise

To advertise a route through RIP on the CSS, use the rip advertise command. The syntax for this command is:

rip advertise ip_address subnet_mask metric

•ip_address - The IP address for the route prefix. Enter an IP address in dotted-decimal notation (for example, 192.168.1.0).

•subnet_mask - The IP prefix length in CIDR bitcount notation (for example, /24) or in dotted-decimal notation (for example, 255.255.255.0).

•metric - The optional metric to use when advertising this route. Enter a number from 1 to 15. The default is 1.

For example:

(config)# rip advertise 192.168.1.0/24 9

---

Note The network does not have to be present in the routing table to be advertised. The SNTP ip advertise command is intended for advertising Virtual IP addresses (VIPs).

---

To stop advertising a route through RIP on the CSS, enter:

(config)# no rip advertise 192.168.1.0/24

Configuring RIP Redistribute

To advertise routes from other protocols through RIP, use the rip redistribute command. By default, RIP advertises RIP routes and local routes for interfaces running RIP. This command instructs RIP to advertise other routes.

You can configure the following options for rip redistribute:

•rip redistribute firewall metric - Advertise firewall routes through RIP

•rip redistribute local metric - Advertise local routes (interfaces not running RIP)

•rip redistribute static metric - Advertise static routes

•rip redistribute ospf metric - Advertise OSPF routes

You can also enter an optional metric, which is the metric the CSS uses when advertising this route. Enter a number from 1 to 15. The default is 1.

For example:

(config)# rip redistribute static 3

To stop advertising routes from other protocols through RIP, use either the local, static, or firewall option.

The following commands stop advertising static routes:

(config)# no rip redistribute firewall

(config)# no rip redistribute local

(config)# no rip redistribute static

(config)# no rip redistribute ospf

Configuring RIP Equal-Cost

To set the maximum number of routes RIP can insert into the routing table, use the rip equal-cost command. Enter a number from 1 to 15. The default is 1. For example:

(config)# rip equal-cost 4

To reset the number of routes to the default value of 1, enter:

(config)# no rip equal-cost

Showing RIP Configurations

To show a RIP configuration for one IP address or all IP addresses configured in the CSS, use the show rip command. This command provides the following options:

•show rip - Displays RIP configurations for all interfaces

•show rip ip_address - Displays a single RIP interface entry

•show rip globals - Displays RIP global statistics

•show rip statistics - Displays RIP interface statistics for all interfaces

•show rip statistics ip_address - Displays RIP interface statistics for a specific interface

Table 3-5 describes the fields in the show rip output.

Table 3-5 Field Descriptions for the show rip Command 

Field	Description
IP Address	The advertised RIP interface address.
State	The operational state of the RIP interface.
RIP Send	The RIP version that the interface sends. The possible field values are: •none - Do not send RIP packets •RIPv1 - Send RIP version 1 packets only •RIPv2 - Send RIP version 2 packets only (default)
RIP Recv	The RIP version that the interface receives. The possible values are: •both - Receiving both version 1 and version 2 (default) •none - Receiving no RIP packets •Ripv1 - Receiving RIP version 1 packets only •Ripv2 - Receiving RIP version 2 packets only
Default Metric	The default metric used when advertising the RIP interface.
Tx Log	The setting for logging RIP packet transmissions (enabled or disabled). The default setting is disabled.
Rx Log	The setting for logging RIP packet received (enabled or disabled). The default setting is disabled.

To display global RIP statistics, enter:

# show rip globals

Table 3-6 describes the fields in the show rip globals output.

Table 3-6 Field Descriptions for the show rip globals Command

Field	Description
RIP Route Changes	The global number of route changes made to the IP route database by RIP
RIP Query Responses	The global number of query responses sent to RIP query from other systems

To display the RIP interface statistics for all RIP interface entries, enter:

# show rip statistics

Table 3-7 describes the fields in the show rip statistics output.

Table 3-7 Field Descriptions for the show rip statistics Command 

Field	Description
System Route Changes	The global number of route changes made to the IP route database by RIP
System Global Query Responses	The global number of query responses sent to RIP query from other systems
IP Address	The RIP interface IP address
Triggered Updates Sent	The number of triggered RIP updates sent by the interface
Bad Packets Received	The number of bad RIP response packets received by the interface
Bad Routes Received	The number of bad routes in valid RIP packets received by the interface

Configuring Internet Protocol

To enter Internet Protocol (IP) configuration commands for the CSS, use the ip command. This command is available in configuration mode. The options for this command are:

•ip record-route - Enable the CSS to process frames with a record-route option

•ip redundancy - Enable CSS-to-CSS redundancy

•ip ecmp - Set the equal-cost multipath selection algorithm

Configuring IP Record-Route

To enable the CSS to process frames with a record-route option, use the ip record-route command. For example:

(config)# ip record-route

---

Caution Enabling ip record-route could pose security risks to your network. Record-route inserts the IP address of each router along a path into the IP header.

---

The CSS does not load balance TCP or UDP packets with IP options that are destined to a VIP address. These packet types are dropped and the CSS returns an ICMP destination/port unreachable error. This behavior exists regardless of the state (enabled or disabled) of the ip record-route and ip source-route commands.

The CSS, however, does respond to ICMP packets that are destined to a VIP address. The CSS also responds to TCP or UDP packets that include IP options that are destined to a local circuit address, or require that a routing decision be made.

To disable processing frames with a record-route option (the default behavior), enter:

(config)# no ip record-route

Configuring IP Redundancy

To enable CSS-to-CSS redundancy, use the ip redundancy command. For example:

(config)# ip redundancy

---

Note The CSS does not support simultaneous CSS-to-CSS redundancy and VIP redundancy configurations. In addition, the CSS does not support a trace route of a redundant IP interface.

