-
Cisco IOS Multiprotocol Label Switching Command Reference
-
MPLS Commands: A through L
-
MPLS Commands: match mpls label through mpls label range
-
MPLS Commands: mpls ldp address-message through mpls ldp tcp pak-priority
-
MPLS Commands: mpls mtu through mpls traffic-eng tunnels
-
MPLS Commands: neighbor activate through show controllers xtagatm
-
MPLS Commands: show interface xtagatm through show isis mpls traffic-eng tunnel
-
MPLS Commands: show xtagatm cos-bandwidth-allocation through xconnect
-
MPLS Commands: show mpls atm-ldp bindings through show mpls traffic-eng summary
-
Introduction
-
Table Of Contents
bgp default route-target filter
clear mpls traffic-eng auto-bw timers
encapsulation (Any Transport over MPLS)
encapsulation (Layer 2 Local Switching)
ip vrf forwarding (interface configuration)
address-family
To enter the address family submode for configuring routing protocols such as Border Gateway Protocol (BGP), Routing Information Protocol (RIP), and static routing, use the address-family command in address family configuration submode. To disable the address family submode for configuring routing protocols, use the no form of this command.
VPN-IPv4 Unicast
address-family vpnv4 [unicast]
no address-family vpnv4 [unicast]
IPv4 Unicast
address-family ipv4 [unicast]
no address-family ipv4 [unicast]
IPv4 Unicast with CE router
address-family ipv4 [unicast] vrf vrf-name
no address-family ipv4 [unicast] vrf vrf-name
Syntax Description
Defaults
Routing information for address family IPv4 is advertised by default when you configure a BGP session using the neighbor remote-as command unless you execute the no bgp default ipv4-activate command.
Command Modes
Address family configuration
Command History
Usage Guidelines
Using the address-family command puts the router in address family configuration submode (prompt: (config-router-af)# ). Within this submode, you can configure address-family specific parameters for routing protocols, such as BGP, that can accommodate multiple Layer 3 address families.
To leave address family configuration submode and return to router configuration mode, enter the exit-address-family or exit command.
Examples
The address-family command in the following example puts the router into address family configuration submode for the VPNv4 address family. Within the submode, you can configure advertisement of Network Layer Reachability Information (NLRI) for the VPNv4 address family using neighbor activate and other related commands:
router bgp 100address-family vpnv4The address-family command in the following example puts the router into address family configuration submode for the IPv4 address family. Use this form of the command, which specifies a VRF, only to configure routing exchanges between provider edge (PE) and customer edge (CE) devices. This address-family command causes subsequent commands entered in the submode to be executed in the context of VRF vrf2. Within the submode, you can use neighbor activate and other related commands to accomplish the following:
•
Configure advertisement of IPv4 NLRI between the PE and CE routers.
•
•
The following example shows how to enter the address family submode:
Router(config)# router bgp 100Router(config-router)# address-family ipv4 unicast vrf vrf2Related Commands
default
Exits from address family submode.
neighbor activate
Enables the exchange of information with a neighboring router.
append-after
To insert a path entry after a specified index number, use the append-after command in IP explicit path configuration mode.
append-after index command
Syntax Description
Defaults
No path entry is inserted after a specified index number.
Command Modes
IP explicit path configuration
Command History
Examples
In the following example, the next-address command is inserted after index 5:
Router(config-ip-expl-path)# append-after 5 next-address 3.3.27.3Related Commands
bgp default route-target filter
To enable automatic Border Gateway Protocol (BGP) route-target community filtering, use the bgp default route-target filter command in router configuration mode. To disable automatic BGP route-target community filtering, use the no form of this command.
bgp default route-target filter
no bgp default route-target filter
Syntax Description
This command has no arguments or keywords.
Defaults
This command is enabled.
Command Modes
Router configuration
Command History
Usage Guidelines
Use the bgp default route-target filter command to control the distribution of Virtual Private Network (VPN) routing information through the list of VPN route-target communities.
