Table Of Contents

System Management Commands

aaa accounting

aaa authentication arap

aaa authentication enable default

aaa authentication login

aaa authentication local-override

aaa authentication password-prompt

aaa authentication ppp

aaa authentication username-prompt

aaa authorization

aaa new-model

alias

arap authentication

buffers

buffers huge size

cdp enable

cdp holdtime

cdp run

cdp timer

clear cdp counters

clear cdp table

clock set

clock summer-time

clock timezone

custom-queue-list

downward-compatible-config

enable last-resort

enable password

enable secret

enable use-tacacs

fair-queue

hostname

ip tacacs source-interface

load-interval

logging

logging buffered

logging console

logging facility

logging monitor

logging on

logging synchronous

logging trap

login authentication

ntp access-group

ntp authenticate

ntp authentication-key

ntp broadcast

ntp broadcast client

ntp broadcastdelay

ntp clock-period

ntp disable

ntp master

ntp peer

ntp server

ntp source

ntp trusted-key

ping (user)

ping (privileged)

ppp authentication

ppp chap password

ppp use-tacacs

priority-group

priority-list default

priority-list interface

priority-list protocol

priority-list queue-limit

privilege level (global)

privilege level (line)

prompt

queue-list default

queue-list interface

queue-list protocol

queue-list queue byte-count

queue-list queue limit

scheduler-interval

service decimal-tty

service exec-wait

service finger

service nagle

service password-encryption

service prompt config

service tcp-keepalives

service tcp-small-servers

service telnet-zero-idle

service timestamps

show aliases

show buffers

show cdp

show cdp entry

show cdp interface

show cdp neighbors

show cdp traffic

show clock

show debugging

show ip accounting

show logging

show memory

show ntp associations

show ntp status

show privilege

show processes

show processes memory

show protocols

show queueing

show snmp

show stacks

show tcp

snmp-server access-policy

snmp-server chassis-id

snmp-server community

snmp-server contact

snmp-server context

snmp-server host

snmp-server location

snmp-server packetsize

snmp-server party

snmp-server queue-length

snmp-server system-shutdown

snmp-server trap-authentication

snmp-server trap-source

snmp-server trap-timeout

snmp-server userid

snmp-server view

tacacs-server attempts

tacacs-server authenticate

tacacs-server directed-request

tacacs-server extended

tacacs-server host

tacacs-server key

tacacs-server last-resort

tacacs-server notify

tacacs-server optional-passwords

tacacs-server retransmit

tacacs-server timeout

trace (user)

trace (privileged)

username

System Management Commands

---

This chapter describes the commands used to manage the access server system and its performance on the network.

For system management configuration tasks and examples, refer to the chapter entitled "Managing the System" in the Access and Communication Servers Configuration Guide.

aaa accounting

To enable AAA accounting of requested services for billing or security purposes when using TACACS+, use the aaa accounting global configuration command. Use the no form of this command to disable accounting.

aaa accounting {system | network | connection | exec | command level} {start-stop |
wait-start | stop-only} tacacs+
no aaa accounting {system | network | connection | exec | command level}

Syntax Description

system	Accounting is performed for all system-level events not associated with users, such as reloads.
network	Accounting is run for all network-related service requests, including SLIP, PPP, PPP NCPs, and ARAP.
connection	Accounting is run for outbound Telnet and rlogin.
exec	Accounting is run for Execs (user shells). This may return user profile information such as autocommand information.
command	Accounting is run for all commands at the specified privilege level.
level	The command level that should be accounted. Valid entries are 0-15.
start-stop	A start record accounting notice is sent at the beginning of a process and a stop record is sent at the end of a process. The start accounting record is sent in the background. The requested user process begins regardless of whether or not the start accounting record was received by the accounting server.
wait-start	As in start-stop, both a start and a stop accounting record are sent to the accounting server. However, if you use the wait-start keyword, the requested user service will not begin until the start accounting record is acknowledged. A stop accounting record will also be sent.
stop-only	A stop record accounting notice is sent at the end of the requested user process.
tacacs+	Mandatory. Enables the TACACS-style accounting.

Default

AAA accounting is not enabled.

Command Mode

Global configuration

Usage Guideline

The aaa accounting command allows you to set start/stop accounting for any or all of the listed functions in the Syntax Description for this command. For minimal accounting control, issue the stop-only command, which sends a stop record accounting notice at the end of the requested user process. For additional accounting control, you can issue the start-stop command, where TACACS+ sends a start accounting notice at the beginning of the requested process and a stop accounting notice at the end of the process. You can further control access and accounting by issuing the wait-start command, which ensures that the start notice is received by the TACACS+ server before granting the user's process request. Accounting is only done to the TACACS+ server.

---

Note   This command, along with aaa authentication username-prompt, replaces the tacacs-server authenticate command in previous versions of TACACS, and can only be used with AAA/TACACS+.

---

Examples

In the following example, accounting is set for outbound Telnet and rlogin, and both a start and stop accounting notice is sent to the TACACS+ server:

aaa accounting connection start-stop tacacs+

In the following example, accounting is set for privilege level 15 commands, with a wait-start restriction:

aaa accounting command 15 wait-start tacacs+

Related Commands

aaa new-model
aaa authentication username-prompt

aaa authentication arap

To enable an AAA authentication method for AppleTalk Remote Access (ARA )users while using TACACS+, use the aaa authentication arap command. Use the no form of the command to disable this authentication.

aaa authentication arap {default | list-name} method1 [...[method4]]
no aaa authentication arap {default | list-name} method1 [...[method4]]

Syntax Description

default	Uses the listed methods that follow this argument as the default list of methods used when a user logs in.
list-name	A character string used to name the following list of authentication methods tried when a user logs in.
method	One of the methods described in .

Default

If the default list is not set, only the local user database is checked. This has the same effect as issuing the following command:

aaa authentication arap default local

Command Mode

Global configuration

Usage Guideline

The list names and default that you set using the aaa authentication arap command are used with the arap authentication command. These lists can contain up to four authentication methods that will be used when a user tries to log in with ARA. Note that ARAP guest logins are disabled by default when you enable AAA/TACACS+. To allow guest logins, you must use either the guest or auth-guest method listed in . You can only use one of these methods; they are mutually exclusive.

Create a list by entering the aaa authentication arap list-name method command, where list-name is any character string used to name this list, such as MIS-access. The method keyword refers to the list of methods the authentication algorithm will try, in the given sequence. You can enter up to four methods, which are described in .

To create a default list that will be used if no list is specified in the arap authentication command, use the default keyword followed by the methods you wish to be used in default situations.

The additional methods of authentication will only be used if the previous method returns an error, not if it fails.

Use the show running-config command to view lists of authentication methods.

Table 5-1 AAA Authentication ARAP Method Descriptions

Method	Description
guest	Allows guest logins. This method must be the first method listed, but can be followed by other methods to try if it does not succeed.
auth-guest	Allows guest logins only if the user has already logged in to EXEC. This method must be the first method listed, but can be followed by other methods to try if it does not succeed.
line	Uses the line password for authentication.
local	Uses the local username database for authentication.
tacacs+	Uses TACACS+ authentication.

---

Note   This command cannot be used with TACACS or Extended TACACS.

---

Examples

The following example creates a list called MIS-access, which first tries TACACS+ authentication and then none:

aaa authentication arap MIS-access tacacs+ none

The following example creates the same list, but sets it as the default list, which will be used for all arap authentications if no other list is specified:

aaa authentication arap default tacacs+ none

Related Commands

A dagger (†) indicates that the command is documented in another chapter.

aaa authentication local-override
aaa new-model
arap authentication†

aaa authentication enable default

To enable AAA authentication to determine if a user can access the privileged command level with TACACS+, use the aaa authentication enable default command. Use the no form of the command to disable this authorization method.

aaa authentication enable default method1 [...[method4]]
no aaa authentication enable default method1 [...[method4]]

Syntax Description

method

At least one and up to four of the methods described in .

Default

If the default list is not set, the action will be to check only the enable password. This has the same effect as issuing the following command:

aaa authentication enable default enable

On the console, the enable password is used if it exists. If no password is set, the process will succeed anyway.

Command Mode

Global configuration

Usage Guideline

Use the aaa authentication enable default command to create a series of authentication methods that are used to determine if a user can access privileged command level. You can specify up to four authentication methods. Method keywords are described in . The additional methods of authentication will only be used if the previous method returns an error, not if it fails. To specify that the authentication should succeed even if all methods return an error, specify none as the final method in the command line.

If a default authentication routine is not set for a function, the default is none—no authentication is performed. Use the show running-config command to view currently configured lists of authentication methods.

Table 5-2 AAA Authentication Enable Default Method Descriptions

Method	Description
enable	Uses the enable password for authentication.
line	Uses the line password for authentication.
none	Uses no authentication.
tacacs+	Uses TACACS+ authentication.

---

Note   This command cannot be used with TACACS or Extended TACACS.

---

Example

The following example creates an authentication list that will first try to contact a TACACS+ server. If no server can be found, then AAA will try to use the enable password. If this also returns an error (because no enable password is configured on the server), the user will be allowed access with no authentication.

aaa authentication enable default tacacs+ enable none

Related Commands

aaa authentication local-override
aaa new-model
aaa authentication username-prompt
enable password

aaa authentication login

To set AAA authentication at login when using TACACS+, use the aaa authentication login global configuration command. Use the no form of the command to disable AAA authentication.

aaa authentication login {default | list-name} method1 [...[method4]]
no aaa authentication login {default | list-name} method1 [...[method4]]

Syntax Description

default	Makes the listed authentication methods that follow this argument the default list of methods used when a user logs in.
list-name	A character string used to name the following list of authentication methods tried when a user logs in.
method	At least one and up to four of the methods described in .

Default

If the default list is not set, only the local user database is checked. This has the same effect as issuing the following command:

aaa authentication login default local

---

Note   On the console, login will succeed without any authentication checks if default is not set.

---

Command Mode

Global configuration

Usage Guideline

The default and optional list names that you create with the aaa authentication login command are used with the login authentication command.

Create a list by entering the aaa authentication list-name method command, where list-name is any character string used to name this list, such as MIS-access. The method keyword refers to the list of methods the authentication algorithm tries, in the given sequence. Method keywords are described in .

To create a default list that is used if no list is assigned to a line with the login authentication command, use the default argument followed by the methods you want in default situations.

The additional methods of authentication is only be used if the previous method returns an error, not if it fails. To specify that the authentication should succeed even if all methods return an error, specify none as the final method in the command line.

If authentication is not specifically set for a line, the default is to deny access—no authentication is performed. Use the show running-config command to view currently configured lists of authentication methods.

Table 5-3 AAA Authentication Login Method Descriptions

Method	Description
enable	Uses the enable password for authentication.
line	Uses the line password for authentication.
local	Uses the local username database for authentication.
none	Uses no authentication.
tacacs+	Uses TACACS+ authentication.

---

Note   This command cannot be used with TACACS or Extended TACACS.

---

Example

The following example creates an AAA authentication list called MIS-access. This authentication will first try to contact a TACACS+ server. If no server is found, TACACS+ will return an error and AAA will try to use the enable password. If this also returns an error (because no enable password is configured on the server), the user is allowed access with no authentication.

aaa authentication login MIS-access tacacs+ enable none

The following example creates the same list, but sets it as the default list that will be used for all login authentications if no other list is specified:

aaa authentication login default tacacs+ enable none

Related Commands

aaa authentication local-override
aaa new-model
login authentication

aaa authentication local-override

To have the access server check the local user database for authentication before attempting another form of authentication, use the aaa authentication local-override command. Use the no form of the command to disable the override.

aaa authentication local-override
no aaa authentication local-override

Syntax Description

This command has no arguments or keywords.

Default

Override is disabled.

Command Mode

Global configuration

Usage Guideline

This command is useful when you want to configure an override to the normal authentication process for certain personnel such as system administrators.

When this override is set, the user is always prompted for the username. The system then checks to see if the entered username corresponds to a local account. If the username does not correspond to one in the local database, login proceeds with the methods configured using other aaa commands (such as aaa authentication login). Note that when using this command, the first prompt is fixed as Username:

Example

The following example enables aaa authentication override:

aaa authentication local-override

Related Commands

aaa authentication arap
aaa authentication enable default
aaa authentication login
aaa new-model
aaa authentication password-prompt

aaa authentication password-prompt

To change the text displayed when users are prompted for a password, use the aaa authentication password-prompt global configuration command. Use the no form of this command to return to the default password prompt text.

aaa authentication password-prompt {text-string}
no aaa authentication password-prompt {text-string}

Syntax Description

text-string

String of text that will be displayed when the user is prompted to enter a password. If this text-string contains spaces or unusual characters, it must be enclosed in double-quotes (for example, "Enter your password:").

Default

This command is disabled by default.

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.0.

Use the aaa authentication password-prompt command to change the default text that the Cisco IOS software displays when prompting a user to enter a password. This command changes the password prompt for the enable password as well as for login passwords that are not supplied by remote security servers. The no form of this command returns the password prompt to the default value:

Password:

The aaa authentication password-prompt command does not change any dialog that is supplied by a remote TACACS+ or RADIUS server.

Example

The following example changes the text for the password prompt:

aaa authentication password-prompt "Enter your password now:"

Related Commands

A dagger (†) indicates that the command is documented outside this chapter.

aaa authentication username prompt
aaa new-model
enable password ^†

aaa authentication ppp

To specify one or more AAA authentication methods for use on serial interfaces running PPP when using TACACS+, use the aaa authentication ppp command. Use the no form of the command to disable authentication.

aaa authentication ppp {default | list-name} method1 [...[method4]]
no aaa authentication ppp {default | list-name} method1 [...[method4]]

Syntax Description

default	Makes the listed authentication methods that follow this argument the default list of methods used when a user logs in.
list-name	A character string used to name the following list of authentication methods tried when a user logs in.
method	At least one and up to four of the methods described in .

Default

If the default list is not set, the action will be to check only the local user database. This has the same effect as issuing the following command:

aaa authentication ppp default local

Command Mode

Global configuration

Usage Guideline

The lists that you create using the aaa authentication ppp command are used with the ppp authentication command. These lists contain up to four authentication methods that will be used when a user tries to log in to the serial interface.

Create a list by entering the aaa authentication ppp list-name method command, where list-name is any character string used to name this list, such as MIS-access. The method keyword refers to the list of methods the authentication algorithm tries, in the given sequence. You can enter up to four methods. Method keywords are described in .

The additional methods of authentication are only used if the previous method returns an error, not if it fails. Specify none as the final method in the command line to have authentication succeed even if all methods return an error.

If authentication is not specifically set for a function, the default is none—no authentication is performed. Use the show running-config command to view lists of authentication methods.

Table 5-4 AAA Authentication PPP Method Descriptions

Method	Description
if-needed	Does not authenticate if user has already been authenticated on a TTY line.
local	Uses the local username database for authentication.
none	Uses no authentication.
tacacs+	Uses TACACS+ authentication.

---

Note   This command cannot be used with TACACS or Extended TACACS.

---

Example

The following example creates an AAA authentication list called MIS-access for serial lines that use PPP. This authentication first tries to contact a TACACS+ server. If this returns an error, the user is allowed access with no authentication.

aaa authentication ppp MIS-access tacacs+ none

Related Commands

aaa authentication local-override
aaa new-model
ppp authentication

aaa authentication username-prompt

To change the text displayed when users are prompted to enter a username, use the aaa authentication username-prompt global configuration command. Use the no form of this command to return to the default username prompt text.

aaa authentication username-prompt {text-string}
no aaa authentication username-prompt {text-string}

Syntax Description

text-string

String of text that will be displayed when the user is prompted to enter a username. If this text-string contains spaces or unusual characters, it must be enclosed in double-quotes (for example, "Enter your name:").

Default

This command is disabled by default.

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.0.

Use the aaa authentication username-prompt command to change the default text that the Cisco IOS software displays when prompting a user to enter a username. The no form of this command returns the username prompt to the default value:

Username:

Some protocols (for example, TACACS+) have the ability to override the use of local username prompt information. Using the aaa authentication username-prompt command will not change the username prompt text in these instances.

---

Note   The aaa authentication username-prompt command does not change any dialog that is supplied by a remote TACACS+ server.

---

Example

The following example changes the text for the username prompt:

aaa authentication username-prompt "Enter your name here:"

Related Commands

A dagger (†) indicates that the command is documented outside this chapter.

aaa authentication password-prompt
aaa new-model
enable password ^†

aaa authorization

To set parameters that restrict a user's network access based on TACACS+ authorization, use the aaa authorization command. To disable authorization for a function, use the no form of the command.

aaa authorization {network | connection | exec | command level} methods
no aaa authorization {network | connection | exec | command level}

Syntax Description

network	Authorization is run for all network-related service requests, including SLIP, PPP, PPP NCPs, and ARAP.
connection	Authorization is run for outbound Telnet and rlogin.
exec	Authorization is run to determine if the user is allowed to run an Exec shell. This may return user profile information such as autocommand information.
command	Authorization is run for all commands at the specified privilege level.
level	Specific command level that should be authorized. Valid entries are 0-15.

Default

Authorization is disabled for all actions (equivalent to the keyword none).

Command Mode

Global configuration

Usage Guideline

This command first appeared in Cisco IOS Release 10.0.

---

Note   There are five commands associated with privilege level 0: disable, enable, exit, help, and logout. If you configure AAA authorization for a privilege level greater than 0, these five commands will not be included.

---

Use the aaa authorization command to create a list of one and up to four authorization methods that can be used when a user accesses the specified function. lists the different authorization methods.

---

Note   This command, along with aaa accounting, replaces the tacacs-server suite of commands in previous versions of TACACS.

---

The additional methods of authorization are only used if the previous method returns an error, not if it fails. Specify none as the final method in the command line to have authorization succeed even if all methods return an error.

Table 5-5 AAA Authorization Keyword Descriptions

Keyword	Description
methods	•tacacs+—request authorization information from the TACACS+ server. •if-authenticated—allow the user to access the requested function if the user is authenticated. •none—no authorization is performed. •local—use the local database for authorization.

If authorization is not specifically set for a function, the default is none—no authorization is performed.