---

To disable CSS-to-CSS redundancy, enter:

(config)# no ip redundancy

For information on configuring CSS-to-CSS redundancy, refer to the Cisco Content Services Switch Advanced Configuration Guide, Chapter 5, Configuring Redundant Content Services Switches.

Configuring IP ECMP

Use the ip ecmp command to set the equal-cost multipath (ECMP) selection algorithm and the preferred reverse egress path. The CSS supports a maximum of 15 ECMP paths. The syntax and options for this global configuration mode command are:

•ip ecmp address - Choose among alternate paths based on IP addresses. For example:

(config)# ip ecmp address

•ip ecmp no-prefer-ingress - Do not prefer the ingress path of a flow for its reverse egress path. By default, the ingress path for a flow is its preferred egress path. For example:

(config)# ip ecmp no-prefer-ingress

To reset the ingress path of a flow for its preferred reverse egress path, enter:

(config)# no ip ecmp no-prefer-ingress

•ip ecmp roundrobin - Alternate between equal paths in roundrobin fashion. For example:

(config)# ip ecmp roundrobin

---

Note The ECMP selection algorithm for non-TCP/UDP packets (for example, ICMP) is applied on a packet-by-packet basis. Multipath selection for TCP and UDP is performed on a per-flow basis and all packets for a particular flow take the same path.

---

Configuring an IP Route

A static route consists of a destination network address and mask, as well as the next hop to reach the destination. You can also specify a default static route (using 0.0.0.0 as the destination network address and a valid next hop address) to direct frames for which no other destination is listed in the routing table. Default static routes are useful for forwarding otherwise unrouteable packets by the CSS.

When you configure a static route, the CSS creates an internal service that periodically polls the configured next hop address with an ICMP echo (or ping) keepalive. The internal service is called an implicit service. If the router fails, the CSS removes any entries from the routing table that point to the failed router and stops sending network traffic to the failed router. When the router recovers, the CSS:

•Becomes aware of the router

•Reenters applicable routes into the routing table

The implicit service does not determine if the default or static route appears in the routing table. This decision is based on the CSS having a viable ARP entry for the next hop router IP address so the CSS can forward traffic to that destination. The CSS uses the ICMP keepalive as a means to ensure the next hop router MAC address is available and current. However, in certain situations, the next hop router may block ICMP message transmitted by the CSS, which results in a failed ICMP keepalive (the ICMP keepalive is in the Down state). As long as the CSS has the ARP entry of the next hop router the static route is still placed in the routing table.

---

Note The CSS allows you to disable the internal ICMP keepalive through the ip-no-implicit service command. In this case, if the MAC address for the next hop is not known to the CSS the address will not appear in the routing table.

---

Use the ip route command to configure an IP route. You can configure a static route, a default static IP route, a blackhole route (where the CSS drops any packets addressed to the route), or a firewall IP route. Each ip route command requires either an:

•IP address and a subnet mask prefix - For example, 192.168.1.0 /24

or

•IP address and a subnet mask - For example, 192.168.1.0  255.255.255.0

The ip route options are defined below. Note that the examples use the subnet mask prefix option.

•ip route IP address subnet mask blackhole - Instructs the CSS to drop any packets addressed to the route. For example:

(config)# ip route 192.168.1.0 /24 blackhole

•ip route IP address subnet mask IP address2 - Specify the next hop address for the route. For example:

(config)# ip route 0.0.0.0 /0 10.0.1.1

•ip route IP address subnet mask IP address2 distance - Specify the administrative distance. Enter an integer from 1 to 254. Note that the larger the administrative distance value (more hops), the less the route is preferred.
For example:

(config)# ip route 0.0.0.0 /0 10.0.1.1 40

•ip route IP address subnet mask firewall index distance - Configure a firewall route. The firewall option instructs the CSS to use firewall load balancing for this route. You can optionally set the administrative distance. For example:

(config)# ip route 192.168.1.0 /24 firewall 3 2

---

Note The CLI prevents you from configuring IP static routes with identical destinations and identical administrative costs, for IP static routes that are firewall routes and IP static routes that are not firewall routes.

---

•ip route IP address subnet mask IP address originated-packets - Specifies that the route is used only by packets that are created using flows or sessions going to and from the CSS (for example, a Telnet session to the CSS). The route is not used by flows or sessions that go through the CSS (for example, between an attached server and a remote client).

The optional originated-packets keyword instructs the CSS to use this route for flow and session packets going to and from the CSS (for example, a Telnet session to the CSS). Flows or session packets that go through the CSS (for example, between an attached server and a remote client) do not use this route.

For example:

(config)# ip route 0.0.0.0/0 10.0.1.1 originated-packets

---

Note Ping responses and SNMP responses do not use the originated-response route. Ping requests sent from the CSS use the originated-response route. Ping responses sent from the CSS do not use the originated-response route.

---

The variables are:

•ip_address - The destination network address. Enter the IP address in dotted-decimal notation (for example, 192.168.11.1).

•subnet_mask - The IP subnet mask. Enter the mask in either:

–CIDR bitcount notation (for example, /24). Do not enter a space to separate the IP address from the prefix length.

–Dotted-decimal notation (for example, 255.255.255.0).

•ip_address2 - The next hop address for the route. Enter the IP address in dotted-decimal notation (for example, 192.168.11.1).

•distance - The optional administrative distance. Enter an integer from 1 to 254. A smaller number is preferable. The default value is 1.

•index - An existing index number for the firewall route. For information on configuring a firewall index, see the ip firewall command.