When you use the no form of this command, all received VPN-IPv4 routes are accepted by the configured router. Accepting VPN-IPv4 routes is the desired behavior for a router configured as an autonomous system border edge router or as a customer edge (CE) BGP border edge router.
If you configure the router for BGP route-target community filtering, all received exterior BGP (EBGP) VPN-IPv4 routes are discarded when those routes do not contain a route-target community value that matches the import list of any configured VPN routing/forwarding instances (VRFs). This is the desired behavior for a router configured as a provider edge (PE) router.
Note
Examples
In the following example, BGP route-target filtering is disabled for autonomous system 120:
Router(config)# router bgp 120Router(config-router)# no bgp default route-target filterRelated Commands
bgp scan-time
To configure scanning intervals of Border Gateway Protocol (BGP) routers for next hop validation or to decrease import processing time of Virtual Private Network version 4 (VPNv4) routing information, use the bgp scan-time command in address family or router configuration mode. To return the scanning interval of a router to its default scanning interval of 15 seconds, use the no form of this command.
bgp scan-time [import] scanner-interval
no bgp scan-time [import] scanner-interval
Syntax Description
Defaults
The default scanning interval is 15 seconds.
Command Modes
Address family configuration
Router configurationCommand History
Usage Guidelines
The import keyword is supported in address family VPNv4 unicast mode only.
Entering the no form of this command does not disable scanning, but removes it from the output of the show running-config command.
Examples
In the following router configuration example, the scanning interval for next hop validation of IPv4 unicast routes for BGP routing tables is set to 20 seconds:
router bgp 100no synchronizationbgp scan-time 20In the following address family configuration example, the scanning interval for next hop validation of address family VPNv4 unicast routes for BGP routing tables is set to 45 seconds:
router bgp 150address-family vpn4 unicastbgp scan-time 45In the following address family configuration example, the scanning interval for importing address family VPNv4 routes into IP routing tables is set to 30 seconds:
router bgp 150address-family vpnv4 unicastbgp scan-time import 30Related Commands
class (MPLS)
To configure a defined Multiprotocol Label Switching (MPLS) class of service (CoS) map that specifies how classes map to label switched controlled virtual circuits (LVCs) when combined with a prefix map, use the class command in CoS map submode. To remove the defined MPLS CoS map, use the no form of this command.
class class [available | standard | premium |control]
no class class [available | standard | premium |control]
Syntax Description
Defaults
This command is disabled.
Command Modes
CoS map submode
Command History
Examples
The following example shows how to configure a CoS map:
Router(config)# mpls cos-map 55Router(config-mpls-cos-map)# class 1 premiumRouter(config-mpls-cos-map)# exitRelated Commands
clear ip route vrf
To remove routes from the Virtual Private Network (VPN) routing/forwarding instance (VRF) routing table, use the clear ip route vrf command in user EXEC or privileged EXEC mode.
clear ip route vrf vrf-name {* | network [mask]}
Syntax Description
Command Modes
User EXEC
Privileged EXECCommand History
Usage Guidelines
Use this command to clear routes from the routing table. Use the asterisk (*) to delete all routes from the forwarding table for a specified VRF, or enter the address and mask of a particular network to delete the route to that network.
Examples
The following command shows how to remove the route to the network 10.13.0.0 in the vpn1 routing table:
Router# clear ip route vrf vpn1 10.13.0.0Related Commands
clear mpls ldp neighbor
To forcibly reset a label distribution protocol (LDP) session, use the clear mpls ldp neighbor command in privileged EXEC mode.
clear mpls ldp neighbor [vrf vpn-name] {nbr-address | *}
Syntax Description
Defaults
No default behavior or values
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The clear mpls ldp neighbor command terminates the specified LDP sessions. The LDP sessions should be reestablished if the LDP configuration remains unchanged.
You can clear an LDP session for an interface-specific label space of an LSR by issuing the no mpls ip command and then the mpls ip command on the interface associated with the LDP session.
Examples
The following example resets an LDP session:
Router# clear mpls ldp neighbor 12.12.12.12To verify the results of the clear mpls ldp neighbor command, enter the show mpls ldp neighbor command. Notice the value in the "Up time" field.