The authorization command causes a request packet containing a series of attribute value pairs to be sent to the TACACS daemon as part of the authorization process. The daemon can:

•accept the request as is

•make changes to the request

•refuse the request, and hence, refuse authorization

describes attribute value (AV) pairs associated with the aaa authorization command. Registered users can find more information about TACACS+ and attribute pairs on Cisco Connection Online (CCO).

Table 5-6 Supported TACACS+ AV Pairs 

Attribute	Description	Cisco IOS Release 11.0	Cisco IOS Release11.1	Cisco IOS Release11.2
service=x	The primary service. Specifying a service attribute indicates that this is a request for authorization or accounting of that service. Current values are slip, ppp, arap, shell, tty-daemon, connection, and system. This attribute must always be included.	yes	yes	yes
protocol=x	A protocol that is a subset of a service. An example would be any PPP NCP. Currently known values are lcp, ip, ipx, atalk, vines, lat, xremote, tn3270, telnet, rlogin, pad, vpdn, http, and unknown.	yes	yes	yes
cmd=x	A shell (EXEC) command. This indicates the command name for a shell command that is to be run. This attribute must be specified if service equals "shell." A NULL value indicates that the shell itself is being referred to.	yes	yes	yes
cmd-arg=x	An argument to a shell (EXEC) command. This indicates an argument for the shell command that is to be run. Multiple cmd-arg attributes may be specified, and they are order dependent.	yes	yes	yes
acl=x	ASCII number representing a connection access list. Used only when service=shell.	yes	yes	yes
inacl=x	ASCII identifier for an interface input access list. Used with service=ppp and protocol=ip.	yes	yes	yes
inacl#<n>	ASCII access list identifier for an input access list to be installed and applied to an interface for the duration of the current connect ion. Used with service=ppp and protocol=ip, and service service=ppp and protocol =ipx.	no	no	11.2(4)F
outacl=x	ASCII identifier for an interface output access list. Used with service=ppp and protocol=ip, and service service=ppp and protocol=ipx. Contains an IP output access list for SLIP or PPP/IP (for example, outacl=4). The access list itself must be preconfigured on the router. Per-user access lists do not currently work with ISDN interfaces.	yes (PPP/IP only)	yes	yes
outacl#<n>	ACSII access list identifier for an interface output access list to be installed and applied to an interface for the duration of the current condition. Used with service=ppp and protocol=ip, and service service=ppp and protocol=ipx.	no	no	11.2(4)F
zonelist=x	A numeric zonelist value. Used with service=arap. Specifies an AppleTalk zonelist for ARA (for example, zonelist=5).	yes	yes	yes
addr=x	A network address. Used with service=slip, service=ppp, and protocol=ip. Contains the IP address that the remote host should use when connecting via SLIP or PPP/IP. For example, addr=1.2.3.4.	yes	yes	yes
addr-pool=x	Specifies the name of a local pool from which to get the address of the remote host. Used with service=ppp and protocol=ip. Note that addr-pool works in conjunction with local pooling. It specifies the name of a local pool (which must be preconfigured on the network access server). Use the ip-local pool command to declare local pools. For example: ip address-pool local ip local pool boo 1.0.0.1 1.0.0.10 ip local pool moo 2.0.0.1 2.0.0.20 You can then use TACACS+ to return addr-pool=boo or addr-pool=moo to indicate the address pool from which you want to get this remote node's address.	yes	yes	yes
routing=x	Specifies whether routing information is to be propagated to, and accepted from this interface. Used with service=slip, service=ppp, and protocol=ip. Equivalent in function to the /routing flag in SLIP and PPP commands. Can either be true or false (for example, routing=true).	yes	yes	yes
route	Specifies a route to be applied to an interface. Used with service=slip, service=ppp, and protocol=ip. During network authorization, the route attribute can be used to specify a per-user static route, to be installed by TACACS+ as follows: route="dst_address mask [gateway]" This indicates a temporary static route that is to be applied. dst_address, mask, and gateway are expected to be in the usual dotted-decimal notation, with the same meanings as in the familiar ip route configuration command on a network access server. If gateway is omitted, the peer's address is the gateway. The route is expunged when the connection terminates.	no	yes	yes
route#<n>	Like the route AV pair, this specifies a route to be applied to an interface, but these routes are numbered, allowing multiple routes to be applied. Used with service=ppp and protocol=ip, and service=ppp and protocol=ipx.	no	no	11.2(4)F
timeout=x	The number of minutes before an ARA session disconnects (for example, timeout=60). A value of zero indicates no timeout. Used with service=arap.	yes	yes	yes
idletime=x	Sets a value, in minutes, after which an idle session is terminated. Does not work for PPP. A value of zero indicates no timeout.	no	yes	yes
autocmd=x	Specifies an autocommand to be executed at EXEC startup (for example, autocmd=telnet muruga.com). Used only with service=shell.	yes	yes	yes
noescape=x	Prevents user from using an escape character. Used with service=shell. Can be either true or false (for example, noescape=true).	yes	yes	yes
nohangup=x	Used with service=shell. Specifies the nohangup option. Can be either true or false (for example, nohangup=false).	yes	yes	yes
priv-lvl=x	Privilege level to be assigned for the EXEC. Used with service=shell. Privilege levels range from 0 to 15, with 15 being the highest.	yes	yes	yes
callback-dialstring	Sets the telephone number for a callback (for example: callback-dialstring=408-555-1212). Value is NULL, or a dial-string. A NULL value indicates that the service may choose to get the dialstring through other means. Used with service=arap, service=slip, service=ppp, service=shell. Not valid for ISDN.	no	yes	yes
callback-line	The number of a TTY line to use for callback (for example: callback-line=4). Used with service=arap, service=slip, service=ppp, service=shell. Not valid for ISDN.	no	yes	yes
callback-rotary	The number of a rotary group (between 0 and 100 inclusive) to use for callback (for example: callback-rotary=34). Used with service=arap, service=slip, service=ppp, service=shell. Not valid for ISDN.	no	yes	yes
nocallback-verify	Indicates that no callback verification is required. The only valid value for this parameter is 1 (for example, nocallback-verify=1). Used with service=arap, service=slip, service=ppp, service=shell. There is no authentication on callback. Not valid for ISDN.	no	yes	yes
tunnel-id	Specifies the username that will be used to authenticate the tunnel over which the individual user MID will be projected. This is analogous to the remote name in the vpdn outgoing command. Used with service=ppp and protocol=vpdn.	no	no	yes
ip-addresses	Space-separated list of possible IP addresses that can be used for the end-point of a tunnel. Used with service=ppp and protocol=vpdn.	no	no	yes
nas-password	Specifies the password for the network access server during the L2F tunnel authentication. Used with service=ppp and protocol=vpdn.	no	no	yes
gw-password	Specifies the password for the home gateway during the L2F tunnel authentication. Used with service=ppp and protocol=vpdn.	no	no	yes
rte-ftr-in#<n>	Specifies an input access list definition to be installed and applied to routing updates on the current interface for the duration of the current connection. Used with service=ppp and protocol=ip, and with service=ppp and protocol=ipx.	no	no	11.2(4)F
rte-ftr-out#<n>	Specifies an output access list definition to be installed and applied to routing updates on the current interface for the duration of the current connection. Used with service=ppp and protocol=ip, and with service=ppp and protocol=ipx.	no	no	yes 11.2(4)F
sap#<n>	Specifies static Service Advertising Protocol (SAP) entries to be installed for the duration of a connection. Used with service=ppp and protocol=ipx.	no	no	yes 11.2(4)F
sap-fltr-in#<n>	Specifies an input SAP filter access list definition to be installed and applied on the current interface for the duration of the current connection. Used with service=ppp and protocol=ipx.	no	no	yes 11.2(4)F
sap-fltr-out#<n>	Specifies an output SAP filter access list definition to be installed and applied on the current interface for the duration of the current connection. Used with service=ppp and protocol=ipx.	no	no	11.2(4)F
pool-def#<n>	Used to define IP address pools on the network access server. Used with service=ppp and protocol=ip.	no	no	11.2(4)F
source-ip=x	Used as the source IP address of all VPDN packets generated as part of a VPDN tunnel. This is equivalent to the Cisco vpdn outgoing global configuration command.	no	no	yes

Examples

The following example specifies that TACACS+-style authorization is used for all network-related requests. If this authorization method returns an error (if the TACACS+ server cannot be contacted), no authorization is performed, and the request is successful.

aaa authorization network tacacs+ none

The following example specifies that TACACS+-style authorization is run for level 15 commands. If this authorization method returns an error (if the TACACS+ server cannot be contacted), no authorization is performed, and the request succeeds.

aaa authorization command 15 tacacs+ none

Related Commands

aaa accounting
aaa new-model

aaa new-model

To enable the new AAA access control model that includes TACACS+, issue the aaa new-model global configuration command. Use the no form of the command to disable this functionality.

aaa new-model
no aaa new-model

Syntax Description

This command has no arguments or keywords.

Default

AAA/TACACS+ is not enabled.

Command Mode

Global configuration

Usage Guideline

This command enables the new AAA access control system and TACACS+. If you initialize this functionality and later decide to use TACACS or Extended TACACS, issue the no version of this command and then enable the version of TACACS you want to use.

After enabling AAA/TACACS+ with the aaa new-model command, you must use the tacacs-server key command to set the authentication key used in all TACACS+ communications with the TACACS+ daemon.

Example

The following example initializes AAA and TACACS+:

aaa new-model

Related Commands

aaa accounting
aaa authentication arap
aaa authentication enable default
aaa authentication local-override
aaa authentication login
aaa authentication password-prompt
aaa authentication username-prompt
tacacs-server key

alias

To create a command alias, use the alias global configuration command. Use the no alias command to delete all aliases in a command mode or to delete a specific alias, and to revert to the original command syntax.

alias mode alias-name alias-command-line
no alias mode [alias-name]

Syntax Description

mode	Command mode of the original command and alias commands. See for a list of options for this argument.
alias-name	Command alias.
alias-command-line	Original command syntax.

Defaults

Default aliases are in EXEC mode as follows:

Command Alias	Original Command
h	help
lo	logout
p	ping
r	resume
s	show
w	where

Command Mode

Global configuration

Usage Guidelines

You can use simple words as aliases or abbreviations. The aliases in the Default section are predefined. They can be turned off using the no alias command.

shows the acceptable options for the mode argument in the alias global configuration command.

Table 5-7

Argument Options	Mode
configuration	Global configuration
controller	Controller configuration
exec	EXEC
hub	Hub configuration
interface	Interface configuration
ipx-router	IPX router configuration
line	Line configuration
map-class	Map class configuration
map-list	Map list configuration
route-map	Route map configuration
router	Router configuration

Mode Argument Options

See the summary of command modes in the user interface chapter in the Access and Communication Configuration Guide for more information about command modes.

When you use online help, command aliases are indicated by an asterisk (*), as follows:

Router#lo?

*lo=logout  lock  login  logout 

When you use online help, aliases that contain spaces (for example, "telnet device.cisco.com 25") are displayed as follows:

Router# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Router(config)# alias exec device-mail telnet device.cisco.com 25

Router(config)# end

Router# device-mail?

*device-mail="telnet device.cisco.com 25" 

When you use online help, the alias is expanded and replaced with the original command, as shown in the following example with the "td" alias:

Router(config)# alias exec td trace device

Router(config)# ^Z

Router# t?

*td="trace device"  telnet  terminal  test  tn3270

trace               

To list only commands and omit aliases, begin your input line with a space. In the following example, the alias td is not shown, because there is a space before the t? command line.

Router# t?

telnet  terminal  test  tn3270  trace

As with commands, you can use online help to display the arguments and keywords that can follow a command alias. In the following example, the alias td is created to represent the command telnet device. The /debug and /line switches can be added to telnet device to modify the command:

Router(config)# alias exec td telnet device

Router(config)# ^Z

Router#td ?

      /debug     Enable telnet debugging mode

      /line      Enable telnet line mode

      ...

      whois      Whois port

      <cr>

Router# telnet device

You must enter the complete syntax for the alias command. Partial syntax for aliases are not accepted. In the following example, the parser does not recognize the command t as indicating the alias td.

bones# t

% Ambiguous command:  "t"

Example

In the following example, the alias fixmyrt is created for the EXEC-mode command clear ip route 172.30.116.16.

alias exec fixmyrt clear ip route 172.30.116.16

Related Command

show aliases

arap authentication

To enable TACACS+ authentication for ARA on a line, use the arap authentication command. Use the no form of the command to disable authentication for an ARA line.

arap authentication {default | list-name}
no arap authentication {default | list-name}

Syntax Description

default	Use the default list created with the aaa authentication arap command.
list-name	Use the indicated list created with the aaa authentication arap command.

Default

ARAP authentication uses the default set with aaa authentication arap command. If no default has been set, the local user database is checked.

Command Mode

Line configuration

Usage Guideline

This command is a per-line command, and specifies the name of a list of AAA authentication methods to try at login. If no list is specified, the default list will be used (whether or not it is specified in the command line). Defaults and lists are created by using the aaa authentication arap command. Entering the no version of arap authentication has the same effect as entering the command with the default argument.

Before issuing this command, create a list of authentication processes by using the aaa authentication arap global configuration command.

---

Caution   

If you use a list-name that was not configured with the aaa authentication arap command, ARAP will be disabled on this line.

---

Example

The following example specifies that the TACACS+ authentication list called MIS-access is used on ARA line 7:

line 7

arap authentication MIS-access

Related Command

aaa authentication arap

buffers

Use the buffers global configuration command to make adjustments to initial buffer pool settings and to the limits at which temporary buffers are created and destroyed. Use the no buffers command to return the buffers to their default size.

buffers {small | middle | big | verybig | large | huge | type number} {permanent | max-free
| min-free | initial} number
no buffers {small | middle | big | verybig | large | huge | type number} {permanent | max-free
| min-free | initial} number

Syntax Description

small	Buffer size of this public buffer pool is 104 bytes.
middle	Buffer size of this public buffer pool is 600 bytes.
big	Buffer size of this public buffer pool is 1524 bytes.
verybig	Buffer size of this public buffer pool is 4520 bytes.
large	Buffer size of this public buffer pool is 5024 bytes.
huge	Default buffer size of this public buffer pool is 18024 bytes. This value can be configured with the buffers huge size command.
type	Interface type of the interface buffer pool. Value cannot be fddi.
number	Interface number of the interface buffer pool.
permanent	Number of permanent buffers that the system tries to create and keep. Permanent buffers are normally not trimmed by the system.
max-free	Maximum number of free or unallocated buffers in a buffer pool.
min-free	Minimum number of free or unallocated buffers in a buffer pool.
initial	Number of additional temporary buffers that are to be allocated when the system is reloaded. This keyword can be used to ensure that the system has necessary buffers immediately after reloading in a high-traffic environment.
number	Number of buffers to be allocated.

Default

The default number of the buffers in a pool is determined by the hardware configuration and can be displayed with the EXEC show buffers command.

Command Mode

Global configuration

Usage Guidelines

It is normally not necessary to adjust these parameters; do so only after consulting with technical support personnel. Improper settings could adversely impact system performance.

Buffer pool allocation is a user tunable parameter. The buffer pool to tune depends on the type of encapsulation used by the interfaces. Correspondingly, the ring size changes with the size of the buffer required.

Examples

In the following example, the system will try to keep at least 50 small buffers free:

buffers small min-free 50

In the following example, the permanent buffer pool allocation for big buffers is increased to 200. On a Cisco 2509 1E2T box using HDLC encapsulation, there are four receive rings, each of 32 entries. The cache size is 32 buffers. The MTU for this sort of encapsulation is below 1524 bytes (the same as for Ethernet) which means that you must use buffers from the "big" pool. The basic number of "big" buffers required is (2 + 1) * 32 = 96. Adding a bit of "comfort" space, the following command can then be used:

buffers big permanent 100

The above example shows approximate figures.

In the following example, the initial and permanent interface buffer pools are set to 100:

buffers ethernet 0 initial 100

buffers ethernet 0 permanent 100

Related Commands

buffers huge size
show buffers

buffers huge size

Use the buffers huge size global configuration command to dynamically resize all huge buffers to the value you specify. Use the no buffers huge size command to restore the default buffer values.

buffers huge size number
no buffers huge size number

Syntax Description

number

Number of buffers to be allocated

Default

18024 buffers

Command Mode

Global configuration

Usage Guidelines

Use this command only after consulting with technical support personnel. The buffer size cannot be lowered below the default.

Example

In the following example, the system will resize huge buffers to 20000 bytes:

buffers huge size 20000

Related Commands

buffers
show buffers

cdp enable

To enable CDP on an interface, use the cdp enable interface configuration command. Use the no cdp enable command to disable CDP on an interface.

cdp enable
no cdp enable

Syntax Description

This command has no arguments or keywords.

Default

Disabled

Command Mode

Interface configuration

Usage Guidelines

CDP is enabled by default at the global level, but it must be enabled on each interface in order to send or receive CDP information.

Example

In the following example, CDP is enabled on Ethernet interface 0:

interface ethernet 0

cdp enable

Related Command

cdp run

cdp holdtime

To specify the amount of time the receiving device should hold a CDP packet from your access server before discarding it, use the cdp holdtime global configuration command. Use the no cdp holdtime command to revert to the default setting.

cdp holdtime seconds
no cdp holdtime

Syntax Description

seconds

Specifies the hold time to be sent in the CDP update packets.

Default

180 seconds

Command Mode

Global configuration

Usage Guidelines

CDP packets are sent with time-to-live, or hold time, that is nonzero after an interface is enabled and a hold time of 0 immediately before an interface is idled down.

The CDP hold time must be set to a higher number of seconds than the time between CDP transmissions, which is set using the cdp timer command.

Example

In the following example, the CDP packets being sent from your device should be held by the receiving device for 60 seconds before being discarded. You might want to set the hold time lower than the default setting of 180 seconds if information about your device changes often and you want the receiving devices to purge this information more quickly.

cdp holdtime 60

Related Commands

cdp timer
show cdp

cdp run

To enable CDP on your access server, use the cdp run global configuration command. Use the no cdp run command to disable CDP.

cdp run
no cdp run

Syntax Description

This command has no arguments or keywords.

Default

Enabled

Command Mode

Global configuration

Usage Guidelines

CDP is enabled on your access server by default, which means the access server will receive CDP information. However, to receive CDP packets it must be enabled on interfaces, using the cdp enable interface configuration command.