To remove a static route, enter:

(config)# no ip route 0.0.0.0/24 10.0.1.1

To disable the dropping of packets to a black-hole route, enter:

(config)# no ip route 192.168.1.0/24 blackhole

To remove a firewall route, enter:

(config)# no ip route 192.168.1.0/24 firewall 3

Configuring IP Source-Route

To enable the CSS to process source-routed frames, use the ip source-route command. For example:

(config)# ip source-route

---

Caution Enabling ip source-route could pose a major security risk to your network. Source-route specifies information that overrides the default routing a packet would normally take. The packet could then bypass a firewall.

---

The CSS does not load balance TCP or UDP packets with IP options that are destined to a VIP address. These packet types are dropped and the CSS returns an ICMP destination/port unreachable error. This behavior exists regardless of the state (enabled or disabled) of the ip source-route and ip record-route commands.

The CSS, however, does respond to ICMP packets that are destined to a VIP address. The CSS also responds to TCP or UDP packets that include IP options that are destined to a local circuit address, or require that a routing decision be made.

To disable processing source-routed frames (the default behavior), enter:

(config)# no ip source-route

Disabling an Implicit Service for Static Route Next Hop

Use the ip no-implicit-service command when you do not want the CSS to start an implicit service for the next hop of a static route. By default, the CSS establishes an implicit (or internal) service for the gateway address when a static route is defined. The ip no-implicit-service command specifies that no implicit service is established to the next hop of the static route, which disables the internal service ICMP keepalive. In this case, if the ARP address for the next hop is not known to the CSS the address will not appear in the routing table.

The purpose of the implicit service to the next hop of a static route is to monitor the availability of the next hop to forward data traffic. When the ip no-implicit-service command is in effect, traffic will be forwarded to the next hop even when the next hop is unavailable. Because of the possibility of data being lost if the next hop becomes unavailable, use of the ip no-implicit-service command is strongly discouraged.

---

Note Static routes can sometimes appear in the CSS routing table even when you have an implicit service for the next hop address (the default setting) and the internal keepalive is down. When the CSS detects the ARP mapping for the next hop in the static route, the CSS continues to list that route in the routing table regardless of the state of the ICMP service keepalive (Down or Up).

---

When you implement the ip no-implicit-service global configuration command, this action does not affect previously configured static routes. The ip no-implicit-service command affects only those static routes added after you enable the command. Cisco Systems recommends you reboot the CSS after you modify the configuration to ensure all static routes are the same, which is useful for network monitoring and troubleshooting. If you wish to stop the implicit service for a previously configured static route, then you must delete and reconfigure the static route.

For example:

(config)# ip no-implicit-service

To reset the default setting, enter:

(config)# no ip no-implicit-service

Configuring IP Subnet-Broadcast

To enable the CSS to forward subnet broadcast addressed frames, use the ip subnet-broadcast command.

For example:

(config)# ip subnet-broadcast

To disable forwarding subnet broadcast addressed frames (the default behavior), enter:

(config)# no ip subnet-broadcast

---

Caution Enabling the CSS to forward the subnet broadcast can make the subnet susceptible to "smurf" attacks; an attacker sends an ICMP echo request frame using a subnet broadcast address as a destination and a forged address as the source.

If a "smurf" attack is successful, all the destination subnet hosts reply to the echo and flood the path back to the source. By disabling the subnet broadcast forwarding, the original echo never reaches the hosts.

---

Showing IP Information

Use the show ip command to display Internet Protocol (IP) information for the CSS. See the following sections to display CSS IP information.

•Showing IP Config - Display IP global configuration parameters

•Showing IP Interfaces - Display configured IP interfaces

•Showing IP Routes - Display IP routing information

•Showing IP Statistics - Display aggregate UDP and TCP statistics for the CSS

•Showing IP Summary - Display a summary of IP global statistics

Showing IP Config

Use the show ip config command to display IP global configuration parameters. The parameters shows the state (enabled or disabled) of the source route option, forward IP broadcasts, record route option, and IP route change logging. It also shows the value for the orphaned route timer.

Table 3-8 describes the fields in the show ip config output.

Table 3-8 Field Descriptions for the show ip config Command 

Field	Description
Source Route Option	Whether processing source-routed frames is enabled or disabled.
Forward IP Broadcasts	Whether forwarding IP broadcasts is enabled or disabled.
Orphaned Route Timer	The setting for the orphaned route timer.
Record Route Option	Whether processing with a record-route option is enabled or disabled.
Multiple Equal Cost Path Algorithm	The setting for the equal-cost multipath selection algorithm. The possible settings are: •Address, choose among alternate paths based on IP addresses •roundrobin, alternate between equal paths in roundrobin fashion
IP Route Change Logging	Whether logging IP route changes is enabled or disabled.

Showing IP Interfaces

Use the show ip interfaces command to display configured IP interfaces on the CSS. The display includes the circuit state, IP address, broadcast address, Internet Control Message Protocol (ICMP) settings, and Router Discovery Program (RDP) settings.

Table 3-9 describes the fields in the show ip interfaces output.

Table 3-9 Field Descriptions for the show ip interfaces Command 

Field	Description
Circuit Name	The name of the circuit associated with the IP interface.
State	The state of the IP interface. The possible states are: •active (1), the interface is up •disabled (2), the interface is disabled •noCircuit (3), the interface is waiting for an underlying circuit
IP Address	The IP address assigned to the circuit.
Network Mask	The network mask of the circuit.
Broadcast Address	The broadcast IP address associated with the IP interface. If left at zero, the all-ones host is used for numbered interfaces. 255.255.255.255 is always used for unnumbered interfaces.
Redundancy	Indicates whether the redundancy protocol is running on the interface. The default state is disable.
ICMP Redirect	Whether the transmission of Internet Control Message Protocol (ICMP) redirect messages is enabled or disabled. The default state is Enabled.
ICMP Unreachable	Whether the transmission of ICMP "destination unreachable" messages is enabled or disabled. The default state is enabled.
RIP	Whether RIP is enabled or disabled.