Router# show mpls ldp neighbor 12.12.12.12Peer LDP Ident: 12.12.12.12:0; Local LDP Ident 13.13.13.13:0TCP connection: 12.12.12.12.646 - 13.13.13.13.15093State: Oper; Msgs sent/rcvd: 142/138; DownstreamUp time: 02:16:28LDP discovery sources:Serial1/0, Src IP addr: 25.0.0.2Addresses bound to peer LDP Ident:2.0.0.129 12.12.12.12 25.0.0.2 32.1.0.521.7.0.1Then enter the following clear mpls ldp neighbor 12.12.12.12 command. With mpls ldp logging configured, the easiest way to verify the clear mpls ldp neighbor command is to monitor the LDP log messages.
Router# clear mpls ldp neighbor 12.12.12.121w1d: %LDP-5-CLEAR_NBRS: Clear LDP neighbors (12.12.12.12) by console1w1d: %LDP-5-NBRCHG: LDP Neighbor 12.12.12.12:0 is DOWN1w1d: %LDP-5-NBRCHG: LDP Neighbor 12.12.12.12:0 is UPReenter the show mpls ldp neighbor 12.12.12.12 command. Notice that the "Up time" value has been reset.
Router# show mpls ldp neighbor 12.12.12.12Peer LDP Ident: 12.12.12.12:0; Local LDP Ident 13.13.13.13:0TCP connection: 12.12.12.12.646 - 13.13.13.13.15095State: Oper; Msgs sent/rcvd: 125/121; DownstreamUp time: 00:00:05LDP discovery sources:Serial1/0, Src IP addr: 25.0.0.2Addresses bound to peer LDP Ident:2.0.0.129 12.12.12.12 25.0.0.2 32.1.0.521.7.0.1The following example resets all LDP sessions:
Router# clear mpls ldp neighbor *Related Commands
clear mpls traffic-eng auto-bw timers
To reinitialize the automatic bandwidth adjustment feature on a platform, use the clear mpls traffic-eng auto-bw timers command in user EXEC or privileged EXEC mode.
clear mpls traffic-eng auto-bw timers
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC
Privileged EXECCommand History
Usage Guidelines
For each tunnel for which automatic bandwidth adjustment is enabled, the platform maintains information about sampled output rates and the time remaining until the next bandwidth adjustment. The clear mpls traffic-eng auto-bw timers command clears this information for all such tunnels. The effect is as if automatic bandwidth adjustment had just been enabled for the tunnels.
Examples
The following example shows how to clear information about sampled output rates and the time remaining until the next bandwidth adjustment:
Router# clear mpls traffic-eng auto-bw timersClear mpls traffic engineering auto-bw timers [confirm]Related Commands
connect (Frame Relay)
To define connections between Frame Relay permanent virtual circuits (PVCs), use the connect command in global configuration mode. To remove connections, use the no form of this command.
connect connection-name interface dlci {interface dlci | l2transport}
no connect connection-name interface dlci {interface dlci | l2transport}
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
When Frame Relay switching is enabled, the connect command creates switched PVCs in Frame Relay networks.
Examples
The following example shows how to define a connection called "frompls1" with DLCI 100 on serial interface 5/0.
connect frompls1 Serial5/0 100 l2transportThe following example shows how to enable Frame Relay switching and define a connection called "one" between DLCI 16 on serial interface 0 and DLCI 100 on serial interface 1.
frame-relay switchingconnect one serial0 16 serial1 100Related Commands
frame-relay switching
Enables PVC switching on a Frame Relay DCE or NNI.
mpls l2transport route
Enables routing of Frame Relay packets over a specified VC.
encapsulation (Any Transport over MPLS)
To configure the ATM adaptation layer (AAL) encapsulation for an Any Transport over MPLS (AToM), use the encapsulation command in the appropriate configuration mode. To remove the ATM encapsulation, use the no form of this command.
encapsulation layer-type
no encapsulation layer-type
Syntax Description
layer-type
The adaptation layer type. Possible values are:
aal5—ATM adaptation layer 5
aal0—ATM adaptation layer 0
Defaults
The default encapsulation is AAL5.