Example

In the following example, CDP is disabled for the access server.

no cdp run

Related Command

cdp enable

cdp timer

To specify how often your access server will send CDP updates, use the cdp timer global configuration command. Use the no cdp timer command to revert to the default setting.

cdp timer seconds
no cdp timer

Syntax Description

seconds

Specifies how often your access server will send CDP updates.

Default

60 seconds

Command Mode

Global configuration

Usage Guidelines

The trade-off with sending more frequent transmissions is providing up-to-date information versus using bandwidth more often.

Example

In the following example, CDP updates will be sent from your access server every 80 seconds, less frequently than the default setting of 60 seconds. You might want to make this change if you are concerned about preserving bandwidth.

cdp timer 80

Related Commands

cdp holdtime
show cdp

clear cdp counters

To reset CDP traffic counters to zero (0) on your access server, use the clear cdp counters privileged EXEC command.

clear cdp counters

Syntax Description

This command has no arguments or keywords.

Command Mode

Privileged EXEC

Example

In the following example, the CDP counters have been cleared. The show cdp traffic output shows that all of the traffic counters have been reset to zero (0).

Router# clear cdp counters

Router# show cdp traffic 

CDP counters :

        Packets output: 0, Input: 0

        Hdr syntax: 0, Chksum error: 0, Encaps failed: 0

        No memory: 0, Invalid packet: 0, Fragmented: 0

Related Commands

show cdp traffic
clear cdp table

clear cdp table

To clear the table that contains CDP information about neighbors, use the clear cdp table privileged EXEC command.

clear cdp table

Syntax Description

This command has no arguments or keywords.

Command Mode

Privileged EXEC

Example

In the following example, the CDP table is cleared. The output of the show cdp neighbors command shows that all information has been deleted from the table.

Router# clear cdp table  

CDP-AD: Deleted table entry for neon.cisco.com, interface Ethernet0

CDP-AD: Deleted table entry for neon.cisco.com, interface Serial0

Router# show cdp neighbors 

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

                  S - Switch, H - Host, I - IGMP

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID

Related Commands

clear cdp counters
show cdp neighbors

clock set

To manually set the system clock, use the clock set EXEC command.

clock set hh:mm:ss day month year
clock set hh:mm:ss month day year

Syntax Description

hh:mm:ss	Current time in hours (military format), minutes, and seconds.
day	Current day (by date) in the month.
month	Current month (by name).
year	Current year (no abbreviation).

Command Mode

EXEC

Usage Guidelines

Generally, if the system is synchronized by a valid outside timing mechanism, such as an NTP clock source, you need not set the system clock. Use this command if no other time sources are available. The time specified in this command is relative to the configured time zone.

Example

In the following example, the system clock is manually set to 1:32 p.m. on July 23, 1993:

clock set 13:32:00 23 July 1993

Related Commands

calendar set
clock summer-time
clock timezone

clock summer-time

To configure the system to switch to summer time (daylight savings time) automatically, use one of the formats of the clock summer-time global configuration command. Use the no form of this command to configure the access server not to automatically switch to summer time.

clock summer-time zone recurring [week day month hh:mm week day month hh:mm [offset]]
clock summer-time zone date date month year hh:mm date month year hh:mm [offset]
clock summer-time zone date month date year hh:mm month date year hh:mm [offset]
no clock summer-time

Syntax Description

zone	Name of the time zone (PDT, ...) to be displayed when summer time is in effect.
week	Week of the month (1 to 5 or last).
day	Day of the week (Sunday, Monday ...).
date	Date of the month (1 to 31).
month	Month (January, February, ...).
year	Year (1993 to 2035).
hh:mm	Time (military format) in hours and minutes.
offset	(Optional) Number of minutes to add during summer time (default is 60).

Default

Summer time is disabled. If clock summer-time zone recurring is specified without parameters, the summer time rules default to United States rules. Default of offset is 60.

Command Mode

Global configuration

Usage Guidelines

Use this command if you want to automatically switch to summer time (for display purposes only). Use the recurring form of the command if the local summer time rules are of this form. Use the date form to specify a start and end date for summer time if you cannot use the first form.

In both forms of the command, the first part of the command specifies when summer time begins, and the second part specifies when it ends. All times are relative to the local time zone. The start time is relative to standard time. The end time is relative to summer time. If the starting month is after the ending month, the system assumes that you are in the Southern Hemisphere.

Examples

In the following example, summer time starts on the first Sunday in April at 02:00 and ends on the last Sunday in October at 02:00:

clock summer-time PDT recurring 1 Sunday April 2:00 last Sunday October 2:00

If you live in a place where summer time does not follow the pattern in the first example, you could set it to start on October 12, 1993 at 02:00, and end on April 28, 1994 at 02:00, with the following example:

clock summer-time date 12 October 1993 2:00 28 April 1994 2:00

Related Commands

calendar set
clock timezone

clock timezone

To set the time zone for display purposes, use the clock timezone global configuration command. To set the time to Coordinated Universal Time (UTC), use the no clock timezone command.

clock timezone zone hours [minutes]
no clock timezone

Syntax Description

zone	Name of the time zone to be displayed when standard time is in effect
hours	Hours offset from UTC
minutes	(Optional) Minutes offset from UTC

Default

UTC

Command Mode

Global configuration

Usage Guidelines

The system internally keeps time in UTC, so this command is used only for display purposes and when the time is manually set.

Example

In the following example, the time zone is set to Pacific Standard Time and is offset 8 hours behind UTC:

clock timezone PST -8

Related Commands

clock set
clock summer-time
show clock

custom-queue-list

To assign a custom queue list to an interface, use the custom-queue-list interface configuration command. To remove a specific list or all list assignments, use the no form of this command.

custom-queue-list list
no custom-queue-list [list]

Syntax Description

list	Number of the custom queue list you want to assign to the interface. An integer from 1 to 10.

Default

No custom queue list is assigned.

Command Mode

Interface configuration

Usage Guidelines

You can assign only one queue list per interface. Use this command in place of the priority-list command (not in addition to it). Custom queuing allows a fairness that is not provided with priority queuing. With custom queuing, you can control the interfaces' available bandwidth when it is unable to accommodate the aggregate traffic enqueued. Associated with each output queue is a configurable byte count, which specifies how many bytes of data should be delivered from the current queue by the system before the system moves on to the next queue. When a particular queue is being processed, packets are sent until the number of bytes sent exceeds the queue byte count or until the queue is empty.

Example

In the following example, custom queue list number 3 is assigned to serial interface 0:

interface serial 0

custom-queue-list 3

Related Commands

queue-list default
queue-list interface
queue-list protocol
queue-list queue byte-count
queue-list queue limit
queue-list stun

downward-compatible-config

To have the access server try to generate a configuration that is compatible with an earlier Cisco IOS release, use the downward-compatible-config global configuration command. To remove this feature, use the no form of this command.

downward-compatible-config version
no downward-compatible-config

Syntax Description

version

Cisco IOS Release number, not earlier than 10.2.

Default

Disabled

Command Mode

Global configuration

Usage Guidelines

In Cisco IOS Release 10.3, the IP access list formats changed. Use this command to regenerate a configuration in the format prior to Release 10.3 if you are going to downgrade from a Release 10.3 or later to an earlier release. The earliest release this command accepts is 10.2.

When this command is configured, the access server attempts to generate a configuration that is compatible with the specified version. Currently, this command affects only IP access lists.

Under some circumstances, the software might not be able to generate a fully backward-compatible configuration. In such a case, the software issues a warning message any time it tries to write a configuration that is not downward compatible.

Example

In the following example, the access server will attempt to generate a configuration file compatible with Cisco IOS Release 10.2:

downward-compatible-config 10.2

Related Commands

A dagger (†) indicates that the command is documented in another chapter.

access-list (extended)†
access-list (standard)†

enable last-resort

To specify what happens if the TACACS servers used by the enable command do not respond, use the enable last-resort global configuration command. The no form of this command restores the default.

enable last-resort {password | succeed}
no enable last-resort

Syntax Description

password	Allows users to enable by entering the privileged command level password.
succeed	Allows users to enable without further question.

Default

Default action is to fail.

Command Mode

Global configuration

Usage Guideline

The secondary authentication is used only if the first attempt failed. The second authentication will not occur if the first authentication was only unsuccessful.

---

Note   This command is not used in AAA/TACACS+ and has been replaced by the
aaa authentication suite of commands.

---

Example

In the following example, if the TACACS servers do not respond to the enable command, the user can enable by entering the privileged level password:

enable last-resort password

Related Command

A dagger (†) indicates that the command is documented in another chapter.

enable †

enable password

Use the enable password global configuration command to set a local password to control access to various privilege levels. Use the no form of this command to remove the password requirement.

enable password [level level] {password}
enable password [level level] {encryption-type encrypted-password}
no enable password [level]

Syntax Description

level level	(Optional) Level for which the password applies. You can specify up to sixteen privilege levels, using numbers 0 through 15. Level 1 is normal EXEC-mode user privileges. If this argument is not specified, the privilege level defaults to 15 (traditional enable privileges). The same holds true for the no form of the command.
password	The enable password password as you would type it when enabling. This password should be different from the password created with the enable secret command. If you have the service password-encryption flag set, when the router displays the password for you later it will be displayed encrypted (an encrypted form of what you typed).
encryption-type	(Optional) The Cisco-proprietary algorithm used to encrypt the password. Currently the only encryption type available is 7 . If you specify encryption-type, the next argument you supply must be an encrypted password (a password already encrypted by a Cisco router).
encrypted-password	An encrypted password you enter, copied from another router configuration.

Default

No password is defined.

Command Mode

Global configuration

Usage Guidelines

You will not ordinarily enter an encryption type. Typically you enter an encryption type only if you copy and paste back into this command a password that has already been encrypted by a Cisco router.

---

Caution   If you specify an encryption type and then enter a clear-text password, you will not be able to re-enter enable mode. You cannot recover a lost password that has been encrypted by any method.

---

Use this command with the level option to define a password for a specific privilege level. Once the level and the password are specified, give the password to the users you want to have access at this level. Use the privilege level (global) configuration command to specify commands accessible at various level.

Enable or disable password encryption with the service password-encryption command.

An enable password can contain from 1 to 80 uppercase and lowercase alphanumeric characters. The first character cannot be a number. Some spaces are valid password characters; for example, "two words" is valid. Leading spaces are ignored, but trailing spaces are recognized. For example "woolly" is interpreted as "woolly" (without the space), while "woolly " is interpreted as "woolly " (with the space). To create an enable password containing a question mark (?), precede the question mark with the keystrokes Ctrl-V. For example, to create the password "abc?123", you enter the letters abc followed by Ctrl-V followed by ? followed by the numbers 123. When the system prompts you to enter the enable password, you need not precede the question mark with the Ctrl-V; you can simply enter abc?123 at the password prompt.

Example

In the following example, the password pswd2 is enabled for privilege level 2:

enable password level 2 pswd2

In the following example the encrypted password Xyti5Rkls3LoyxzS8t9, which has been copied from a router configuration file, is set for privilege level 2 using encryption type 7:

enable password level 2 7 Xyti5Rkls3LoyxzS8t9

Related Commands

A dagger (†) indicates that the command is documented outside this chapter.

disable †
enable †
privilege level (global)
service password-encryption
show privilege

enable secret

Use the enable secret command to specify an additional layer of security over the enable password command. Use the no form of the command to turn off the enable secret function.

enable secret [level level] {password}
enable secret [level level] {encryption-type encrypted-password}
no enable secret [level level]

Syntax Description

level level	(Optional) Level for which the password applies. You can specify up to sixteen privilege levels, using numbers 0 through 15. Level 1 is normal EXEC-mode user privileges. If this argument is not specified, the privilege level defaults to 15 (traditional enable privileges). The same holds true for the no form of the command.
password	The enable secret password—the password you would type when enabling. This password should be different from the password created with the enable password command. When the router displays the password for you later, it will be displayed encrypted (an encrypted form of what you typed).
encryption-type	(Optional) The Cisco-proprietary algorithm used to encrypt the password. Current the only encryption type available for this command is 5 . If you specify encryption-type, the next argument you supply must be an encrypted password (a password encrypted by a Cisco router).
encrypted password	An encrypted password you enter, copied from another router configuration.

Default

Disabled

Command Mode

Global configuration

Usage Guidelines

You will not ordinarily enter an encryption type. Typically you enter an encryption type only if you paste back into this command an encrypted password that you copied from a router configuration file.

---

Caution   If you specify encryption-type and then enter a clear-text password, you will not be able to re-enter enable mode. You cannot recover a lost password that has been encrypted by any method.

---

The enable secret command is used in conjunction with the enable password command to provide an additional layer of security over the enable password. This scheme provides better security by storing the enable secret using a non-reversible cryptographic function.

This added layer of security is useful in environments where the password crosses the network or is stored on a TFTP server.

If you use the same password for enable password and enable secret, you receive an error message warning that this practice is not recommended; but the password will be accepted. By using the same password, however, you undermine the additional security the enable secret command provides.

---

Note   After you set a password using enable secret, a password set using the enable password command will no longer work unless enable secret is disabled or an older version of Cisco IOS software is being used, such as when running an older rxboot image. Additionally, you cannot recover a lost password that has been encrypted by any method.

---

Examples

The following example specifies an enable secret password of gobbledegook:

enable secret gobbledegook

After specifying an enable secret password, users must enter this password to gain access. Any passwords set through enable password will no longer work.

Password: gobbledegook

In the following example the encrypted password Xyti5Rkls3LoyxzS8t9, which has been copied from a router configuration file, is enabled for privilege level 2 using encryption type 5:

enable password level 2 5 $1$FaD0$Xyti5Rkls3LoyxzS8t98j2

Related Commands

A dagger (†) indicates that the command is documented outside this chapter.

enable †
enable password

enable use-tacacs

To enable use of TACACS to determine whether a user can access the privileged command level, use the enable use-tacacs global configuration command. Use the no enable use-tacacs command to disable TACACS verification.

enable use-tacacs
no enable use-tacacs

Syntax Description

This command has no arguments or keywords.

Default

Disabled

Command Mode

Global configuration

Usage Guidelines

When you add this command to the configuration file, the EXEC enable command prompts for a new username and password pair. This pair is then passed to the TACACS server for authentication. If you are using extended TACACS, it also will pass any already-existing UNIX user identification code to the server.

---

Note   This command initializes TACACS. Use the tacacs-server directed-request command to initialize Extended TACACS, or use the aaa new-model command to initialize AAA/TACACS+.

---

---

Caution   

If you use the enable use-tacacs command, you must also use the tacacs-server authenticate enable command, or else you will be locked out of the access server.

---

Example

The following example sets TACACS verification on the privileged EXEC-level login sequence:

enable use-tacacs

tacacs-server authenticate enable

Related Command

tacacs-server authenticate

fair-queue

To enable weighted fair queuing for an interface and to set the congestion threshold after which messages for high-bandwidth conversations are dropped, use the fair-queue interface configuration command. To disable weighted fair queuing for an interface, use the no form of this command.

fair-queue congestive-discard-threshold-number
no fair-queue

Syntax Description

congestive-discard-threshold-number

Number of messages creating a congestion threshold after which new messages for high-bandwidth conversations are no longer enqueued. Valid values are 1 to 512 inclusive. The congestive-discard threshold default is 64 messages.

Default

Fair queuing is enabled by default for physical interfaces whose bandwidth is less than or equal to 2.048 megabits per second (Mbps) and that do not use Link Access Procedure, Balanced (LAPB), X.25, PPP, or Synchronous Data Link Control (SDLC) encapsulations. (Fair queuing is not an option for these protocols.) However, if custom queuing or priority queuing is enabled for a qualifying link, it overrides fair queuing, effectively disabling it. Additionally, fair queuing is automatically disabled if you enable autonomous switching.

The congestive-discard threshold is 64 messages.

Command Mode

Interface configuration

Usage Guidelines

When enabled for an interface, weighted fair queuing provides traffic priority management that automatically sorts among individual traffic streams without requiring that you first define access lists. Enabling weighted fair queuing requires use of this command only.

Weighted fair queuing can manage duplex data streams, such as those between pairs of applications, and simplex data streams such as voice or video. From the perspective of weighted fair queuing, there are two categories of sessions: high-bandwidth sessions and low-bandwidth sessions. Low-bandwidth traffic has effective priority over high-bandwidth traffic, and high-bandwidth traffic shares the transmission service proportionally according to assigned weights.

When weighted fair queuing is enabled for an interface, new messages for high-bandwidth traffic streams are discarded after the configured or default congestive-messages threshold has been met. However, low-bandwidth conversations, which include control-message conversations, continue to enqueue data. As a result, the fair queue may occasionally contain more messages than its configured threshold number specifies.

Weighted fair queuing uses a traffic data stream discrimination registry service to determine which traffic stream a message belongs to. For each forwarding protocol, shows the attributes of a message that are used to classify traffic into data streams.

Table 5-8 Weighted Fair Queuing Traffic Stream Discrimination Fields

Forwarder	Fields Used
AppleTalk	•Source net, node, socket •Destination net, node, socket •Type
DECnet	•Source address •Destination address
Frame Relay switching	•DLCI value
DDN IP	•TOS •IP Protocol •Source IP address (if message is not fragmented) •Destination IP address (if message is not fragmented) •Source TCP/UDP port •Destination TCP/UDP port
All others (default)	Value of pak -> linktype

It is important to note that IP precedence, congestion in Frame Relay switching, and discard eligibility flags affect the weights used for queuing.

IP precedence, which is set by the host, is a number in the range of 0 to 7. Data streams of precedence number are weighted so that they are given an effective bit rate of number+1 times as fast as a data stream of precedence 0, which is normal.

In Frame Relay switching, message flags for congestion (FECN and BECN) and discard eligible (DE) message flags cause the algorithm to select weights that effectively impose reduced queue priority, providing the application with "slow down" feedback and sorting traffic, giving the best service to applications within their Committed Information Rate.

Fair queuing is supported for all LAN and line (WAN) protocols except those that use LAPB, which are listed in "Default." Because tunnels are software interfaces that are themselves routed over physical interfaces, fair queuing is not supported for tunnels. If fair queuing is configured for an interface, the default of no fair-queue is applied for these links and tunnels on the interface and appears in the configuration script for them.