Showing IP Routes

Use the show ip routes command to display IP routing information. The syntax and options for this command are:

•show ip routes - Display the entire routing table, including host IP address, next hop, interface, route type, protocol, age (in seconds), and metric

•show ip routes firewall - Display all firewall routes

•show ip routes local - Display all local routes

•show ip routes ospf - Display all OSPF routes

•show ip routes rip - Display all RIP routes

•show ip routes static - Display all static routes

•show ip routes summary - Display the total number of OSPF routes (including a breakdown of Intra, Inter, and Ext routes), RIP routes, local routes, static routes, and firewall routes

•show ip routes ip_address_or_host {to ip_address_or_host | mask_or_prefix} - Display information about a route to a destination, a specific route, or routes in a range

The variables are:

•ip_address_or_host - The IP address of the host or network prefix. Enter an IP address in dotted-decimal notation (for example, 192.168.11.1). The IP address after the to keyword is the last IP address in a range.

•mask_or_prefix - Subnet address of the specific network. Enter the subnet address in mask or prefix notation (for example, /24).

To show all IP routes in the CSS, enter:

# show ip routes

Table 3-10 describes the fields in the show ip routes output.

Table 3-10 Field Descriptions for the show ip routes Command 

Field	Description
prefix/length	The IP address and prefix length for the route.
next hop	The IP address for the next hop.
if	The ifIndex value that identifies the local interface through which the next hop of this route should be reached.
type	The type of the route entry. The possible types are: •local, local interface •remote, remote destination •mgmt, management interface
proto	The protocol for the route.
age	The maximum age for the route.
metric	The metric cost for the route.

Showing IP Statistics

Use the show ip statistics command to display aggregate TCP statistics for the unit. Table 3-11 describes the fields in the show ip statistics output.

Table 3-11 Field Descriptions for the show ip statistics Command 

Field	Description
UDP Statistics
Input Datagrams	The total number of flow-related UDP datagrams delivered to UDP users.
No Port Errors	The total number of received UDP datagrams for which there was no application at the destination port.
Output Datagrams	The total number of flow-related UDP datagrams sent from the CSS.
Input Errors	The number of received UDP datagrams that could not be delivered for reasons other than the lack of an application at the destination port.
TCP Statistics
Retransmit Algorithm	The algorithm used to determine the timeout value for retransmitting unacknowledged octets.
Max Retransmit Time	The maximum value permitted by a TCP implementation for the retransmission timeout, measured in milliseconds.
Active Opens	The number of times TCP connections have made a direct transition to the SYN-SENT state from the CLOSED state.
Failed Attempts	The number of times TCP connections have made a direct transition to the CLOSED state from either the SYN-SENT state or the SYN-RCVD state, plus the number of times TCP connections have made a direct transition to the LISTEN state from the SYN-RCVD state.
Established Conns	The number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT.
Output Segments	The total number of segments sent, including those on current connections but excluding those containing only retransmitted octets.
Input Errors	The total number of segments received in error (for example, bad TCP checksums).
Min Retransmit Time	The minimum value permitted by a TCP implementation for the retransmission timeout, measured in milliseconds.
Max TCP Connections	The limit on the total number of TCP connections the CSS can support.
Passive Opens	The number of times TCP connections have made a direct transition to the SYN-RCVD state from the LISTEN state.
Resets	The number of times TCP connections have made a direct transition to the CLOSED state from either the ESTABLISHED state or the CLOSE-WAIT state.
Input Segments	The total number of segments received, including those received in error. This count includes segments received on currently established connections.
Retransmit Segments	The total number of segments retransmitted, that is, the number of TCP segments transmitted containing one or more previously transmitted octets.
Output Resets	The number of TCP segments sent containing the RST flag.
ICMP Statistics
Echo Requests In	The number of received ICMP Echo (request) messages.
VIP Echo Requests	The sending Echo request count for the VIP.
Unreachable	The number of received ICMP Destination Unreachable messages.
Redirect	The number of received ICMP Redirect messages.
Router Solicit	The number of received ICMP router solicitation packets.
Param Problem	The number of received ICMP Parameter Problem messages.
Timestamp Reply	The number of sent ICMP Timestamp Reply messages.
Information Reply	The number of received ICMP reply packets.
Mask Reply	The number of received ICMP Address Mask Reply messages.
Echo Replies In	The number of received ICMP Echo reply messages.
VIP Echo Replies	The sending Echo replies in response to echoes for the VIP.
Source Quench	The number of received ICMP Source Quench messages.
Router Adv	The number of received ICMP router advertisement packets.
Time Exceeded	The number of received ICMP Time Exceeded messages.
Timestamp	The number of sent ICMP Timestamp (request) messages.
Information Request	The number of received ICMP information request packets.
Mask Request	The number of sent ICMP Address Mask Request messages.
Invalid	The number of received bad ICMP type packets.
ARP Statistics
Requests In	The number of received ARP request packets.
Requests Out	The sending ARP request packet count.
Duplicate Addr	The number of received ARP packets with duplicate IP address detected count. This can be the local IP address, VIP, or virtual interface
Invalid	The number of invalid or bad ARP packets.
Replies In	The number of received ARP reply packets.
Replies Out	The sending ARP reply packet count.
In Off Subnet	The number of received ARP packets with sender or target addresses outside of the subnet range of the receiving interface.
Unresolved	The number of processed IP frames with unresolved next hop MAC addresses.

Showing IP Summary

Use the show ip summary command to display a summary of IP global statistics. The statistics include data on reachable and total routes, reachable and total hosts, memory in use for each, and total IP routing memory in use.

Table 3-12 describes the fields in the show ip summary output.