Command Modes
L2transport VC configuration for an ATM PVC
VC class for a VC class
Command History
Usage Guidelines
In L2transport VC configuration mode, the pvc command and the encapsulation command work together. How you use the commands for AToM is slightly different than for all other applications. The following table shows the differences in how the commands are used:
Router(config-if)# pvc 1/100
Router(config-if-atm-vc)# encapsulation aal5snap
Router(config-if)# pvc 1/100 l2transport
Router(config-if-atm-l2trans-pvc)# encapsulation aal5
The following list highlights the differences:
•
•
•
When you use the aal5 keyword, incoming cells (except Operation, Administration, and Maintenance [OAM] cells) on that PVC are treated as AAL5 encapsulated packets. The router reassembles the packet from the incoming cells. The router does not check the contents of the packet, so it does not need to know the encapsulation type (such as aal5snap, aal5mux, and so on). After imposing the Multiprotocol Label Switching (MPLS) label stack, the router sends the reassembled packet over the MPLS core network.
When you use the aal0 keyword, the router strips the header error control (HEC) byte from the cell header and adds the MPLS label stack. The router sends the cell over the MPLS core network.
Examples
The following example shows how to configure a PVC to transport ATM Cell Relay packets for AToM:
Router> enableRouter# configure terminalRouter(config)# interface atm1/0Router(config-if)# pvc 1/100 l2transportRouter(config-if-atm-l2trans-pvc)# encapsulation aal0Router(config-if-atm-l2trans-pvc)# xconnect 13.13.13.13 100 encapsulation mplsThe following example configures ATM AAL5 over MPLS in VC class configuration mode. The VC class is then applied to a PVC.
Router> enableRouter# configure terminalRouter(config)# vc-class atm aal5classRouter(config-vc-class)# encapsulation aal5Router(config)# interface atm1/0Router(config-if)# pvc 1/200 l2transportRouter(config-if-atm-l2trans-pvc)# class-vc aal5classRouter(config-if-atm-l2trans-pvc)# xconnect 13.13.13.13 100 encapsulation mplsRelated Commands
encapsulation (Layer 2 Local Switching)
To configure the ATM adaptation layer (AAL) for a Layer 2 local switching ATM permanent virtual circuit (PVC), use the encapsulation command in ATM PVC L2transport configuration mode. To remove an encapsulation from a PVC, use the no form of this command.
encapsulation layer-type
no encapsulation layer-type
Syntax Description
layer-type
Adaptation layer type. Possible values are:
aal5
aal0
aal5snap
aal5mux
aal5nlpid (not on Cisco 12000 series)
Defaults
If you do not create a PVC, one is created for you. The default encapsulation types for autoprovisioned PVCs are as follows:
•
•
Command Modes
ATM PVC L2transport configuration
Command History
Usage Guidelines
The pvc command and the encapsulation command work together. The use of these commands with Layer 2 local switching is slightly different from the use of these commands with other applications. The following list highlights the differences:
•
•
The following table shows the encapsulation types supported for each transport type:
Examples
The following example shows how to configure a PVC to transport AAL0 packets for Layer 2 local switching:
pvc 1/100 l2transportencapsulation aal0Related Commands
encapsulation dot1q
To enable IEEE 802.1q encapsulation of traffic on a specified subinterface in a virtual LAN (VLAN), use the encapsulation dot1q command in interface range configuration mode or subinterface configuration mode. To disable IEEE 802.1q encapsulation, use the no form of this command.
Interface Range Configuration Mode
encapsulation dot1q vlan-id [native]
no encapsulation dot1q
Subinterface Configuration Mode
encapsulation dot1q vlan-id second-dot1q {any | vlan-id | vlan-id-vlan-id[,vlan-id-vlan-id]}
no encapsulation dot1q vlan-id second-dot1q {any | vlan-id | vlan-id-vlan-id[,vlan-id-vlan-id]}
Syntax Description
Defaults
IEEE 802.1q encapsulation is disabled.