---

Note   For Release 10.3 and earlier, if you used the tx-queue-limit command to set the transmit (tx-queue) limit available to an interface on an MCI or SCI card and you configured custom queuing or priority queuing for that interface, the configured transmit (tx-queue) limit was automatically overridden and set to 1. With this release, for weighted fair queuing, custom queuing, and priority queuing, the transmit (tx-queue) limit is derived from the bandwidth value set for the interface using the bandwidth command. Bandwidth value/ 512 rounded up yields the effective transmit (tx-queue) limit. However, the derived value only applies in the absence of a tx-queue-limit command; that is, a configured transmit (tx-queue) limit overrides this derivation.

---

Example

The following example enables use of weighted fair queuing on Serial 0, with a congestive discard threshold of 300. This means that messages will be discarded from the queuing system only when 300 or more messages have been queued and the message is in a data stream that has more than one message in the queue. The transmit queue limit is set to 1, based on the 384-kilobit (kb) line set by the bandwidth command:

interface Serial 0

bandwidth 384

fair-queue 300

hostname

To specify or modify the host name for the network server, use the hostname global configuration command.

hostname name

Syntax Description

name	New host name for the network server; the name is case sensitive.

Default

The factory-assigned default host name is cs.

Command Mode

Global configuration

Usage Guidelines

The order of display at startup is the message-of-the-day (MOTD) banner, then login and password prompts, then the EXEC banner.

The host name is used in prompts and default configuration filenames. The setup command facility also prompts for a host name at startup.

Example

The following example changes the host name to sandbox:

hostname sandbox

ip tacacs source-interface

To use the IP address of a specified interface for all outgoing TACACS packets, use the ip tacacs source-interface global configuration command. Use the no form of this command to disable use of the specified interface IP address.

ip tacacs source-interface subinterface-name
no ip tacacs source-interface

Syntax Description

subinterface-name

Name of the interface that TACACS uses for all of its outgoing packets.

Default

This command has no factory-assigned default.

Command Mode

Global configuration

Usage Guidelines

Use this command to set a subinterface's IP address for all outgoing TACACS packets. This address is used as long as the interface is in the up state. In this way, the TACACS server can use one iP address entry associated with the network access client instead of maintaining a list of all IP addresses.

This command is especially useful in cases where the router has many interfaces and you want to ensure that all TACACS packets from a particular router have the same IP address.

The specified interface must have an IP address associated with it. If the specified subinterface does not have an IP address or is in a down state, TACACS reverts to the default. To avoid this, add an IP address to the subinterface or bring the interface to the up state.

Example

The following example makes TACACS use the IP address of subinterface s2 for all outgoing TACACS (TACACS, Extended TACACS, or TACACS+) packets:

ip tacacs source-interface s2

Related Commands

You can use the master indexes or search online to find documentation of related commands.

ip radius source-interface
ip telnet source-interface
ip tftp source-interface

load-interval

To change the length of time for which data is used to compute load statistics, use the load-interval interface configuration command. Use the no load-interval command to revert to the default setting.

load-interval seconds
no load-interval seconds

Syntax Description

seconds

Length of time for which data is used to compute load statistics. A value that is a multiple of thirty, between 30 and 600 (30, 60, 90, 120, and so forth).

Default

300 seconds (or 5 minutes)

Command Mode

Interface configuration

Usage Guidelines

If you want load computations to be more reactive to short bursts of traffic rather than averaged over five-minute periods, you can shorten the length of time over which load averages are computed.

If the load interval is set to thirty seconds, new data is used for load calculations over a thirty-second period. This data is used to compute load statistics, including input rate in bits and packets per second, output rate in bits and packets per second, load, and reliability.

Load data is gathered every five seconds on the access server. This data is used for a weighted average calculation in which more-recent load data has more weight in the computation than older load data. If the load interval is set to thirty seconds, the average is computed for the last thirty seconds of load data.

The load-interval command allows you to change the default interval five minutes to a shorter or longer period of time. If you change it to a shorter period of time, the input and output statistics that are displayed when you use the show interface command will be more current and based on more instantaneous data rather than reflecting a more average load over a longer period of time.

This command is often used for dial backup purposes to increase or decrease the likelihood of a backup interface being implemented, but it can be used on any interface.

Example

In the following example, the default five-minute average is set it to a thirty-second average. A burst in traffic that would not trigger a dial backup for an interface configured with the default five-minute interval might trigger a dial backup for this interface that is set for a shorter, thirty-second interval.

interface serial 0

load-interval 30

Related Command

A dagger (†) indicates that the command is documented in another chapter.

show interface†

logging

To log messages to a syslog server host, use the logging global configuration command. The no logging command deletes the syslog server with the specified address from the list of syslogs.

logging host
no logging host

Syntax Description

host	Name or IP address of the host to be used as a syslog server

Default

No messages are logged to a syslog server host.

Command Mode

Global configuration

Usage Guidelines

This command identifies a syslog server host to receive logging messages. By issuing this command more than once, you build a list of syslog servers that receive logging messages.

Example

The following example logs messages to a host named johnson:

logging johnson

Related Commands

logging trap
service timestamps

logging buffered

To log messages to an internal buffer, use the logging buffered global configuration command. The no logging buffered command cancels the use of the buffer and writes messages to the console terminal, which is the default.

logging buffered
no logging buffered

Syntax Description

This command has no arguments or keywords.

Default

The access server displays all messages to the console terminal.

Command Mode

Global configuration

Usage Guidelines

This command copies logging messages to an internal buffer instead of writing them to the console terminal. The buffer is circular in nature, so newer messages overwrite older messages.

To display the messages that are logged in the buffer, use the EXEC command show logging. The first message displayed is the oldest message in the buffer.

Example

The following example illustrates how to enable logging to an internal buffer:

logging buffered

logging console

To limit messages logged to the console based on severity, use the logging console global configuration command. To disable logging to the console terminal, use the no form of the command.

logging console level
no logging console

Syntax Description

level

Limits the logging of messages displayed on the console terminal to the specified level and levels below it. See for a list of the level keywords.

Default

The debugging level

Command Mode

Global configuration

Usage Guidelines

Specifying one of the level names shown in causes messages at that level and numerically lower levels to be displayed at the console terminal.

The EXEC command show logging displays the addresses and levels associated with the current logging setup, as well as any other logging statistics.

Table 5-9 Error Message Logging Priorities

Level Name	Level	Description	Syslog Definition
emergencies	0	System unusable	LOG_EMERG
alerts	1	Immediate action needed	LOG_ALERT
critical	2	Critical conditions	LOG_CRIT
errors	3	Error conditions	LOG_ERR
warnings	4	Warning conditions	LOG_WARNING
notifications	5	Normal but significant condition	LOG_NOTICE
informational	6	Informational messages only	LOG_INFO
debugging	7	Debugging messages	LOG_DEBUG

Example

The following example changes the level of messages displayed to the console terminal to alerts, which means alerts and emergencies are displayed:

logging console alerts

Related Command

logging facility

logging facility

To configure the syslog facility in which error messages are sent, use the logging facility global configuration command. To revert to the default of local7, use the no form of this command.

logging facility facility-type
no logging facility

Syntax Description

facility-type

Logging facility type. See for the facility-type keywords.

Default

local7

Command Mode

Global configuration

Usage Guidelines

Table 5-10 Logging Facility Facility-Type Keywords

Keyword	Description
auth	Authorization system
cron	Cron facility
daemon	System daemon
kern	Kernel
local0-7	Reserved for locally defined messages
lpr	Line printer system
mail	Mail system
news	USENET news
sys9	System use
sys10	System use
sys11	System use
sys12	System use
sys13	System use
sys14	System use
syslog	System log
user	User process
uucp	UNIX-to-UNIX copy system

Example

The following example configures the syslog facility to Kernel:

logging facility kern

Related Command

logging console

logging monitor

To limit messages logged to the terminal lines (monitors) based on severity, use the logging monitor global configuration command. Use the no form of this command to disable logging to terminal lines other than the console line.

logging monitor level
no logging monitor

Syntax Description

level

One of the level keywords listed in

Default

debugging

Command Mode

Global configuration

Usage Guidelines

Specifying a level causes messages at that level and numerically lower levels to be displayed to the monitor.

This command limits the logging messages displayed on terminal lines other than the console line to messages with a level at or above the specified level.

Example

The following example specifies that only messages of the levels errors, critical, alerts, and emergencies be displayed on terminals:

logging monitor errors

logging on

To control logging of error messages, use the logging on global configuration command. This command enables or disables message logging to all destinations except the console terminal. The no logging on command enables logging to the console terminal only.

logging on
no logging on

Syntax Description

This command has no arguments or keywords.

Default

The access server logs messages to the console terminal.

Command Mode

Global configuration

Example

The following example shows how to direct error messages to the console terminal only:

no logging on

logging synchronous

To synchronize unsolicited messages and debug output with solicited system output and prompts for a specific line, use the logging synchronous line configuration command. To disable this capability, use the no form of this command.

logging synchronous [level severity-level | all] [limit number-of-buffers]
no logging synchronous [level severity-level | all] [limit number-of-buffers]

Syntax Description

level severity-level-number	(Optional) Message severity level. Messages with a severity level equal to or higher than this value are printed asynchronously. When specifying a severity level number, consider that for the logging system, low numbers indicate greater severity and high numbers indicate lesser severity. The default value is 2.
all	(Optional) Specifies that all messages are printed asynchronously, regardless of the severity level.
limit number-of-buffers	(Optional) Number of buffers to be queued for the terminal after which new messages are dropped. The default value is 20.

Defaults

This feature is turned off by default.

If you do not specify a severity level, the default value of 2 is assumed.

If you do not specify the maximum number of buffers to be queued, the default value of 20 is assumed.

Command Mode

Line configuration

Usage Guidelines

When synchronous logging of unsolicited messages and debug output is turned on, unsolicited router output is displayed on the console or printed after solicited router output is displayed or printed. Unsolicited messages and debug output is displayed on the console after the prompt for user input is returned. This is to keep unsolicited messages and debug output from being interspersed with solicited router output and prompts. After the unsolicited messages are displayed, the console displays the user prompt again.

When specifying a severity level number, consider that for the logging system, low numbers indicate greater severity and high numbers indicate lesser severity.

When a terminal line's message-queue limit is reached, new messages are dropped from the line, although these messages might be displayed on other lines. If messages are dropped, the notice "%SYS-3-MSGLOST number-of-messages due to overflow" follows any messages that are displayed. This notice is displayed only on the terminal that lost the messages. It is not sent to any other lines, any logging servers, or the logging buffer.

---

Caution   

By configuring abnormally large message-queue limits and setting the terminal to "terminal monitor" on a terminal that is accessible to intruders, you expose yourself to "denial of service" attacks. An intruder could carry out the attack by putting the terminal in synchronous output mode, making a Telnet connection to a remote host, and leaving the connection idle. This could cause large numbers of messages to be generated and queued, and these messages would consume all available RAM. Although unlikely to occur, you should guard against this type of attack through proper configuration.

---

Example

The following example identifies a line and configures synchronous logging for that line, then it does this for another line:

line 0 4 
logging synchronous level 6

line 2

logging synchronous level 7 limit 70000

Related Command

A dagger (†) indicates that the command is documented in another chapter.

line † 

logging trap

To limit messages logged to the syslog servers based on severity, use the logging trap global configuration command. Use the no form of this command to disable logging to syslog servers.

logging trap level
no logging trap

Syntax Description

level

One of the level keywords listed in

Default

informational

Command Mode

Global configuration

Usage Guidelines

The EXEC command show logging displays the addresses and levels associated with the current logging setup. The command output also includes ancillary statistics. This command limits the logging of error messages sent to syslog servers to only those messages at the specified level.

lists the syslog definitions that correspond to the debugging message levels. Additionally, there are four categories of messages generated by the software, as follows:

•Error messages about software or hardware malfunctions at the LOG_ERR level

•Output for the debug commands at the LOG_WARNING level

•Interface up/down transitions and system restarts at the LOG_NOTICE level

•Reload requests and low process stacks are at the LOG_INFO level

Use the logging and logging trap commands to send messages to a UNIX syslog server.

Example

The following example logs messages to a host named johnson and limits messages logged to the syslog server.

logging johnson 
logging trap notifications

Related Command

logging

login authentication

To enable TACACS+ authentication for logins, use the login authentication command. Use the no form of the command to return to the default.

login authentication {default |list-name}
no login authentication {default | list-name}

Syntax Description

default	Uses the default list created with the aaa authentication login command.
list-name	Uses the indicated list created with the aaa authentication login command.

Default

Uses the default set with aaa authentication login.

Command Mode

Line configuration

Usage Guideline

This command is a per-line command used with AAA, and specifies the name of a list of TACACS+ authentication methods to try at login. If no list is specified, the default list will be used (whether or not it is specified in the command line). Defaults and lists are created by using the aaa authentication login command. Entering the no version of login authentication has the same effect as entering the command with the default argument.

Before issuing this command, create a list of authentication processes by using the global configuration aaa authentication login command.

---

Caution   

If you use a list-name that was not configured with the aaa authentication login command, you will disable login on this line.

---

Examples

The following example specifies that the default AAA authentication is to be used on line 4:

line 4

login authentication default

The following example specifies that the AAA authentication list called MIS-access is to be used on line 7:

line 7

login authentication MIS-access

Related Command

aaa authentication login

ntp access-group

To control access to the system's Network Time Protocol (NTP) services, use the ntp access-group global configuration command. To remove access control to the system's NTP services, use the no form of this command.

ntp access-group {query-only | serve-only | serve | peer} access-list-number
no ntp access-group {query-only | serve-only | serve | peer}

Syntax Description

query-only	Allows only NTP control queries. See RFC 1305 (NTP version 3).
serve-only	Allows only time requests.
serve	Allows time requests and NTP control queries, but does not allow the system to synchronize to the remote system.
peer	Allows time requests and NTP control queries and allows the system to synchronize to the remote system.
access-list-number	Number (1 to 99) of a standard IP access list.

Default

No access control (full access granted to all systems)

Command Mode

Global configuration

Usage Guidelines

The access group options are scanned in the following order from least restrictive to most restrictive:

1 peer

2 serve

3 serve-only

4 query-only

Access is granted for the first match that is found. If no access groups are specified, all access is granted to all sources. If any access groups are specified, only the specified access is granted. This facility provides minimal security for the time services of the system. However, it can be circumvented by a determined programmer. If tighter security is desired, use the NTP authentication facility.

Example

In the following example, the system is configured to allow itself to be synchronized by a peer from access list 99. However, the system restricts access to allow only time requests from access list 42.

ntp access-group peer 99

ntp access-group serve-only 42

Related Command

A dagger (†) indicates that the command is documented in another chapter.

access-list †

ntp authenticate

To enable Network Time Protocol (NTP) authentication, use the ntp authenticate global configuration command. Use the no form of this command to disable the feature.

ntp authenticate
no ntp authenticate

Syntax Description

This command has no keywords or arguments.

Default

No authentication

Command Mode

Global configuration

Usage Guidelines

Use this command if you want authentication. If this command is specified, the system will not synchronize to a system unless it carries one of the authentication keys specified in the ntp trusted-key command.

Example

The following example enables NTP authentication:

ntp authenticate

Related Commands

ntp authentication-key
ntp trusted-key

ntp authentication-key

To define an authentication key for Network Time Protocol (NTP), use the ntp authentication-key global configuration command. Use the no form of this command to remove the authentication key for NTP.

ntp authentication-key number md5 value
no ntp authentication-key number

Syntax Description

number	Key number (1 to 4294967295)
md5	Key type
value	Key value (an arbitrary string of up to eight characters)

Default

No authentication key is defined for NTP.

Command Mode

Global configuration

Usage Guidelines

Use this command to define authentication keys for use with other NTP commands in order to provide a higher degree of security. Currently, only the key type md5 is supported.

Example

The following example sets authentication key 10 to aNiceKey:

ntp authentication-key 10 md5 aNiceKey

---

Note   When this command is written to nonvolatile memory, the key is encrypted so that it is not displayed when the configuration is viewed.

---

Related Commands

ntp authenticate
ntp peer
ntp server
ntp trusted-key

ntp broadcast

To specify that a specific interface should send Network Time Protocol (NTP) broadcast packets, use the ntp broadcast interface configuration command. Use the no form of this command to disable this capability.

ntp broadcast [version number]
no ntp broadcast

Syntax Description

version number

(Optional) Number from 1 to 3 indicating the NTP version

Default

Disabled

Command Mode

Interface configuration

Example

In the following example, Ethernet interface 0 is configured to send NTP version 2 packets:

interface ethernet 0

ntp broadcast version 2

Related Commands

ntp broadcast client
ntp broadcastdelay

ntp broadcast client

To allow the system to receive NTP broadcast packets on an interface, use the ntp broadcast client interface configuration command. Use the no form of this command to disable this capability.

ntp broadcast client
no ntp broadcast client

Syntax Description

This command has no arguments or keywords.

Default

Disabled

Command Mode

Interface configuration

Usage Guidelines

Use this command to allow the system to listen to broadcast packets on an interface-by-interface basis.

Example

In the following example, the access server synchronizes to NTP packets broadcasted on Ethernet interface 1:

interface ethernet 1

ntp broadcast client

Related Commands

ntp broadcast
ntp broadcastdelay

ntp broadcastdelay

To set the estimated round-trip delay between the access server and a Network Time Protocol (NTP) broadcast server, use the ntp broadcastdelay global configuration command. Use the no form of this command to revert to the default value.

ntp broadcastdelay microseconds
no ntp broadcastdelay

Syntax Description

microseconds

Estimated round-trip time (in microseconds) for NTP broadcasts. The range is from 1 to 999999.

Default

3000 microseconds

Command Mode

Global configuration

Usage Guidelines

Use this command when the access server is configured as a broadcast client and the round-trip delay on the network is other than 3000 microseconds.

Example

In the following example, the estimated round-trip delay between the access server and the broadcast client is set to 5000 microseconds:

ntp broadcastdelay 5000

Related Commands

ntp broadcast
ntp broadcast client

ntp clock-period

As NTP compensates for the error in the system clock, it keeps track of the correction factor for this error. The system automatically saves this value into the system configuration using the ntp clock-period global configuration command. The system uses the no form of this command to revert to the default.

ntp clock-period value
no ntp clock-period

Syntax Description

value

Amount to add to the system clock for each clock hardware tick (in units of 2-32 seconds).