Table 3-12 Field Descriptions for the show ip summary Command

Field	Description
Reachable Routes	The current number of reachable routes.
Total Routes	The current number of routes maintained, both reachable and unreachable.
Reachable Hosts	The current number of reachable host entries.
Total Hosts	The current number of host entries, both reachable and unreachable.
Total Memory in use - IP Routing Memory Pool	The total amount of memory in bytes allocated for the IP routing table. When there are no additional free entries in the memory pool, more memory is allocated to the pool.

Configuring Cisco Discovery Protocol (CDP)

The Cisco Discovery Protocol (CDP) is a medium-independent protocol that runs over Layer 2 (the data link layer) on the CSS and other Cisco manufactured equipment, such as routers, switches, bridges, and access servers. CDP allows the CSS to advertise itself to all other neighboring Cisco CDP-compatible devices on a network. The CSS only transmits CDP advertisements to other CDP-compatible devices on the network; it does not listen for CDP messages from the other CDP-compatible devices.

Any Cisco device with CDP support can learn about the CSS by listening to the periodic messages transmitted by the CSS and determining when the CSS is active. Network operators and analysts can use this information for configuration monitoring, topology discovery, and fault diagnosis.

CDP messages contain specific information about the CSS, such as:

•Device ID (CSS base MAC address)

•IP address (CSS management port IP address)

•Ethernet port ID name

•CSS functional capability flag (Router, Transparent Bridge, or Switch)

•CSS software version

•CSS platform (11500 series CSS product family or 11000 series CSS product family)

CDP advertisements also include hold time information, which defines the length of time the receiving device is to hold CDP information before discarding it.

The CSS enables you to configure the following global CDP attributes:

•cdp run - Enable CDP on the CSS and broadcasting CDPv1 advertisements by the CSS

•cdp holdtime - Specify the amount of time a receiving device is to hold the packet information sent by the CSS before discarding it

•cdp timer - Specify how often the CSS sends CDP updates to neighboring devices

Enabling CDP

To enable CDP transmissions from the CSS to other neighboring Cisco CDP-compatible devices on the network, use the cdp run global configuration command. By default, CDP advertisement is disabled for the CSS.

For example:

(config)# cdp run

To disable CDP transmissions on the CSS, enter:

(config)# no cdp run

Setting the CDP Hold Time

To specify the amount of time a receiving device retains the CDP information sent by the CSS (time-to-live information) before discarding it, use the cdp holdTime global configuration command. If a neighboring device does not receive a CDP message before the hold time expires, the neighboring device drops the CSS as a neighbor. Valid entries are 10 to 255 seconds. The default is 180 seconds.

To specify a CDP hold time of 255 seconds for the receiving device, enter:

(config)# cdp holdTime 255

To reset the CDP hold time back to the default value of 180 seconds, enter:

(config)# no cdp holdTime

Setting the CDP Transmission Rate

To specify the frequency at which the CSS transmits CDP packets to all receiving CDP-compatible devices, use the cdp timer global configuration command. Valid entries are 5 to 254 seconds. The default is 60 seconds.

To change the CDP transmission rate for the CSS to 120 seconds, enter:

(config)# cdp timer 120

To reset the CDP timer to the default rate of 60 seconds, enter:

(config)# no cdp timer

Showing CDP Information

Use the show cdp command to display and verify CDP information for the CSS, such as frequency of transmissions and the hold time for transmitted CSS CDP information.

For example:

(config)# show cdp

Global CDP information:

Sending CDP packets every  60 seconds

Sending a holdtime value of 16 seconds

TimeLastCdpSent: 0 days 00:00:30

The following example illustrates the CDP output on a Cisco Catalyst 8540 router using the IOS show cdp neighbors command.

24-8540-1>show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge S - 
Switch, H - Host, I - IGMP, r - Repeater

Device ID          Local Intrfce  Holdtme Capability Platform  Port ID

00-10-58-01-4d-e3   Eth 0            178   R T S     CSS 11050 Eth-Mgmt

SCA043801A5         Eth 0            144   T S       WS-C6009  3/1

25-8540-1           Fas 0/0/7        142   R T       C8540CSR  Fas 0/0/4

25-8540-1           Eth 0            142   R T       C8540CSR  Eth 0

SCA043801HU(bxb11   Eth 0            151   T S       WS-C6009  2/48

00-07-85-43-14-1d   Eth 0            170   R T S     CSS11503  Eth-Mgmt  

Configuring Spanning-Tree Bridging for the CSS

Use the following bridge commands to configure spanning-tree bridging options for the CSS:

•bridge aging-time - Set the bridge filtering database aging time

•bridge forward-time - Set the bridge forward delay time

•bridge hello-time - Set the bridge hello time interval

•bridge max-age - Set the bridge spanning-tree maximum age

•bridge priority - Set the bridge spanning-tree priority

•bridge spanning-tree - Enable or disable the bridge spanning-tree

Configuring Spanning-TreeBridge Aging-Time

To set the spanning-tree bridge filtering database aging time for the CSS, use the bridge aging-time command. The aging time is the timeout period in seconds for aging out dynamically-learned forwarding information. Enter an integer from 10 to 1000000. The default is 300.

To set the bridge aging time to 600, enter:

(config)# bridge aging-time 600

To restore the default aging time of 300, enter:

(config)# no bridge aging-time

Configuring Spanning-Tree Bridge Forward-Time

To set the spanning-tree bridge forward delay time, use the bridge forward-time command. The forward time is the delay time in seconds that all bridges use for forward delay when this bridge is acting as the root. Enter an integer from 4 to 30. The default is 4.

---

Note Ensure that the bridge maximum age is less than or equal to 2 times (bridge forward-time - 1 second) and greater than or equal to 2 times (bridge hello-time + 1 second).