Default

17179869 (4 milliseconds)

Command Mode

Global configuration

Usage Guidelines

If a write memory command is entered to save the configuration to nonvolatile memory, this command will automatically be added to the configuration. It is a good idea to use the write memory command after NTP has been running for a week or so; this will help NTP synchronize more quickly if the system is restarted.

Do not enter this command; it is documented for informational purposes only. The system automatically generates this command as Network Time Protocol (NTP) determines the clock error and compensates.

ntp disable

To prevent an interface from receiving Network Time Protocol (NTP) packets, use the ntp disable interface configuration command. To enable receipt of NTP packets on an interface, use the no form of this command.

ntp disable
no ntp disable

Syntax Description

This command has no arguments or keywords.

Default

Enabled

Command Mode

Interface configuration

Usage Guidelines

This command provides a simple method of access control.

Example

In the following example, Ethernet interface 0 is prevented from receiving NTP packets:

interface ethernet 0

ntp disable

ntp master

To configure the access server as a Network Time Protocol (NTP) master clock to which peers synchronize themselves when an external NTP source is not available, use the ntp master global configuration command. To disable the master clock function, use the no ntp master command.

ntp master [stratum]
no ntp master [stratum]

Syntax Description

stratum

(Optional) Number from 1 to 15. Indicates the NTP stratum number that the system will claim.

Default

By default, the master clock function is disabled. When enabled, the default stratum is 8.

Command Mode

Global configuration

Usage Guidelines

Because our implementation of NTP does not support directly attached radio or atomic clocks, the access server is normally synchronized, directly or indirectly, to an external system that has such a clock. In a network without Internet connectivity, such a time source may not be available. The ntp master command is used in such cases.

If the access server has ntp master configured, and it cannot reach any clock with a lower stratum number, the access server will claim to be synchronized at the configured stratum number, and other access servers will be willing to synchronize to it via NTP.

---

Note   The system clock must have been set from some source, either by taking the time from another source or by having the time set manually, before ntp master will have any effect. This protects against distributing erroneous time after the system is restarted.

---

---

Caution   

Use this command with extreme caution. It is very easy to override valid time sources using this command, especially if a low stratum number is configured. Configuring multiple machines in the same network with the ntp master command can cause instability in timekeeping if the machines do not agree on the time.

---

Example

In the following example, the access server is configured as an NTP master clock to which peers can synchronize:

ntp master 10

ntp peer

To configure the access server's system clock to synchronize a peer or to be synchronized by a peer, use the ntp peer global configuration command. To disable this capability, use the no form of this command.

ntp peer ip-address [version number] [key keyid] [source interface] [prefer]
no ntp peer ip-address

Syntax Description

ip-address	IP address of the peer providing, or being provided, the clock synchronization.
version number	(Optional) Defines the Network Time Protocol (NTP) version number (1 to 3).
key keyid	(Optional) Defines the authentication key when sending packets to this peer.
source interface	(Optional) Names the interface from which to pick the IP source address.
prefer	(Optional) Makes this peer the preferred peer that provides synchronization.

Default

No peers are configured by default. If a peer is configured, the default NTP version number is 3, no authentication key is used, and the source IP address is taken from the outgoing interface.

Command Mode

Global configuration

Usage Guidelines

Use this command if you want to allow this access server to synchronize with the peer, or vice versa. Using the prefer keyword will reduce switching back and forth between peers.

If you are using the default version of 3 and NTP synchronization does not occur, try using NTP version number 2. Many NTP servers on the Internet run version 2.

Example

In the following example, the access server is configured to allow its system clock to be synchronized with the clock of the peer (or vice versa) at IP address 172.30.22.33 using NTP version 2. The source IP address will be the address of Ethernet interface 0.

ntp peer 172.30.22.33 version 2 source Ethernet 0

Related Commands

ntp authentication-key
ntp server
ntp source

ntp server

To allow the access server's system clock to be synchronized by a time server, use the ntp server global configuration command. To disable this capability, use the no form of this command.

ntp server ip-address [version number] [key keyid] [source interface] [prefer]
no ntp server ip-address

Syntax Description

ip-address	IP address of the time server providing the clock synchronization.
version number	(Optional) Defines the Network Time Protocol (NTP) version number (1 to 3).
key keyid	(Optional) Defines the authentication key to use when sending packets to this peer.
source interface	(Optional) Identifies the interface from which to pick the IP source address.
prefer	(Optional) Makes this server the preferred server that provides synchronization.

Default

No peers are configured by default. If a peer is configured, the default NTP version number is 3, no authentication key is used, and the source IP address is taken from the outgoing interface.

Command Mode

Global configuration

Usage Guidelines

Use this command if you want to allow this access server to synchronize with the specified server. The server will not synchronize to this access server.

Using the prefer keyword will reduce switching back and forth between servers.

If you are using the default version of 3 and NTP synchronization does not occur, try using NTP version number 2. Many NTP servers on the Internet run version 2.

Example

In the following example, the access server is configured to allow its system clock to be synchronized with the clock of the peer at IP address 172.30.22.44 using NTP version 2:

ntp server 172.30.22.44 version 2

Related Commands

ntp authentication-key
ntp peer
ntp source

ntp source

To use a particular source address in Network Time Protocol (NTP) packets, use the ntp source global configuration command. Use the no form of this command to remove the specified source address.

ntp source interface
no ntp source

Syntax Description

interface

Any valid system interface name

Default

Source address is determined by the outgoing interface.

Command Mode

Global configuration

Usage Guidelines

Use this command when you want to use a particular source IP address for all NTP packets. The address is taken from the named interface. This command is useful if the address on an interface cannot be used as the destination for reply packets. If the source keyword is present on an ntp server or ntp peer command, that value overrides the global value.

Example

In the following example, the access server is configured to use the IP address of Ethernet interface 0 as the source address of all outgoing NTP packets:

ntp source ethernet 0

Related Commands

ntp peer
ntp server

ntp trusted-key

If you want to authenticate the identity of a system to which Network Time Protocol (NTP) will synchronize, use the ntp trusted-key global configuration command. Use the no form of this command to disable authentication of the identity of the system.

ntp trusted-key key-number
no ntp trusted-key key-number

Syntax Description

key-number

Key number of authentication key to be trusted

Default

Disabled

Command Mode

Global configuration

Usage Guidelines

If authentication is enabled, use this command to define one or more key numbers (corresponding to the keys defined with the ntp authentication-key command) that a peer NTP system must provide in its NTP packets, in order for this system to synchronize to it. This provides protection against accidentally synchronizing the system to a system that is not trusted, since the other system must know the correct authentication key.

Example

In the following example, the system is configured to synchronize only to systems providing authentication key 42 in its NTP packets:

ntp authenticate 
ntp authentication-key 42 md5 aNiceKey 
ntp trusted-key 42

Related Commands

ntp authenticate
ntp authentication-key

ping (user)

Use the ping (packet internet groper) user EXEC command to diagnose basic network connectivity on IP and Novell IPX networks.

ping [protocol] {host | address}

Syntax Description

protocol	(Optional) Protocol keyword, either ip or novell
host	Host name of system to ping
address	Address of system to ping

Command Mode

User EXEC

Usage Guidelines

The user-level ping feature provides a basic ping facility for users who do not have system privileges. This feature allows the access server to perform the simple default ping functionality for a number of protocols. Only the nonverbose form of the ping command is supported for user-level pings. Unlike the privileged-level ping command, the values for the number of ping packets sent, the datagram size, and the timeout cannot be adjusted.

If the system cannot map an address for a host name, it will return an "%Unrecognized host or address" error message.

To abort a ping session, type the escape sequence (by default, Ctrl-^ X, which is done by simultaneously pressing the Ctrl, Shift, and 6 keys, letting go, then pressing the X key).

describes the test characters that the ping facility sends.

Table 5-11 Ping Test Characters

Char	Meaning
!	Each exclamation point indicates receipt of a reply.
.	Each period indicates the network server timed out while waiting for a reply.
U	A destination unreachable error PDU was received.
C	A congestion experienced packet was received.
I	User interrupted test.
?	Unknown packet type.
&	Packet lifetime exceeded.

Example

The following display shows sample ping output when you ping the IP host named donald:

Router> ping donald

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.31.7.27, timeout is 2 seconds:

!!!!!

Success rate is 100 percent, round-trip min/avg/max = 1/3/4 ms

describes the default ping fields shown in the display.

Table 5-12 Ping Field Descriptions

Field	Description
Sending 5, 100-byte ICMP echos to ...	Indicates the number of ping packets sent to the specified host name, the datagram size, and the timeout value.
!!!!!	Each exclamation point (!) indicates receipt of a reply. A period (.) indicates the network server timed out while waiting for a reply. Other characters might appear in the ping output display, depending on the protocol type.
Success rate is 100 percent	Percentage of packets successfully echoed back to the access server. Anything less than 80 percent is usually considered problematic.
round-trip min/avg/max = 1/3/4 ms	Round-trip travel time intervals for the protocol echo packets, including minimum/average/maximum (in milliseconds).

Related Command

ping (privileged)

ping (privileged)

Use the ping (packet internet groper) privileged EXEC command to diagnose basic network connectivity on IP and Novell IPX networks.

ping [protocol] {host | address}

Syntax Description

protocol	(Optional) Protocol keyword, either ip or novell
host	Host name of system to ping
address	Address of system to ping

Command Mode

Privileged EXEC

Usage Guidelines

The ping program sends an echo request packet to an address, then awaits a reply. Ping output can help you evaluate path-to-host reliability, delays over the path, and whether the host can be reached or is functioning.

Depending upon the protocol type, You can adjust values for the number of ping packets to be sent, the datagram size, the timeout interval, additional command to include, and the sizes of the echo packets being sent.

After you enter the ping command in privileged mode, the system prompts for one of the following keywords: ip or ipx. The default protocol is IP.

If you enter a host name or address on the same line as the ping command, the default action is taken as appropriate for the protocol type of that name or address.

To abort a ping session, type the escape sequence (by default, Ctrl-^ X, which is done by simultaneously pressing the Ctrl, Shift, and 6 keys, letting go, then pressing the X key).

describes the test characters that the ping facility sends.

Table 5-13 Ping Test Characters

Char	Meaning
!	Each exclamation point indicates receipt of a reply.
.	Each period indicates the network server timed out while waiting for a reply.
U	A destination unreachable error PDU was received.
C	A congestion experienced packet was received.
I	User interrupted test.
?	Unknown packet type.
&	Packet lifetime exceeded.

---

Note   Not all protocols require hosts to support pings, and for some protocols, the pings are Cisco-defined and are only answered by another Cisco access server.

---

Example

While the precise dialog varies somewhat from protocol to protocol, all are similar to the ping session using default values shown in the following display:

Router# ping

Protocol [ip]:

Target IP address: 172.30.7.27

Repeat count [5]:

Datagram size [100]:

Timeout in seconds [2]:

Extended commands [n]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.31.7.27, timeout is 2 seconds:

!!!!!

Success rate is 100 percent, round-trip min/avg/max = 1/2/4 ms

describes the default ping fields shown in the display.

Table 5-14 Ping Field Descriptions

Field	Description
Protocol [ip]:	Prompts for a supported protocol. Enter ip or novell. Default: ip.
Target IP address:	Prompts for the IP address or host name of the destination node you plan to ping. If you have specified a supported protocol other than IP, enter an appropriate address for that protocol here. Default: none.
Repeat count [5]:	Number of ping packets that will be sent to the destination address. Default: 5.
Datagram size [100]:	Size of the ping packet (in bytes). Default: 100 bytes.
Timeout in seconds [2]:	Timeout interval. Default: 2 (seconds).
Extended commands [n]:	Specifies whether or not a series of additional commands appears. Many of the following displays and tables show and describe these commands.
Sweep range of sizes [n]:	Allows you to vary the sizes of the echo packets being sent. This capability is useful for determining the minimum sizes of the MTUs configured on the nodes along the path to the destination address. Packet fragmentation contributing to performance problems can then be reduced.
!!!!!	Each exclamation point (!) indicates receipt of a reply. A period (.) indicates the network server timed out while waiting for a reply. Other characters might appear in the ping output display, depending on the protocol type.
Success rate is 100 percent	Percentage of packets successfully echoed back to the access server. Anything less than 80 percent is usually considered problematic.
round-trip min/avg/max = 1/2/4 ms	Round-trip travel time intervals for the protocol echo packets, including minimum/average/maximum (in milliseconds).

Related Command

ping (user)

ppp authentication

To enable Challenge Handshake Authentication Protocol (CHAP) or Password Authentication Protocol (PAP), and to enable an AAA authentication method on an interface, use the ppp authentication interface configuration command. Use the no form of the command to disable this authentication.

ppp authentication {chap | pap} [if-needed] [list-name]
no ppp authentication

Syntax Description

chap	Enable CHAP on a serial interface.
pap	Enable PAP on a serial interface.
if-needed	(Optional) Used with TACACS and Extended TACACS. Do not perform CHAP or PAP authentication if user has already provided authentication. This option is available only on asynchronous interfaces.
list-name	(Optional) Used with AAA/TACACS+. Specify the name of a list of AAA methods of authentication to use. If no listname is specified, the system will use the default. Lists and default are created using the aaa authentication password-prompt command.

Default

PPP authentication is not enabled.

Command Mode

Interface configuration

Usage Guidelines

Once you have enabled CHAP or PAP, the local access server requires a password from remote devices. If the remote device does not support CHAP or PAP, no traffic will be passed to that device.

If you are using autoselect on a tty line, you will probably want to use the ppp authentication command to turn on PPP authentication for the corresponding interface.

When you specify the if-needed option, PPP authentication is not required when the user has already provided authentication. This option is useful in conjunction to the autoselect command, but cannot be used with AAA/TACACS+.

The list-name keyword can only be used when AAA/TACACS+ is initialized and cannot be used with the if-needed argument.

---

Caution   

If you use a list-name that was not configured with the aaa authentication ppp command, you will disable PPP on this interface.

---

Example

The following example enables CHAP on asynchronous interface 4:

interface async 4 
encapsulation ppp 
ppp authentication chap

Related Commands

A dagger (†) indicates that the command is documented in another chapter.

aaa authentication password-prompt
aaa new-model
autoselect†
encapsulation ppp†
ppp chap password
username

ppp chap password

Use the ppp chap password interface configuration command to enable a router calling a collection of routers that do not support this command (such as routers running older Cisco IOS software images) to configure a common CHAP secret password to use in response to challenges from an unknown peer. To disable this function, use the no form of this command.

ppp chap password secret
no chap password secret

Syntax Description

secret

The secret used to compute the response value for any CHAP challenge from an unknown peer.

Default

Disabled.

Command Mode

Interface configuration.

Usage Guidelines

This command first appeared in Cisco IOS Release 11.2.

This command allows you to replace several username and password configuration commands with a single copy of this command on any dialer interface or asynchronous group interface.

This command is used for remote CHAP authentication only (when routers authenticate to the peer) and does not affect local CHAP authentication.

Example

The commands in the following example specify Integrated Services Digital Network (ISDN) Basic Rate Interface (BRI) number 0. The method of encapsulation on the interface is PPP. If a CHAP challenge is received from a peer whose name is not found in the global list of usernames, the encrypted secret 7 1267234591 is decrypted and used to create a CHAP response value.

interface bri 0

encapsulation ppp

ppp chap password 7 1234567891 

Related Commands

aaa authentication ppp
ppp authentication
ppp chap hostname
ppp pap

ppp use-tacacs

To enable TACACS for PPP authentication, use the ppp use-tacacs interface configuration command. Use the no form of this command to disable TACACS for PPP authentication.

ppp use-tacacs [single-line]
no ppp use-tacacs

Syntax Description

single-line

(Optional) Accept the username and password in the username field. This option applies only when using CHAP authentication.

Default

TACACS is not used for PPP authentication.

Command Mode

Interface configuration

Usage Guidelines

This is a per-interface command used with Extended TACACS. Use this command only when you have set up an extended TACACS server.

When CHAP authentication is being used, the ppp use-tacacs command with the single-line option specifies that if a username and password are specified in the username, separated by an asterisk (*), then a standard tacacs login query is performed using that username and password. If the username does not contain an asterisk, then normal CHAP authentication is performed using TACACS.

This feature is useful when integrating TACACS with other authentication systems that require a clear-text version of the user's password. Such systems include one-time password systems, token card systems, and others.

---

Caution   

Normal CHAP authentications prevent the clear-text password from being transmitted over the link. When you use the single-line option, passwords will cross the link in the clear.

---

If the username and password are contained in the CHAP password, then the CHAP secret is not used by the Cisco system. Because most PPP clients will require that a secret be specified, you can use any arbitrary string; the Cisco system will ignore it.

---

Note   This command is not used in AAA/TACACS+ and has been replaced with the aaa authentication password-prompt command.

---

Examples

In the following example, asynchronous serial interface 1 is configured to use TACACS for CHAP authentication:

interface async 1

ppp authentication chap

ppp use-tacacs

In the following example, asynchronous serial interface 1 is configured to use TACACS for PAP authentication:

interface async 1

ppp authentication pap

ppp use-tacacs

Related Commands

A dagger (†) indicates that the command is documented in another chapter.

ppp authentication chap†
ppp authentication pap†
tacacs-server directed-request
tacacs-server host

priority-group

To assign the specified priority list to an interface, use the priority-group interface configuration command. Use the no form of this command to remove the specified priority-group assignment.

priority-group list
no priority-group

Syntax Description

list	Priority list number assigned to the interface

Default

None

Command Mode

Interface configuration

Usage Guidelines

Only one list can be assigned per interface. Priority output queueing provides a mechanism to prioritize packets transmitted on an interface.

Example

The following example causes packets on serial interface 0 to be classified by priority list 1:

interface serial 0 
priority-group 1

Related Commands

priority-list
priority-list interface
priority-list queue-limit
priority-list stun

priority-list default

To assign a priority queue for those packets that do not match any other rule in the priority list, use the priority-list default global configuration command. Use the no form of this command to return to the default or assign normal as the default.

priority-list list-number default {high | medium | normal | low}
no priority-list list-number default {high | medium | normal | low}

Syntax Description

list-number	Arbitrary integer between 1 and 10 that identifies the priority list selected by the user
high | medium | normal | low	Priority queue level

Default

The normal queue is assumed if you use the no form of the command.