---

To set the bridge forward time to 9, enter:

(config)# bridge forward-time 9

To restore the default delay time of 4, enter:

(config)# no bridge forward-time

Configuring Spanning-Tree Bridge Hello-Time

To set the bridge hello time interval, use the bridge hello-time command. The hello time is the time in seconds that all bridges use when a bridge is acting as the root. Enter an integer from 1 to 10. The default is 1.

To set the bridge hello time to 9, enter:

(config)# bridge hello-time 9

To restore the default hello time interval of 1, enter:

(config)# no bridge hello-time

Configuring Spanning-Tree Bridge Max-Age

To set the bridge spanning-tree maximum age, use the bridge max-age command. The maximum age is the time in seconds that all bridges use when a bridge is acting as the root. Enter an integer from 6 to 40. The default is 6.

---

Note Ensure that the bridge maximum age is greater than or equal to 2 times (bridge hello-time + 1 second) and less than or equal to 2 times (bridge forward-time - 1 second).

---

To set the bridge maximum age to 21, enter:

(config)# bridge max-age 21

To restore the default maximum age of 6, enter:

(config)# no bridge max-age

Configuring Spanning-Tree Bridge Priority for the CSS

To set the priority that spanning tree uses to choose the root bridge in the network, use the global bridge priority command. In spanning tree, the 2-octet field is prepended to the 6-octet MAC address to form an 8-octet bridge identifier. The device with the lowest bridge identifier is considered the highest priority bridge and becomes the root bridge. The range for bridge priority is 0 to 65535. The default is 32768.

For example:

(config)# bridge priority 1700

To restore the bridge priority to its default of 32768, enter:

(config)# no bridge priority

Enabling and Disabling Bridge Spanning-Tree

Spanning-tree bridging is enabled by default. To disable the spanning-tree, enter:

(config)# bridge spanning-tree disable

---

Caution Disabling spanning-tree bridging may make your network susceptible to packet storms.

---

When you disable spanning-tree bridging, the CSS forwards all multicast traffic, including bridge protocol data units (BPDUs) for the bridge multicast group and for trunked VLANs. The CSS can still operate in an 802.1Q spanning-tree environment as long as you do not require that the CSS put any of its ports into a blocking state.

To reenable spanning-tree bridging, enter:

(config)# bridge spanning-tree enable

Showing Bridge Configurations

The CSS enables you to show bridge forwarding and bridge status information.To display bridge forwarding information, use the show bridge forwarding command. Table 3-13 describes the fields in the show bridge forwarding output.

Table 3-13 Field Descriptions for the show bridge forwarding Command

Field	Description
VLAN	The bridge interface virtual LAN number
MAC Address	The MAC address for the entries
Port Number	The port number used for bridge forwarding

To display bridge status information, use the show bridge status command. Table 3-14 describes the fields in the show bridge status output.

Table 3-14 Field Descriptions for the show bridge status Command 

Field	Description
STP State	The state of the spanning-tree protocol, enabled or disabled.
Root Max Age	The timeout period in seconds the host times out root information.
Root Hello Time	The interval in seconds that the root broadcasts its hello message to other devices.
Root Fwd Delay	The delay time in seconds that the root uses for forward delay.
Designated Root	The bridge ID for the designated root.
Bridge ID	The bridge ID of the bridge.
Port	The port ID.
State	The state of the port. The possible states are: •Block - The blocking state. A port enters the blocking state after CSS initialization. The port does not participate in frame forwarding. •Listen - The listening state. This state is the first transitional state a port enters after the blocking state. The port enters this state when STP determines that the port should participate in frame forwarding. •Learn - The learning state. The port enters the learning state from the listening state. The port in the learning state prepares to participate in frame forwarding. •Forward - The forwarding state. The port enters the forwarding state from the learning state. A port in the forwarding state forwards frames. •Disabled - The disabled state. A port in the disabled state does not participate in frame forwarding or STP. A port in the disabled state is non operational.
Designated Bridge	The bridge ID for the designated bridge.
Designated Root	The bridge ID for the designated root.
Root Cost	The cost of the root.
Port Cost	The cost of the port.
Desg Port	Designated port.

Configuring Secure Shell Daemon

The Secure Shell Daemon (SSHD) protocol provides secure encrypted communications between two hosts communicating over an insecure network. The CSS supports an implementation of OpenSSH to provide this secure communication. SSHD uses the standard CSS login sequence of entering the username and password at the CSS login prompts.

SSHD on the CSS supports both the SSH v1 and v2 protocols. For SSH v1, the software provides encrypted communication using ciphers such as 3DES or Blowfish. For SSH v2, the software provides 128-bit AES, Blowfish, 3DES, CAST128, Arcfour, 192-bit AES, or 256-bit AES.

---

Caution When using SSHD, ensure that the CSS is not configured to perform a network boot from a network-mounted file system on a remote system (a diskless environment). If you require the CSS to use the network-mounted method of booting, be aware that the SSHD protocol is not supported.

If the CSS has been booted using a network boot from a network-mounted file system, the CSS logs the following error message by SSHD as the protocol attempts to initialize (and then exit from operation):

Unable to initialize sshd; failure to seed random number generator

---

---

Note To enhance security when using SSHD, disable Telnet access (Telnet access is enabled by default). Use the telnet-access disable command as described later in this chapter.

---

This section covers:

•Enabling SSH

•Configuring SSH Access

•Configuring SSHD in the CSS

•Configuring Telnet Access When Using SSHD

•Showing SSHD Configurations

Enabling SSH

You must specify a Secure Management license key for the SSH functionality to be activated in your Cisco 11500 series CSS. If you ordered the software option with your CSS, the license key is located on a card in an envelope in the CSS Accessory kit. If you ordered the Secure Management software option after receipt of your CSS, the license key was mailed to you.

To install the Secure Management license key and activate SSH:

1. Log into the CSS and enter the license command.

# license

2. Enter the 12-digit Secure Management license key.

Enter the Software License Key (q to quit): nnnnnnnnnnnn

The Secure Management license key is now properly installed.

Configuring SSH Access

SSH access to the CSS is enabled by default through the no restrict ssh command. Before you use SSHD, ensure that access has not restricted through the restrict ssh command. You can verify the SSH access selection in the running-configuration file.

To enable SSH access to the CSS, enter:

(config)# no restrict ssh

To disable SSH access, enter:

(config)# restrict ssh

Configuring SSHD in the CSS

The CSS provides the following commands for configuring SSHD:

•sshd keepalive - Enable TCP keepalive messages

•sshd port - Specify the SSHD port

•sshd server-keybits - Set the number of bits in the ephemeral protocol server key (SSH v1 only)

Ensure that SSHD access to the CSS is enabled for SSHD to accept connections from SSH clients. By default, SSH access is enabled through the no restrict ssh global command.

Configuring SSHD Keepalive

The CSS supports sending TCP keepalive messages to the client as a means for the server to determine whether the SSHD connection to the client is functioning (for example, if the network has gone down or the client has crashed). If you disable sending SSHD keepalives to a client, sessions may hang indefinitely on the server which consumes system resources.

To enable SSHD keepalive, use the sshd keepalive command. SSHD keepalive is enabled by default.

To enable sending SSHD keepalives to the client, enter:

(config)# sshd keepalive

To disable sending SSHD keepalives, enter:

(config)# no sshd keepalive

Configuring SSHD Port

To specify the port number to which the server listens for connections from clients, use the sshd port command. Enter a port number of 22 or from 512 to 65535. The default is 22 (the default port for SSH).

For example, to configure port number 65530 as the SSHD port, enter:

(config)# sshd port 65530

To reset the port number to the default of 22, enter:

(config)# no sshd port

Configuring SSHD Server-Keybits

To specify the number of bits in the ephemeral protocol server key, use the sshd server keybits command. Enter the number of bits from 512 to 1024. The default is 768.

---

Note The sshd server keybits command pertains only to SSH v1 connections.

---

For example, to set the number of bits in the server key to 1024, enter:

(config)# sshd server-keybits 1024

To reset the number of bits to the default of 768, enter:

(config)# no sshd server-keybits

Configuring Telnet Access When Using SSHD

When you use SSHD, you can disable non-secure Telnet access to the CSS. Use the global restrict telnet command to disable Telnet access to the CSS. Telnet access is enabled by default.

To disable Telnet access, enter:

(config)# restrict telnet

To reenable Telnet access to the CSS, enter:

(config)# no restrict telnet

Showing SSHD Configurations

To display SSHD configurations, use the show sshd command. This command provides the following options:

•show sshd config - Displays the SSHD configuration

•show sshd sessions - Displays a summary of the current active SSHD server sessions. The command only displays data if an SSH client is currently configured.

•show sshd version - Show the current version of the SSHield package that is running in the CSS.

To display the SSHD configuration, enter:

# show sshd config

Table 3-15 describes the fields in the show sshd config display.

Table 3-15 Field Descriptions for the show sshd config Command 

Field	Description
Maximum Sessions Allowed	The maximum number of concurrent SSHD sessions (five maximum).
Active Sessions	The number of currently active SSHD sessions.
Log Level	The current log level.
Listen Socket Count	The number of sockets that SSHD is currently listening on (not currently configurable, default is 1).
Listen Port	The port number that the SSHD server listens to connections for client connections (set by the sshd port command). The default is 22 (the default port for SSH). The port number is 22 or from 512 to 65535.
Listen Address	The address that SSHD uses to listen for client connections (not currently configurable, default is 0.0.0.0).
Server Key Bits	The number of bits to use when generating the SSHv1 server key. The default is 768. The range is from 512 to 1024.
RSA Protocol (SSH1)	Indicates whether SSHv1 access is allowed (not currently configurable, default is enabled).
Empty Passwords	Disabled. The username must always have an associated password.
Keepalive	Specified whether sending a TCP keepalive to the client is enabled or disabled. SSHD keepalive is enabled by default.
SSH2 Cipher List	Displays a list of SSHv2 cipher suites supported for authentication, encryption, and data integrity between the client and the server.

To display the SSHD sessions, enter:

# show sshd sessions

Table 3-16 describes the fields in the show sshd sessions display.

Table 3-16 Field Descriptions for the show sshd sessions
Command 

Field	Description
Session_ID	The session ID.
Conn_TID	The connection task ID of the SSHD server handling the connection (tSshConn).
Login_TID	The login task ID handling the connection (tSshCli).
PTY_FD	The file descriptor used by the login task to communicate with the CSS CLI. The PTY_FD file descriptor allows you to correlate the SSH client sessions with those sessions listed under the Line field in the show lines output. For example, the show sshd sessions output displays an SSH client session connected to PTY_FD32. If you enter the show lines command there will be a line in the display that lists sshc32 (for SSH client pty_fd32). This correlation allows you to view the login time, idle time, and the location of the client of the SSH sessions through the show lines command.
Remote IP/ Remote Port	The remote IP and port number of the SSHD session.

To display the SSHD version, enter:

# show sshd version

SSHield version 1.5, SSH version OpenSSH_3.0.2p1

Configuring Opportunistic Layer 3 Forwarding

The CSS opportunistic Layer 3 forwarding feature allows the CSS to reduce the number of network device hops for certain packets or flows. The CSS forwards packets at Layer 3 if the destination MAC address in the Ethernet header is the CSS MAC address. Opportunistic Layer 3 forwarding allows the CSS to make Layer 3 forwarding decisions even if the layer 2 packet destination MAC address does not belong to the CSS.