Command Mode

Global configuration

Example

The following example sets the priority queue for those packets that do not match any other rule in the priority list to a low priority:

priority-list 1 default low

Related Commands

priority-group
show queueing

priority-list interface

To establish queuing priorities on packets entering from a given interface, use the priority-list interface global configuration command. Use the no priority-list command with the appropriate arguments to remove an entry from the list.

priority-list list-number interface interface-type interface-number {high | medium |
normal | low}
no priority-list list-number interface interface-type interface-number {high | medium |
normal | low}

Syntax Description

list-number	Arbitrary integer between 1 and 10 that identifies the priority list selected by the user
interface-type	Name of the interface
interface-number	Number of the specified interface
high | medium | normal | low	Priority queue level

Default

No queuing priorities are established.

Command Mode

Global configuration

Example

The following example sets any packet type entering on Ethernet interface 0 to a medium priority:

priority-list 3 interface ethernet 0 medium

Related Commands

priority-group
show queueing

priority-list protocol

To establish queuing priorities based upon the protocol type, use the priority-list protocol global configuration command. Use the no form of this command with the appropriate list number to remove an entry from the list.

priority-list list-number protocol protocol-name {high | medium | normal | low}
queue-keyword keyword-value
no priority-list list-number protocol

Syntax Description

list-number	Arbitrary integer between 1 and 10 that identifies the priority list selected by the user.
protocol-name	Specifies the protocol type: arp, compressedtcp, ip, ipx, pad, and x25.
high | medium | normal | low	Priority queue level.
queue-keyword keyword-value	Possible keywords are gt, lt, list, tcp, and udp. See .

Default

No queuing priorities are established.

Command Mode

Global configuration

Usage Guidelines

When using multiple rules for a single protocol, remember that the system reads the priority settings in order of appearance. When classifying a packet, the system searches the list of rules specified by priority-list commands for a matching protocol type. When a match is found, the packet is assigned to the appropriate queue. The list is searched in the order it is specified, and the first matching rule terminates the search.

Use , , and to configure the queuing priorities for your system.

Table 5-15 Protocol Priority Queue Keywords and Values

Option	Description
gt byte-count	Specifies a greater-than count. The priority level assigned goes into effect when a packet exceeds the value entered for the argument byte-count. The size of the packet must also include additional bytes due to MAC encapsulation on the outgoing interface.
lt byte-count	Specifies a less-than count. The priority level assigned goes into effect when a packet size is less than the value entered for byte-count. The size of the packet must also include additional bytes due to MAC encapsulation on the outgoing interface.
list list-number	Assigns traffic priorities according to a specified list when used with IP or IPX. The list-number argument is the access list number as specified by the access-list global configuration command for the specified protocol-name.
tcp port	Assigns the priority level defined to TCP segments originating from or destined to a specified port (for use with the IP protocol only). lists common TCP services and their port numbers.
udp port	Assigns the priority level defined to UDP packets originating from or destined to the specified port (for use with the IP protocol only). lists common UDP services and their port numbers.

Table 5-16 Common TCP Services and Port Numbers

Service	Port
Telnet	23
SMTP	25

Table 5-17 Common UDP Services and Port Numbers

Service	Port
TFTP	69
NFS	2049
SNMP	161
RPC	111
DNS	53

---

Note   The TCP and UDP ports listed in and include some of the more common port numbers. However, you can specify any port number to be prioritized; you are not limited to those listed.

---

Use the no priority-list global configuration command followed by the appropriate list-number argument and the protocol keyword to remove a priority list entry assigned by protocol type.

Examples

The following example assigns a high-priority level to traffic that matches IP access list 10:

priority-list 1 protocol ip high list 10

The following example assigns a medium-priority level to Telnet packets:

priority-list 4 protocol ip medium tcp 23

The following example assigns a medium-priority level to UDP Domain Name Service packets:

priority-list 4 protocol ip medium udp 53

The following example assigns a high-priority level to traffic that matches Ethernet type code access list 201:

priority-list 1 protocol bridge high list 201

Related Commands

priority-group
show queueing

priority-list queue-limit

To specify the maximum number of packets that can be waiting in each of the priority queues, use the priority-list queue-limit global configuration command. Use the no form of this command to select the normal queue.

priority-list list-number queue-limit high-limit medium-limit normal-limit low-limit
no priority-list list-number queue-limit

Syntax Description

list-number	Arbitrary integer between 1 and 10 that identifies the priority list selected by the user.
high-limit medium-limit normal-limit low-limit	Priority queue maximum length. A value of 0 for any of the four arguments means that the queue can be of unlimited size for that particular queue.

Default

The default queue limit arguments are listed in .

Table 5-18 Default Priority Queue Packet Limits

Priority Queue Argument	Packet Limits
high-limit	20
medium-limit	40
normal-limit	60
low-limit	80

Command Mode

Global configuration

Usage Guidelines

If a priority queue overflows, excess packets are discarded and quench messages can be sent, if appropriate, for the protocol.

Example

The following example sets the maximum packets in the priority queue to 10:

priority-list 2 queue-limit 10 40 60 80

Related Commands

priority-group
show queueing

privilege level (global)

To set the privilege level for a command, use the privilege level global configuration command. Use the no privilege level command to revert to default privileges for a given command.

privilege mode level level command
no privilege mode level level command

Syntax Description

mode	Configuration mode. See in the description of the alias command for a list of acceptable options.
level	Privilege level to be associated with the specified command. You can specify up to sixteen privilege levels, using numbers 0 through 15.
command	Command to which privilege level is associated.

Default

Level 15 is the level of access permitted by the enable password.

Level 1 is normal EXEC-mode user privileges.

Command Mode

Global configuration

Usage Guidelines

in the description of the alias command shows the acceptable options for the mode argument in the privilege level global configuration command.

The password for the privilege level defined using the privilege level global configuration mode is configured using the enable password command.

There are five commands associated with privilege level 0: disable, enable, exit, help, and logout. If you configure AAA authorization for a privilege level greater than 0, these five commands will not be included. Level 0 can be used to specify a more-limited subset of commands for specific users or lines. For example, you can allow user "guest" to only use the show users and exit commands.

Example

In the following example, the configure command in global configuration mode is assigned a privilege level of 14. Only users who know the level 14 password will be able to use the configure command.

privilege exec level 14 configure 
enable password level 14 pswd14

Related Commands

enable password
privilege level (line)

privilege level (line)

To set the default privilege level for a line, use the privilege level line configuration command. Use the no privilege level command to restore the default user privilege level to the line.

privilege level level
no privilege level

Syntax Description

level

Privilege level to be associated with the specified line.

Default

Level 15 is the level of access permitted by the enable password.

Level 1 is normal EXEC-mode user privileges.

Command Mode

Line configuration

Usage Guidelines

The privilege level that is set using this command can be overridden by a user logging into the line and enabling a different privilege level. The user can lower the privilege level by using the disable command. If they know the password to a higher privilege level, they can use that password to enable the higher privilege level.

Level 0 can be used to specify a more limited subset of commands for specific users or lines. For example, you can allow user "guest" to only use the show users and exit commands.

You might specify a high level of privilege for your console line if you are able to restrict who uses that line.

Example

In the following example, the auxiliary line is configured for privilege level 5. Anyone who is using the auxiliary line will have privilege level 5 by default.

line aux 0

privilege level 5

Related Commands

enable password
privilege level (global)

prompt

To customize the access server prompt, use the prompt global configuration command. To revert to the default access server prompt, use the no form of this command.

prompt string
no prompt [string]

Syntax Description

string

Access server prompt. It can consist of all printing characters and the escape sequences listed in in the Usage Guidelines section below.

Default

The default access server prompt is either Router (cs for ASM) or the access server name defined with the hostname global configuration command, followed by an angle bracket (>) for EXEC mode or a pound sign (#) for privileged EXEC mode.

Command Mode

Global configuration

Usage Guidelines

You can include escape sequences when specifying the access server prompt. All escape sequences are preceded by a percent sign (%). lists the valid escape sequences.

Table 5-19 Custom Access Server Prompt Escape Sequences

Escape Sequence	Interpretation
%h	access server's host name. This is either cs or the name defined with the hostname global configuration command.
%n	Physical terminal line (TTY) number of the EXEC user.
%p	Prompt character itself. It is either an angle bracket (>) for EXEC mode or a pound sign (#) for privileged EXEC mode.
%s	Space.
%t	Tab.
%%	Percent sign (%)

Specifying the command prompt %h has the same effect as issuing the no prompt command.

Examples

The following example changes the EXEC prompt to include the TTY number, followed by the access server name and a space:

prompt TTY%n@%h%s%p

The following are examples of user and privileged EXEC prompts that result from the previous command:

TTY17@cs >

TTY17Scs #

Related Command

hostname

queue-list default

To assign a priority queue for those packets that do not match any other rule in the queue list, use the queue-list default global configuration command. To restore the default value, use the
no form of this command.

queue-list list-number default queue-number
no queue-list list-number default queue-number

Syntax Description

list-number	Number of the queue list. An integer from 1 to 10.
queue-number	Number of the queue. An integer from 1 to 10.

Default

Queue number 1

Command Mode

Global configuration

Usage Guidelines

Queue number 0 is a system queue. It is emptied before any of the other queues are processed. The system enqueues high-priority packets, such as keepalives, to this queue.

Example

In the following example, the default queue for list 10 is set to queue number 2:

queue-list 10 default 2

Related Commands

custom-queue-list
show queueing

queue-list interface

To establish queuing priorities on packets entering on an interface, use the queue-list interface global configuration command. To remove an entry from the list, use the no form of this command.

queue-list list-number interface interface-type interface-number queue-number
no queue-list list-number interface queue-number

Syntax Description

list-number	Number of the queue list. An integer from 1 to 10.
interface-type	Required argument that specifies the name of the interface.
interface-number	Number of the specified interface.
queue-number	Number of the queue. An integer from 1 to 10.

Default

No queuing priorities are established.

Command Mode

Global configuration

Example

In the following example, queue list 4 established queuing priorities for packets entering on interface tunnel 3. The queue number assigned is 10.

queue-list 4 interface tunnel 3 10

Related Commands

custom-queue-list
show queueing

queue-list protocol

To establish queuing priority based upon the protocol type, use the queue-list protocol global configuration command. Use the no form of this command with the appropriate list number to remove an entry from the list.

queue-list list-number protocol protocol-name queue-number queue-keyword keyword-value
no queue-list list-number protocol protocol-name

Syntax Description

list-number	Number of the queue list. An integer from 1 to 10.
protocol-name	Required argument that specifies the protocol type: arp, compressedtcp, ip, ipx, pad, and x25.
queue-number	Number of the queue. An integer from 1 to 10.
queue-keyword keyword-value	Possible keywords are gt, lt, list, tcp, and udp. See .

Default

No queuing priorities are established.

Command Mode

Global configuration

Usage Guidelines

When classifying a packet, the system searches the list of rules specified by queue-list commands for a matching protocol type. When a match is found, the packet is assigned to the appropriate queue. The list is searched in the order it is specified, and the first matching rule terminates the search.

Use , , and from the priority-list protocol command to configure custom queuing for your system.

Examples

The following example assigns traffic that matches IP access list 10 to queue number 1:

queue-list 1 protocol ip 1 list 10

The following example assigns Telnet packets to queue number 2:

queue-list 4 protocol ip 2 tcp 23

The following example assigns UDP Domain Name System packets to queue number 2:

queue-list 4 protocol ip 2 udp 53

The following example assigns traffic that matches Ethernet type code access list 201 to queue number 1:

queue-list 1 protocol bridge 1 list 201

Related Commands

custom-queue-list
show queueing

queue-list queue byte-count

To designate the byte size allowed per queue, use the queue-list queue byte-count global configuration command. To return the byte size to the default value, use the no form of this command.

queue-list list-number queue queue-number byte-count byte-count-number
no queue-list list-number queue queue-number byte-count byte-count-number

Syntax Description

list-number	Number of the queue list. An integer from 1 to 10.
queue-number	Number of the queue. An integer from 1 to 10.
byte-count-number	Specifies the lower boundary on how many bytes the system allows to be delivered from a given queue during a particular cycle.

Default

1500 bytes

Command Mode

Global configuration

Example

In the following example, queue list 9 establishes the byte-count as 1400 for queue number 10:

queue-list 9 queue 10 byte-count 1400

Related Commands

custom-queue-list
show queueing

queue-list queue limit

To designate the queue length limit for a queue, use the queue-list queue limit global configuration command. To return the queue length to the default value, use the no form of this command.

queue-list list-number queue queue-number limit limit-number
no queue-list

Syntax Description

list-number	Number of the queue list. An integer from 1 to 10.
queue-number	Number of the queue. An integer from 1 to 10.
limit-number	Maximum number of packets which can be enqueued at any time. Range is 0 to 32767 queue entries.

Default

20 entries

Command Mode

Global configuration

Example

In the following example, the queue length of queue 10 is increased to 40:

queue-list 5 queue 10 limit 40

Related Commands

custom-queue-list
show queueing

scheduler-interval

To control the maximum amount of time that can elapse without running the lowest-priority system processes, use the scheduler-interval global configuration command. Use the no form of this command to restore the default.

scheduler-interval milliseconds
no scheduler-interval

Syntax Description

milliseconds

Integer that specifies the interval, in milliseconds. The minimum interval that you can specify is 500 milliseconds; there is no maximum value.

Default

500 milliseconds

Command Mode

Global configuration

Usage Guidelines

The normal operation of the network server allows the switching operations to use as much of the central processor as is required. If the network is running unusually heavy loads that do not allow the processor the time to handle the routing protocols, give priority to the system process scheduler. High-priority operations are allowed to use as much of the central processor as needed.

Example

The following example changes the low-priority process schedule to an interval of 750 milliseconds:

scheduler-interval 750

service decimal-tty

To specify that line numbers be displayed and interpreted as decimal numbers rather than octal numbers, use the service decimal-tty global configuration command. Use the no form of this command to restore the default.

service decimal-tty
no service decimal-tty

Syntax Description

This command has no arguments or keywords.

Default

Octal line numbers on the ASM-CS; decimal numbers on the 500-CS and Cisco 2500 Series.

Command Mode

Global configuration

Example

The following example shows how to display decimal rather than octal line numbers:

service decimal-tty

service exec-wait

To delay the startup of the EXEC on noisy lines, use the service exec-wait global configuration command. Use the no form of this command to disable this feature.

service exec-wait
no service exec-wait

Syntax Description

This command has no arguments or keywords.

Default

Disabled

Command Mode

Global configuration

Usage Guidelines

This command delays startup of the EXEC until the line has been idle (no traffic seen) for 3 seconds. The default is to enable the line immediately on modem activation.

This command is useful on noisy modem lines or when a modem attached to the line is configured to ignore MNP or V.42 negotiations, and MNP or V.42 modems may be dialing in. In these cases, noise or MNP/V.42 packets might be interpreted as usernames and passwords, causing authentication failure before the user gets a chance to type a username/password. The command is not useful on nonmodem lines or lines without some kind of login configured.

Example

The following example delays the startup of the EXEC:

service exec-wait

service finger

To allow Finger protocol requests (defined in RFC 742) to be made of the network server, use the service finger global configuration command. This service is equivalent to issuing a remote show users command. The no service finger command removes this service.

service finger
no service finger

Syntax Description

This command has no arguments or keywords.

Default

Enabled

Command Mode

Global configuration

Example

The following is an example of how to disable the Finger protocol:

no service finger

service nagle

To enable the Nagle congestion control algorithm, use the service nagle global configuration command. Use the no form of this command to disable this feature.

service nagle
no service nagle

Syntax Description

This command has no arguments or keywords.

Default

Disabled

Command Mode

Global configuration

Usage Guidelines

When using a standard TCP implementation to send keystrokes between machines, TCP tends to send one packet for each keystroke typed. On larger networks, many small packets use up bandwidth and contribute to congestion.

John Nagle's algorithm (RFC 896) helps alleviate the small-packet problem in TCP. In general, it works this way: The first character typed after connection establishment is sent in a single packet, but TCP holds any additional characters typed until the receiver acknowledges the previous packet. Then the second, larger packet is sent, and additional typed characters are saved until the acknowledgment comes back. The effect is to accumulate characters into larger chunks, and pace them out to the network at a rate matching the round-trip time of the given connection. This method is usually a good for all TCP-based traffic. However, do not use the service nagle command if you have XRemote users on X Window sessions.

Example

The following example enables the Nagle algorithm on the access server:

service nagle

service password-encryption

To encrypt passwords, use the service password-encryption global configuration command. Use the no form of this command to disable this service.

service password-encryption
no service password-encryption

Syntax Description

This command has no arguments or keywords.

Default

No encryption

Command Mode

Global configuration

Usage Guidelines

The actual encryption process occurs when the current configuration is written or when a password is configured. Password encryption can be applied to both the privileged command password and to console and virtual terminal line access passwords.

When password encryption is enabled, the encrypted form of the passwords is displayed when a show configuration command is entered.

---

Note   It is not possible to recover a lost encrypted password.

---

Example

The following example causes password encryption to take place:

service password-encryption

service prompt config

To display the configuration prompt (config), use the service prompt config global configuration command. Use the no form of this command to remove the configuration prompt.

service prompt config
no service prompt config

Syntax Description

This command has no arguments or keywords.

Default

Router(config)#

Command Mode

Global configuration

Examples

In the following example, notice how the configuration prompt varies, depending on what sub division of configuration mode you are using.

Router#config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Router(config)#interface ethernet 0

Router(config-if)#line config 0

Router(config-line)#router rip

Router(config-router)#map-list foo

Router(config-map-list)#map-class atm bar

Router(config-map-class)#exit

Router(config)#exit

Router#

Related Commands

prompt
hostname

service tcp-keepalives

To generate keepalive packets on idle network connections, use the service tcp-keepalives global configuration command. Use the no form of this command with the appropriate keyword to disable the keepalives.

service tcp-keepalives-in | tcp-keepalives-out
no service tcp-keepalives-in | tcp-keepalives-out

Syntax Description

in	Generates keepalives on incoming connections (initiated by remote host).
out	Generates keepalives on outgoing connections (initiated by a user).