For example, Figure 3-1 shows a CSS connected to VLAN1 and VLAN2. Each VLAN has an end station and an uplink to Router1. End stations A and B both point to Router1 as their default router. When end station A transmits a packet to end station B, it uses its default route to Router1. The packet contains Router1's destination MAC address. A traditional layer 2 device would forward the packet to Router1 and it would forward the packet to end station B on VLAN2.

Using opportunistic Layer 3 forwarding, the CSS inspects the IP packet header to determine the destination IP address. Instead of forwarding the packet to Router1, the CSS forwards the packet directly to end station B. Because the CSS only handles the packet once, the router and uplink are not used and network resources are conserved.

Figure 3-1 Opportunistic Layer 3 Forwarding Example

Opportunistic Layer 3 forwarding provides three modes of operation:

•local (default) - Apply opportunistic Layer 3 forwarding if the destination IP address belongs to a node that resides on one of the subnets directly attached to the CSS and the CSS knows an ARP resolution for that node. Because the local option is the default, use the no ip opportunistic command to reconfigure ip opportunistic Layer 3 forwarding to the local setting.

•all - Apply opportunistic Layer 3 forwarding if the destination IP address matches any routing entry on the CSS. This mode is not recommended if the topology includes multiple routers and the CSS does not know all of the routes that the routers know.

•disabled - The CSS does not perform opportunistic Layer 3 forwarding. Regular Layer 3 forwarding is performed only for packets that contain the CSS destination MAC address.

To configure ip opportunistic Layer 3 forwarding to all, enter:

(config)# ip opportunistic all

To reconfigure ip opportunistic Layer 3 forwarding to the default of local enter:

(config)# no ip opportunistic

When you configure ip opportunistic all, you can use the ip route originated-packets command to configure routes that the CSS will use to reach devices, but will not use as opportunistic routes for forwarding traffic. Routes created using the ip route originated-packets command apply only to packets that originate on the CSS. Packets and flows forwarded by the CSS will not use these routes.

For example,

(config)# ip route 0.0.0.0/0 192.168.1.7 originated-packets

Configuring the DHCP Relay Agent

Dynamic Host Configuration Protocol (DHCP) servers provide configuration parameters to DHCP clients. When DHCP clients and associated servers do not reside on the same IP network or subnet, a DHCP relay agent can transfer DHCP messages between them. To configure a DHCP relay agent on a 11500 series CSS, define DHCP server destinations on a circuit and enable the DHCP relay agent on the circuit.

---

Note You must assign an IP address on the circuit. Use the ip address command in the specific circuit mode to assign the IP address and a subnet mask. For example:

(config-circuit[VLAN2])# ip address 178.3.6.53/8

---

See the following sections to configure and view DHCP parameters:

•Adding a DHCP Destination on a Circuit

•Enabling and Disabling DHCP on the Circuit

•Defining the Hops Field Value for Forwarding DHCP Messages

•Displaying the DHCP Relay Configuration

Adding a DHCP Destination on a Circuit

A CSS circuit acts as the DHCP relay agent. For each circuit on the CSS, you can configure a maximum of five DHCP destinations. The initial DHCP broadcast request is sent to all of the configured destinations.

Do not configure a relay destination on a circuit when the relay destination is directly connected to or reachable from one of the ports on the same circuit. In this case, the DHCP packets reach the relay destination through normal broadcast and a relay agent is not required.

To specify the DHCP relay destination address, use the dhcp relay-to command available in circuit configuration mode. Enter an IP address in dotted-decimal notation.

To add a destination address of 192.168.22.25 to a DHCP server, enter:

(config-circuit[VLAN2])# dhcp relay-to 192.168.22.25

To remove the relay destination address, enter:

(config-circuit[VLAN2])# no dhcp relay-to 192.168.22.25

Enabling and Disabling DHCP on the Circuit

After you enable the DHCP relay agent on the CSS circuit, the CSS transfers DHCP messages between DHCP clients and servers. To enable the agent on the circuit, use the dhcp-relay-agent command available in circuit configuration mode. For example:

(config-circuit[VLAN2])# dhcp-relay-agent

To disable the DHCP relay agent on the circuit, enter:

(config-circuit[VLAN2])# no dhcp-relay-agent

Defining the Hops Field Value for Forwarding DHCP Messages

The CSS forwards or discards a DHCP message based on its hops field value in the BOOTP header. When messages have values in the hops fields that exceed the maximum value set on the CSS, the CSS discards the message. To set the maximum allowable number in the hops field, use the dhcp-agent max-hops command available in global configuration mode. By default, the maximum allowable number is 4. You can set a number from 1 to 15.

To set the maximum allowable value of 10, enter:

(config)# dhcp-agent max-hops 10

To reset the maximum allowable number in the hops field to its default of 4, enter:

(config)# no dhcp-agent max-hops

Displaying the DHCP Relay Configuration

Use the show dhcp-relay-agent global command to display the DHCP configuration information on the 11500 series CSS. This command is available in all modes. For example:

# show dhcp-relay-agent global

Table 3-17 describes the fields in the show dhcp-relay-agent global output.

Table 3-17 Field Descriptions for the show dhcp-relay-agent global Command 

Field	Description
Max Hops	The maximum allowable number in the hops field of the BOOTP header. The CSS does not forward packets with headers that contain a larger number.
Number of circuits configured for DHCP	The number of CSS circuits configured for DHCP.
Circuit	The circuit configured for DHCP.
IfAddress	The interface address for the circuit.
DHCP State	The DHCP relay agent state on the circuit. Enabled indicates that the DHCP relay agent is enabled. Disabled indicates that the DHCP relay agent is disabled.
Relay destination	The DHCP relay destination address for the server. Each circuit can have five destination addresses.

Where to Go Next

For information on configuring OSPF for the CSS, refer to Chapter 4, Configuring OSPF.