Default

Disabled

Command Mode

Global configuration

Example

The following example generates keepalives on incoming TCP connections:

service tcp-keepalives-in

service tcp-small-servers

To access minor TCP/IP services available from hosts on the network, use the service tcp-small-servers command. Use the no form of the command to disable these services.

Syntax Description

This command has no arguments or keywords.

Default

Enabled

Command Mode

Global configuration

Usage Guidelines

This command makes available minor TCP/IP services through hosts on the network such as chargen, echo, discard, and daytime.

---

Note   Unlike defaults for other commands, this command will display when you perform show running config to display current settings whether or not you have changed the default using the no service tcp-small-servers command.

---

Example

The following example enables minor TCP/IP services available from the network:

service tcp-small-servers

service telnet-zero-idle

To set the TCP window to zero (0) when the Telnet connection is idle, use the service telnet-zero-idle global configuration command. Use the no form of this command to disable this feature.

service telnet-zero-idle
no service telnet-zero-idle

Syntax Description

This command has no arguments or keywords.

Default

Disabled

Command Mode

Global configuration

Usage Guidelines

Normally, data sent to noncurrent Telnet connections is accepted and discarded. When service telnet-zero-idle is enabled, if a session is suspended (that is, some other connection is made active or the EXEC is sitting in command mode), the TCP window is set to zero. This action prevents the remote host from sending any more data until the connection is resumed. Use this command when it is important that all messages sent by the host be seen by the users and the users are likely to use multiple sessions.

Do not use this command if your host will eventually time out and log out a TCP user whose window is zero.

Example

The following example sets the TCP window to zero when the Telnet connection is idle:

service telnet-zero-idle

Related Command

resume

service timestamps

To configure the system to timestamp debugging or logging messages, use one of the service timestamps global configuration commands. Use the no form of this command to disable this service.

service timestamps [type uptime]
service timestamps type datetime [msec] [localtime] [show-timezone]
no service timestamps [type]

Syntax Description

type	(Optional) Type of message to timestamp: debug or log.
uptime	(Optional) Timestamp with time since the system was rebooted.
datetime	Timestamp with the date and time.
msec	(Optional) Timestamp includes milliseconds with the date and time.
localtime	(Optional) Timestamp relative to the local time zone.
show-timezone	(Optional) Timestamp includes the time-zone name.

Default

No timestamping.

If service timestamps is specified with no arguments or keywords, the default is service timestamps debug uptime.

The default for service timestamps type datetime is to format the time in UTC, with no milliseconds and no time-zone name.

The command no service timestamps with no arguments or keywords disables timestamps for both debugging and logging messages.

Command Mode

Global configuration

Usage Guidelines

Timestamps can be added to either debugging or logging messages independently. The uptime form of the command adds timestamps in the format HHHH:MM:SS, indicating the time since the system was rebooted. The datetime form of the command adds timestamps in the format
MMM DD HH:MM:SS, indicating the date and time according to the system clock. If the system clock has not been set, the date and time are preceded by an asterisk (*) to indicate that the date and time are probably not correct.

Examples

The following example enables timestamps on debugging messages, showing the time since reboot:

service timestamps debug uptime

The following example enables timestamps on logging messages, showing the current time and date relative to the local time zone, with the time zone name included:

service timestamps log datetime localtime show-timezone

Related Commands

A dagger (†) indicates that the command is documented in the Debug Command Reference.

clock set
debug †
ntp

show aliases

To display all alias commands, or the alias commands in a specified mode, use the show aliases privileged EXEC command.

show aliases [mode]

Syntax Description

mode	(Optional) Command mode. See in the description of the alias command for acceptable options for the mode argument.

shows the options for the optional mode argument in the show aliases privileged EXEC command.

Command Mode

Privileged EXEC

Usage Guidelines

All of the modes listed in have their own prompts, except for the null interface mode. For example, the prompt for interface configuration mode is cs(config-if).

Sample Display

The following is sample output from the show aliases exec commands. The aliases configured for commands in EXEC mode are displayed.

Router# show aliases exec 

Exec mode aliases:

  h                     help

  lo                    logout

  p                     ping

  r                     resume

  s                     show

  w                     where

Related Command

alias

show buffers

Use the show buffers EXEC command to display statistics for the buffer pools on the network server.

show buffers [type number | alloc [dump]]

Syntax Description

type number	(Optional) Displays interface pool information for the specified interface type and number if the specified interface type and number has its own buffer pool. Value of type can be ethernet, serial, or tokenring.
alloc	(Optional) Displays a brief listing of all allocated buffers.
dump	(Optional) Dumps all allocated buffers. This keyword must be used with the alloc keyword, not by itself.

Command Mode

EXEC

Sample Displays

The following is sample output from the show buffers command with no optional arguments; showing all buffer pool and interface buffer pool information:

		Router# show buffers

Buffer elements:

          421 in free list (500 max allowed)

          409 hits, 0 misses, 0 created

      Public buffer pools:

     Small buffers, 104 bytes (total 50, permanent 50):

          50 in free list (20 min, 150 max allowed)

          277 hits, 0 misses, 0 trims, 0 created

     Middle buffers, 600 bytes (total 25, permanent 25):

          24 in free list (10 min, 75 max allowed)

          19 hits, 0 misses, 0 trims, 0 created

          0 failures (0 no memory)

     Big buffers, 1524 bytes (total 50, permanent 50):

          50 in free list (5 min, 40 max allowed)

          4 hits, 0 misses, 0 trims, 0 created

          0 failures (0 no memory)

     VeryBig buffers, 4520 bytes (total 10, permanent 10):

          10 in free list (0 min, 100 max allowed)

          0 hits, 0 misses, 0 trims, 0 created

     Large buffers, 5024 bytes (total 0, permanent 0):

          0 in free list (0 min, 10 max allowed)

          0 hits, 0 misses, 0 trims, 0 created

          0 failures (0 no memory)

     Huge buffers, 18024 bytes (total 0, permanent 0):

          0 in free list (0 min, 4 max allowed)

          0 hits, 0 misses, 0 trims, 0 created

          0 failures (0 no memory)

      Interface buffer pools:

     Fddi buffers, 5024 bytes (total 256, permanent 256):

          0 in free list (0 min, 256 max allowed)

          256 hits, 0 misses

          256 max cache size, 110 in cache

          14 buffer threshold, 0 threshold transitions

     Ethernet0 buffers, 1524 bytes (total 64, permanent 64):

          16 in free list (0 min, 64 max allowed)

          48 hits, 0 misses

          16 max cache size, 16 in cache

     Ethernet1 buffers, 1524 bytes (total 64, permanent 64):

          16 in free list (0 min, 64 max allowed)

          48 hits, 0 misses

          16 max cache size, 16 in cache

     Serial0 buffers, 1524 bytes (total 64, permanent 64):

          16 in free list (0 min, 64 max allowed)

          48 hits, 0 misses

          16 max cache size, 16 in cache

     Serial1 buffers, 1524 bytes (total 64, permanent 64):

          16 in free list (0 min, 64 max allowed)

          48 hits, 0 misses

          16 max cache size, 16 in cache

describes significant fields shown in the display.

Table 5-20 Show Buffers Field Descriptions

Field	Description
Buffer elements	Buffer elements are small structures used as placeholders for buffers in internal operating system queues. Buffer elements are used when a buffer may need to be on more than one queue.
Free list	Total number of the currently unallocated buffer elements.
Max allowed	Maximum number of buffers that are available for allocation.
hits	Count of successful attempts to allocate a buffer when needed.
misses	Count of buffer allocation attempts that resulted in growing the buffer pool in order to allocate a buffer.
created	Count of new buffers created to satisfy buffer allocation attempts when the available buffers in the pool have already been allocated.
Small buffers	Blocks of memory used to hold network packets. The sizes of these buffers can vary as follows: small, middle, big, large and huge.
Middle buffers	Buffers that are 600 bytes long.
Big buffers	Buffers that are 1524 bytes long.
VeryBig buffers	Buffers that are 4520 bytes long.
Large buffers	Buffers that are 5024 bytes long.
Huge buffers	Buffers that are 18024 bytes long.
(total , permanent )	Total number of this type of buffer, and the number of these buffers that are permanent.
trims	Count of buffers released to the system because they were not being used. This field is displayed only for dynamic buffer pools, not interface buffer pools, which are static.
created	Count of new buffers created in response to misses. This field is displayed only for dynamic buffer pools, not interface buffer pools, which are static.
failures	Total number of allocation requests that have failed because no buffer was available for allocation; the datagram was lost. Such failures normally occur at interrupt level.
(no memory)	Number of failures because no memory was available to create a new buffer.
Interface buffer pools	Static.
Interface buffer pools
Total	Total number of this type of buffer.
Permanent	Number of these buffers that are permanent.
Free list	Number of available or unallocated buffers in that pool.
Min	Minimum number of free or unallocated buffers in the buffer pool.
Max allowed	Maximum number of free or unallocated buffers in the buffer pool.
Hits	Count of successful attempts to allocate a buffer when needed.
Fall backs	Count of buffer allocation attempts that resulted in falling back to the public buffer pool that is the smallest pool at least as big as the interface buffer pool.
Max Cache Size	Maximum number of buffers from that interface's pool that can be in that interface buffer pool's cache. Each interface buffer pool has its own cache. These are not additional to the permanent buffers; they come from the interface's buffer pools. Some interfaces place all of their buffers from the interface pool into the cache. In this case, it is normal for the free list to display 0.
Failures	Total number of allocation requests that have failed because no buffer was available for allocation; the datagram was lost. Such failures normally occur at interrupt level.
(no memory)	Number of failures that occurred because no memory was available to create a new buffer.

The following is sample output from the show buffers command when an interface type and number are specified:

		Router# show buffers ethernet 0

Ethernet0 buffers, 1524 bytes (total 64, permanent 64):

          16 in free list (0 min, 64 max allowed)

          48 hits, 0 misses

          16 max cache size, 16 in cache

The following is sample output from the show buffers command when all is specified:

		Router# show buffers all

Buffer elements:

                            Free      Max        Hit  Miss      Creat

                                      Free                         ed

--------------------------------------------------------------------------------

                             427       500     17553     0          0

Public buffer pools:

Pool      Buffer Total Perm Free Min  Max        Hit  Miss  Trim Creat Need Ex-

Name        Size                 Free Free                          ed      tra

--------------------------------------------------------------------------------

Small        104    50   50   50   20  150     14141     0     0     0 

Middle       600    25   25   25   10   75        36     0     0     0 

Big         1524    50   50   50    5   40        18     0     0     0 

Large       5024     0    0    0    0   10         0     0     0     0 

Huge       18024     0    0    0    0    4         0     0     0     0 

Interface buffer pools:

Pool      Buffer Total Perm Free Min  Max        Hit  Fall Cache Cache Need Ex-

Name        Size                 Free Free            back Max   Free       tra

--------------------------------------------------------------------------------

Serial0     1524    96   96   31    0   96        65     0    32    32 

Serial1     1524    96   96   31    0   96        65     0    32    32 

Ethernet0   1524    96   96   32    0   96        64     0    32    32 

0 failures (0 no memory)

The following is sample output from the show buffers command when alloc is specified:

		Router# show buffers alloc

Buffer elements:

                            Free      Max        Hit  Miss      Creat

                                      Free                         ed

--------------------------------------------------------------------------------

                             427       500     18589     0          0

Public buffer pools:

Pool      Buffer Total Perm Free Min  Max        Hit  Miss  Trim Creat Need Ex-

Name        Size                 Free Free                          ed      tra

--------------------------------------------------------------------------------

Small        104    50   50   50   20  150     14982     0     0     0 

Middle       600    25   25   25   10   75        36     0     0     0 

Big         1524    50   50   50    5   40        18     0     0     0 

Large       5024     0    0    0    0   10         0     0     0     0 

Huge       18024     0    0    0    0    4         0     0     0     0 

0 failures (0 no memory)

Address  PakAddr  Data     Off Data  Pool  Ref Link Enc     Flags Output  Input

                  Area     set Size        Cnt Type Type    (Hex) Idb     Idb

--------------------------------------------------------------------------------

604A8C20 604A8C40 40007550  84     0 Seria   1    0    0        0              

604B6A80 604B6AA0 40007BD4  84     0 Seria   1    0    0        0              

.

show cdp

To display global CDP information, including timer and hold-time information, use the show cdp privileged EXEC command.

show cdp

Syntax Description

This command has no arguments or keywords.

Command Mode

Privileged EXEC

Sample Display

The following is sample output from the show cdp command. Global CDP timer and hold-time parameters are set to the defaults of 60 and 180 seconds, respectively.

Router# show cdp 

Global CDP information:

        Sending CDP packets every 60 seconds

        Sending a holdtime value of 180 seconds

Related Commands

cdp holdtime
cdp timer
show cdp entry
show cdp neighbors

show cdp entry

To display information about a neighbor device listed in the CDP table, use the show cdp entry privileged EXEC command.

show cdp entry entry-name [protocol | version]

Syntax Description

entry-name	Name of neighbor about which you want information.
protocol	(Optional) Limits the display to information about the protocols enabled on a device.
version	(Optional) Limits the display to information about the version of software running on the device.

Command Mode

Privileged EXEC

Sample Displays

The following is sample output from the show cdp entry command with no limits. Information about the neighbor device.cisco.com is displayed, including device ID, address and protocol, platform, interface, hold-time, and version.

Router# show cdp entry device.cisco.com 

Device ID: device.cisco.com

Entry address(es): 

  IP address: 172.30.68.18

  CLNS address: 490001.1111.1111.1111.00

  DECnet address: 10.1

Platform: AGS,  Capabilities: Router Trans-Bridge 

Interface: Ethernet0,  Port ID (outgoing port): Ethernet0

Holdtime : 155 sec

Version :

GS Software (GS3), Experimental Version 10.2(10302) [asmith 161]

Copyright (c) 1986-1994 by cisco Systems, Inc.

Compiled Mon 07-Nov-94 14:34

The following is sample output from the show cdp entry privilege command. Only information about the protocols enabled on device-cisco.com is displayed.

Router# show cdp entry device.cisco.com protocol 

Protocol information for device.cisco.com :

  IP address: 172.30.68.18

  CLNS address: 490001.1111.1111.1111.00

  DECnet address: 10.1

The following is sample output from the show cdp entry version command. Only information about the version of software running on device.cisco.com is displayed.

Router# show cdp entry device.cisco.com version 

Version information for device.cisco.com :

  GS Software (GS3), Experimental Version 10.2(10302) [asmith 161]

Copyright (c) 1986-1994 by cisco Systems, Inc.

Compiled Mon 07-Nov-94 14:34

Related Command

show cdp neighbors

show cdp interface

To display information about the interfaces on which CDP is enabled, use the show cdp interface privileged EXEC command.

show cdp interface [type number]

Syntax Description

type	(Optional) Type of interface about which you want information.
number	(Optional) Number of the interface about which you want information.

Command Mode

Privileged EXEC

Sample Displays

The following is sample output from the show cdp interface command. Status information and information about CDP timer and hold-time settings is displayed for all interfaces on which CDP is enabled.

Router# show cdp interface 

Serial0 is up, line protocol is up, encapsulation is SMDS

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

Ethernet0 is up, line protocol is up, encapsulation is ARPA

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

The following is sample output from the show cdp interface command with an interface specified. Status information and information about CDP timer and hold-time settings is displayed for Ethernet interface 0 only.

Router# show cdp interface ethernet 0 

Ethernet0 is up, line protocol is up, encapsulation is ARPA

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

show cdp neighbors

To display information about neighbors, use the show cdp neighbors privileged EXEC command.

show cdp neighbors [interface-type interface-number] [detail]

Syntax Description

interface-type	(Optional) Type of the interface connected to the neighbors about which you want information.
interface-number	(Optional) Number of the interface connected to the neighbors about which you want information.
detail	(Optional) Displays detailed information about a neighbor (or neighbors) including network address, enabled protocols, hold time, and software version.

Command Mode

Privileged EXEC

Sample Displays

The following is sample output from the show cdp neighbors command. Device ID, interface type and number, hold-time settings, capabilities, platform, and port ID information about the access server's neighbors are displayed.

Router# show cdp neighbors 

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

                  S - Switch, H - Host, I - IGMP

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID

device.cisco.com      Eth 0          151         R T        AGS       Eth 0

device.cisco.com      Ser 0          165         R T        AGS       Ser 3

The following is sample output from the show cdp neighbors detail command. Additional detail is shown about the access server's neighbors, including network address, enabled protocols, and software version:

Router# show cdp neighbors detail  

Device ID: device.cisco.com

Entry address(es): 

  IP address: 172.30.68.18

  CLNS address: 490001.1111.1111.1111.00

  DECnet address: 10.1

Platform: AGS,  Capabilities: Router Trans-Bridge 

Interface: Ethernet0,  Port ID (outgoing port): Ethernet0

Holdtime : 143 sec

Version :

GS Software (GS3), Experimental Version 10.2(10302) [asmith 161]

Copyright (c) 1986-1994 by cisco Systems, Inc.

Compiled Mon 07-Nov-94 14:34

Related Command

show cdp entry

show cdp traffic

To display traffic information from the CDP table, use the show cdp traffic privileged EXEC command.

show cdp traffic

Syntax Description

This command has no arguments or keywords.

Command Mode

Privileged EXEC

Sample Display

The following is sample output from the show cdp traffic command.

Router# show cdp traffic

CDP counters :

        Packets output: 94, Input: 75

        Hdr syntax: 0, Chksum error: 0, Encaps failed: 0

        No memory: 0, Invalid packet: 0, Fragmented: 0

In this example, traffic information is displayed, which includes the numbers of packets sent, the number of packets received, header syntax, checksum errors, failed encapsulations, memory problems, and invalid and fragmented packet. Header syntax indicates the number of packets CDP receives that have an invalid header format.

show clock

To display the system clock, use the show clock EXEC command:

show clock [detail]

Syntax Description

detail

(Optional) Indicates the clock source (NTP) and the current summer-time setting, if any.

Command Mode

EXEC

Usage Guidelines

The system clock keeps an "authoritative" flag that indicates whether or not the time is authoritative (believed to be accurate). If system clock has been set by a timing source (NTP), the flag is set. If the time is not authoritative, it will be used only for display purposes. Until the clock is authoritative and the "authoritative" flag is set, the flag prevents the access server from causing peers to synchronize to the server when its time is invalid.

The symbol that precedes the show clock display indicates the following:

Symbol	Description
*	Time is not authoritative.
(blank)	Time is authoritative.
.	Time is authoritative, but NTP is not synchronized.

Sample Display

The following sample output shows that the current clock is authoritative and that the time source is NTP:

Router# show clock detail

15:29:03.158 PST Mon Mar 1 1993

Time source is NTP

Router#

Related Command

clock set

show debugging

To display information about the types of CDP debugging that are enabled for your access server, use the show debugging privileged EXEC command.

show debugging

Syntax Description

This command has no arguments or keywords.

Command Mode

Privileged EXEC

Sample Display

The following is sample output from the show debug command:

Router# show debugging 

CDP:

  CDP packet info debugging is on

  CDP events debugging is on

  CDP neighbor info debugging is on

CDP-PA: Packet received from neon.cisco.com on interface Ethernet0

CDP-EV: Encapsulation on interface Serial0 failed

CDP-AD: Aging entry for neon.cisco.com, on interface Ethernet0

In this example, all three types of CDP debugging are enabled.

Related Commands

A dagger (†) indicates that the command is documented in the Debug Command Reference.

debug cdp packets†
debug cdp adjacency†
debug cdp events†

show ip accounting

To display the active accounting or checkpointed database or to display access-list violations, use the show ip accounting privileged EXEC command.

show ip accounting [checkpoint] [output-packets | access-violations]

Syntax Description

checkpoint	(Optional) Indicates that the checkpointed database should be displayed.
output-packets	(Optional) Indicates that information pertaining to packets that passed access control and were successfully routed should be displayed. This is the default value if neither output-packets nor access-violations is specified.
access-violations	(Optional) Indicates that information pertaining to packets that failed access lists and were not routed should be displayed.

Defaults

If neither the output-packets nor access-violations keyword is specified, show ip accounting displays information pertaining to packets that passed access control and were successfully routed.

Command Mode

EXEC

Usage Guidelines

To use this command, you must first enable IP accounting on a per-interface basis.

Example

The following example displays information pertaining to packets that failed access lists and were not router (see sample display for command).

show ip accounting access-violations

Sample Display

Following is sample output from the show ip accounting command:

Router# show ip accounting

   Source           Destination              Packets               Bytes     

 172.30.19.40     172.30.67.20                     7                 306

 172.30.13.55     172.30.67.20                    67                2749

 172.30.2.50      172.30.33.51                    17                1111

 172.30.2.50      172.30.2.1                       5                 319

 172.30.2.50      172.30.1.2                     463               30991

 172.30.19.40     172.30.2.1                       4                 262

 172.30.19.40     172.30.1.2                      28                2552

 172.30.20.2     172.30.6.100                    39                2184

 172.30.13.55    172.30.1.2                      35                3020

 172.30.19.40    172.30.33.51                  1986               95091

 172.30.2.50     172.30.67.20                   233               14908

 172.30.13.28    172.30.67.53                   390               24817

 172.30.13.55    172.30.33.51                214669             9806659

 172.30.13.111   172.30.6.23                  27739             1126607

 172.30.13.44    172.30.33.51                 35412             1523980

 172.30.7.21     172.30.1.2                      11                 824

 172.30.13.28    172.30.33.2                     21                1762

 172.30.2.166    172.30.7.130                   797              141054

 172.30.3.11     172.30.67.53                     4                 246

 172.30.7.21     172.30.33.51                 15696              695635

 172.30.7.24     172.30.67.20                    21                 916

 172.30.13.111   172.30.10.1                     16                1137

describes significant fields shown in the display.

Table 5-21 Show IP Accounting Field Descriptions

Field	Description
Source	Source address of the packet
Destination	Destination address of the packet
Packets	Number of packets transmitted from the source address to the destination address
Bytes	Number of bytes transmitted from the source address to the destination address

Following is sample output from the show ip accounting access-violations command:

Router# show ip accounting access-violations

  Source          Destination        Packets        Bytes      ACL 
  172.30.19.40   172.30.67.20       7              306        77

  172.30.13.55   172.30.67.20       67             2749       185

  172.30.2.50    172.30.33.51       17             1111       140

  172.30.2.50    172.30.2.1         5              319        140

  172.30.19.40   172.30.2.1         4              262        77

Accounting data age is 41

describes significant fields shown in the display.

Table 5-22 Show IP Accounting Access-Violation Field Descriptions

Field	Description
Source	Source address of the packet
Destination	Destination address of the packet
Packets	For accounting keyword, number of packets transmitted from the source address to the destination address For access-violations keyword, number of packets transmitted from the source address to the destination address that violated the access control list
Bytes	For accounting keyword, number of bytes transmitted from the source address to the destination address For access-violations keyword, number of bytes transmitted from the source address to the destination address that violated the access-control list
ACL	Number of the access list of the last packet transmitted from the source to the destination that failed an access list

Related Commands

A dagger (†) indicates that the command is documented in another chapter.

clear ip accounting†
ip accounting†
ip accounting-list†
ip accounting-threshold†
ip accounting-transits†

show logging

Use the show logging EXEC command to display the state of logging (syslog).

show logging

Syntax Description

This command has no arguments or keywords.

Command Mode

EXEC

Usage Guidelines

This command displays the state of syslog error and event logging, including host addresses, and whether console logging is enabled. This command also displays Simple Network Management Protocol (SNMP) configuration parameters and protocol activity.

Sample Display

The following is sample output from the show logging command:

Router# show logging

Syslog logging: enabled

     	Console logging: disabled

     	Monitor logging: level debugging, 266 messages logged.

     	Trap logging: level informational, 266 messages logged.

     	Logging to 172.30.2.238

SNMP logging: disabled, retransmission after 30 seconds

    0 messages logged

describes significant fields shown in the display.

Table 5-23 Show Logging Field Descriptions

Field	Description
Syslog logging	When enabled, system logging messages are sent to a UNIX host that acts as a syslog server; that is, it captures and saves the messages.
Console logging	If enabled, states the level; otherwise, this field displays disabled.
Monitor logging	Minimum level of severity required for a log message to be sent to a monitor terminal (not the console).
Trap logging	Minimum level of severity required for a log message to be sent to a syslog server.
SNMP logging	Shows whether SNMP logging is enabled and the number of messages logged, and the retransmission interval.

show memory

Use the show memory EXEC command to show statistics about the access server's memory, including memory free pool statistics.

show memory [type] [free]

Syntax Description

type	(Optional) Memory type to display (processor, multibus, io, sram). If type is not specified, statistics for all memory types present in the access server will be displayed.
free	(Optional) Displays free memory statistics.

Command Mode

EXEC

Sample Displays

The following is sample output from the show memory command:

Router# show memory

               Head  FreeList    Total(b)     Used(b)     Free(b)  Largest(b)

Processor    2E0FF8    2AABFC    13758472      847216    12911256    12908036

          Processor memory

Address   Bytes Prev.   Next     Ref  PrevF   NextF   Alloc PC  What

2E0FF8     2128 0       2E1848     1                  84352     *Init*

2E1848     2052 2E0FF8  2E204C     1                  86184     *Init*

2E204C      564 2E1848  2E2280     1                  861B0     *Init*

2E2280     2052 2E204C  2E2A84     1                  1266      *Init*

2E2A84      308 2E2280  2E2BB8     1                  44974     *Init*

2E2BB8      220 2E2A84  2E2C94     1                  3F788     *Init*

2E2C94     2052 2E2BB8  2E3498     1                  3F7A8     *Init*

2E3498     4052 2E2C94  2E446C     1                  46770     *Init*

2E446C      516 2E3498  2E4670     1                  44E4C     *Packet Buffer*

2E4670      516 2E446C  2E4874     1                  44E4C     *Packet Buffer*

2E4874      516 2E4670  2E4A78     1                  44E4C     *Packet Buffer*

2E4A78      516 2E4874  2E4C7C     1                  44E4C     *Packet Buffer*

2E4C7C      516 2E4A78  2E4E80     1                  44E4C     *Packet Buffer*

2E4E80      516 2E4C7C  2E5084     1                  44E4C     *Packet Buffer*

2E5084      516 2E4E80  2E5288     1                  44E4C     *Packet Buffer*

2E5288      516 2E5084  2E548C     1                  44E4C     *Packet Buffer*

2E548C      516 2E5288  2E5690     1                  44E4C     *Packet Buffer*

2E5690      516 2E548C  2E5894     1                  44E4C     *Packet Buffer*

The following is sample output from the show memory free command:

Router# show memory free

               Head  FreeList    Total(b)     Used(b)     Free(b)  Largest(b)

Processor    2E0FF8    2AABFC    13758472      847120    12911352    12908036

          Processor memory

Address   Bytes Prev.   Next     Ref  PrevF   NextF   Alloc PC  What

             72    Free list 1

             88    Free list 2

             96    Free list 3

384A04       96 38496C  384A64     0  0       0       1205A4    IGRP Router

            108    Free list 4

            124    Free list 5

                   Final freespace block

3B09FC 12908036 3B0834  0          0  0       0       76162     (coalesced)

The display of show memory free contains the same types of information as the show memory display, except that only free memory is displayed, and the information is displayed in order for each free list.

The first section of the display includes summary statistics about the activities of the system memory allocator. describes significant fields shown in the first section of the display.

Table 5-24 Show Memory Field Descriptions—Summary Statistics

Field	Description
Head	Hexadecimal address of the head of the memory allocation chain
FreeList	Hexadecimal address of the base of the free list
Total (b)	Sum of used bytes plus free bytes
Used (b)	Amount of memory in use
Free (b)	Amount of memory not in use
Largest (b)	Size of largest available free block

The second section of the display is a block-by-block listing of memory use. describes significant fields shown in the second section of the display.

Table 5-25 Show Memory Field Descriptions—Block Characteristics

Field	Description
Address	Hexadecimal address of block
Bytes	Size of block in bytes
Prev.	Address of previous block (should match Address on previous line)
Next	Address of next block (should match address on next line)
Ref	Reference count for that memory block, indicating how many different processes are using that block of memory
PrevF	Address of previous free block (if free)
NextF	Address of next free block (if free)
Alloc PC	Address of the system call that allocated the block
What	Name of process that owns the block, or "(fragment)" if the block is a fragment, or "(coalesced)" if the block was coalesced from adjacent free blocks

The show memory io command displays the free IO memory blocks. On the Cisco 2500, this command quickly shows how much unused IO memory is available.

The following is sample output from the show memory io command:

cs1# show memory io

I/O memory

 Address  Bytes Prev.    Next     Ref  PrevF   NextF   Alloc PC  What

100000      212 0        1000F8     1                  3000F2C   *Packet Data*

1000F8      212 100000   1001F0     1                  3000F2C   *Packet Data*

1001F0      212 1000F8   1002E8     1                  3000F2C   *Packet Data*

   .         .     .        .       .                     .            .

   .         .     .        .       .                     .            .

   .         .     .        .       .                     .            .

14AB94     4528 14A510   14BD68     0  146134  0       0         (fragment)

14BD68     1632 14AB94   14C3EC     1                  3001C74   *Packet Data*

14C3EC   736240 14BD68   0          0  0       0       0         (fragment)

The show memory command on the Cisco 2500 includes information about processor and IO memory, and appears as follows:

cs1# show memory

   Head  FreeList    Total(b)     Used(b)     Free(b)  Largest(b)

Processor     66ABC     2DD1C      628036      579460       48576       36096

      I/O    100000     32A14     1048576      179192      869384      736240

Processor memory

 Address  Bytes Prev.    Next     Ref  PrevF   NextF   Alloc PC  What

66ABC      2408 0        67448      1                  30196A0   TTY data

67448      2000 66ABC    67C3C      1                  301B640   TTY Input Buf

  .          .    .        .        .                     .           .

  .          .    .        .        .                     .           .

  .          .    .        .        .                     .           .

14AB94     4528 14A510   14BD68     0  146134  14542C  0         (fragment)

14BD68     1632 14AB94   14C3EC     1                  3001C74   *Packet Data*

14C3EC   736240 14BD68   0          0  0       0       0         (fragment)

cs1#

show ntp associations

To show the status of Network Time Protocol (NTP) associations, use the show ntp associations EXEC command.

show ntp associations [detail]

Syntax Description

detail

(Optional) Shows detailed information about each NTP association.

Command Mode

EXEC

Sample Displays

Detailed descriptions of the information displayed by this command can be found in the NTP specification (RFC 1305).

The following is sample output from the show ntp associations command:

Router# show ntp associations

     address         ref clock     st  when  poll reach  delay  offset    disp

 ~172.30.32.2      172.30.32.1       5    29  1024  377     4.2   -8.59     1.6

+~172.30.13.33    172.30.1.111     3    69   128  377     4.1    3.48     2.3

*~172.30.13.57    172.30.1.111     3    32   128  377     7.9   11.18     3.6

* master (synced), # master (unsynced), + selected, - candidate, ~ configured

describes significant fields shown in the display.

Table 5-26 Show NTP Associations Field Descriptions

Field	Description
(leading characters in display lines)	The first characters in a display line can be one or more of the following characters: * Synchronized to this peer # Almost synchronized to this peer + Peer selected for possible synchronization - Peer is a candidate for selection ~ Peer is statically configured
address	Address of peer.
ref clock	Address of peer's reference clock.
st	Peer's stratum.
when	Time since last NTP packet received from peer.
poll	Polling interval (seconds).
reach	Peer reachability (bit string, in octal).
delay	Round-trip delay to peer (milliseconds).
offset	Relative time of peer's clock to local clock (milliseconds).
disp	Dispersion

The following is sample output of the show ntp associations detail command:

Router# show ntp associations detail

172.30.32.2 configured, insane, invalid, stratum 5

ref ID 172.30.32.1, time AFE252C1.6DBDDFF2 (00:12:01.428 PDT Mon Jul 5 1993)

our mode active, peer mode active, our poll intvl 1024, peer poll intvl 64

root delay 137.77 msec, root disp 142.75, reach 376, sync dist 215.363

delay 4.23 msec, offset -8.587 msec, dispersion 1.62

precision 2**19, version 3

org time AFE252E2.3AC0E887 (00:12:34.229 PDT Mon Jul 5 1993)

rcv time AFE252E2.3D7E464D (00:12:34.240 PDT Mon Jul 5 1993)

xmt time AFE25301.6F83E753 (00:13:05.435 PDT Mon Jul 5 1993)

filtdelay =     4.23    4.14    2.41    5.95    2.37    2.33    4.26    4.33

filtoffset =   -8.59   -8.82   -9.91   -8.42  -10.51  -10.77  -10.13  -10.11

filterror =     0.50    1.48    2.46    3.43    4.41    5.39    6.36    7.34

172.30.13.33 configured, selected, sane, valid, stratum 3

ref ID 172.30.1.111, time AFE24F0E.14283000 (23:56:14.078 PDT Sun Jul 4 1993)

our mode client, peer mode server, our poll intvl 128, peer poll intvl 128

root delay 83.72 msec, root disp 217.77, reach 377, sync dist 264.633

delay 4.07 msec, offset 3.483 msec, dispersion 2.33

precision 2**6, version 3

org time AFE252B9.713E9000 (00:11:53.442 PDT Mon Jul 5 1993)

rcv time AFE252B9.7124E14A (00:11:53.441 PDT Mon Jul 5 1993)

xmt time AFE252B9.6F625195 (00:11:53.435 PDT Mon Jul 5 1993)

filtdelay =     6.47    4.07    3.94    3.86    7.31    7.20    9.52    8.71

filtoffset =    3.63    3.48    3.06    2.82    4.51    4.57    4.28    4.59

filterror =     0.00    1.95    3.91    4.88    5.84    6.82    7.80    8.77

172.30.13.57 configured, our_master, sane, valid, stratum 3

ref ID 172.30.1.111, time AFE252DC.1F2B3000 (00:12:28.121 PDT Mon Jul 5 1993)

our mode client, peer mode server, our poll intvl 128, peer poll intvl 128

root delay 125.50 msec, root disp 115.80, reach 377, sync dist 186.157

delay 7.86 msec, offset 11.176 msec, dispersion 3.62

precision 2**6, version 2

org time AFE252DE.77C29000 (00:12:30.467 PDT Mon Jul 5 1993)

rcv time AFE252DE.7B2AE40B (00:12:30.481 PDT Mon Jul 5 1993)

xmt time AFE252DE.6E6D12E4 (00:12:30.431 PDT Mon Jul 5 1993)

filtdelay =    49.21    7.86    8.18    8.80    4.30    4.24    7.58    6.42

filtoffset =   11.30   11.18   11.13   11.28    8.91    9.09    9.27    9.57

filterror =     0.00    1.95    3.91    4.88    5.78    6.76    7.74    8.71   

describes significant fields shown in the display.

Table 5-27 Show NTP Associations Detail Field Descriptions

Field	Descriptions
configured	Peer was statically configured.
dynamic	Peer was dynamically discovered.
our_master	Local machine is synchronized to this peer.
selected	Peer is selected for possible synchronization.
candidate	Peer is a candidate for selection.
sane	Peer passes basic sanity checks.
insane	Peer fails basic sanity checks.
valid	Peer time is believed to be valid.
invalid	Peer time is believed to be invalid.
leap_add	Peer is signaling that a leap second will be added.
leap-sub	Peer is signaling that a leap second will be subtracted.
unsynced	Peer is not synchronized to any other machine.
ref ID	Address of machine peer is synchronized to.
time	Last timestamp peer received from its master.
our mode	Our mode relative to peer (active / passive / client / server / bdcast / bdcast client).
peer mode	Peer's mode relative to us.
our poll ivl	Our poll interval to peer.
peer poll ivl	Peer's poll interval to us.
root delay	Delay along path to root (ultimate stratum 1 time source).
root disp	Dispersion of path to root.
reach	Peer reachability (bit string in octal).
sync dist	Peer synchronization distance.
delay	Round-trip delay to peer.
offset	Offset of peer clock relative to our clock.
dispersion	Dispersion of peer clock.
precision	Precision of peer clock in Hz.
version	NTP version number that peer is using.
org time	Originate timestamp.
rcv time	Receive timestamp.
xmt time	Transmit timestamp.
filtdelay	Round-trip delay in milliseconds of each sample.
filtoffset	Clock offset in milliseconds of each sample.
filterror	Approximate error of each sample.