Command Modes
Interface range configuration
Subinterface configurationCommand History
Usage Guidelines
Interface Range Configuration Mode
IEEE 802.1q encapsulation is configurable on Fast Ethernet interfaces. IEEE 802.1q is a standard protocol for interconnecting multiple switches and routers and for defining VLAN topologies.
Use the encapsulation dot1q command in interface range configuration mode to apply a VLAN ID to each subinterface within the range specified by the interface range command. The VLAN ID specified by the vlan-id argument is applied to the first subinterface in the range. Each subsequent interface is assigned a VLAN ID, which is the specified vlan-id plus the subinterface number minus the first subinterface number (VLAN ID + subinterface number - first subinterface number).
Do not configure encapsulation on the native VLAN of an IEEE 802.1q trunk without using the native keyword. (Always use the native keyword when vlan-id is the ID of the IEEE 802.1q native VLAN.)
Subinterface Configuration Mode
Use the second-dot1q keyword to configure the IEEE 802.1Q-in-Q VLAN Tag Termination feature. Q-in-Q VLAN tag termination adds another layer of 802.1q tag (called "metro tag" or "PE-VLAN") to the 802.1q tagged packets that enter the network. Double tagging expands the VLAN space, allowing service providers to offer certain services such as Internet access on specific VLANs for some customers and other types of services on other VLANs for other customers.
After a subinterface is defined, use the encapsulation dot1q command to add outer and inner VLAN ID tags to allow one VLAN to support multiple VLANs. You can assign a specific inner VLAN ID to the subinterface; that subinterface is unambiguous. Or you can assign a range or ranges of inner VLAN IDs to the subinterface; that subinterface is ambiguous.
Examples
The following example shows how to create the subinterfaces within the range 0.11 and 0.60 and apply VLAN ID 101 to the Fast Ethernet0/0.11 subinterface, VLAN ID 102 to Fast Ethernet0/0.12 (vlan-id = 101 + 12 - 11 = 102), and so on up to VLAN ID 150 to Fast Ethernet0/0.60 (vlan-id = 101 + 60 - 11 = 150):
Router(config)# interface range fastethernet0/0.11 - fastethernet0/0.60Router(config-int-range)# encapsulation dot1q 101The following example shows how to terminate a Q-in-Q frame on an unambiguous subinterface with an outer VLAN ID of 100 and an inner VLAN ID of 200:
Router(config)# interface gigabitethernet1/0/0.1Router(config-subif)# encapsulation dot1q 100 second-dot1q 200The following example shows how to terminate a Q-in-Q frame on an ambiguous subinterface with an outer VLAN ID of 100 and an inner VLAN ID in the range from 100 to 199 or from 201 to 600:
Router(config)# interface gigabitethernet1/0/0.1Router(config-subif)# encapsulation dot1q 100 second-dot1q 100-199,201-600Related Commands
exit-address-family
To exit from address family configuration mode, use the exit-address-family command in address family configuration mode.
exit-address-family
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values
Command Modes
Address family configuration
Command History
12.0(5)T
This command was introduced.
12.0(22)S
EIGRP support was added.
12.2(15)T
EIGRP support was added.
Usage Guidelines
This command can be abbreviated to exit.
Examples
The following example shows how to exit address family configuration mode:
Router(config-router-af)# exit-address-familyRelated Commands
export map
To associate an export map with a VPN Routing and Forwarding (VRF) instance, use the export map command in VRF configuration mode.
export map route-map
Syntax Description
Defaults
No default behavior or values
Command Modes
IP VPN Routing/Forwarding configuration mode
Command History
Usage Guidelines
The export map command is used to associate a route map with the specified VRF. The export map is used to filter routes that are eligible for export out of a VRF, based on the route target extended community attributes of the route. Only one export route map can be configured for a VRF.
An export route map can be used when an application requires finer control over the routes that are exported out of a VRF than the control that is provided by import and export extended communities configured for the importing and exporting VRFs.
Examples
In the following example, an export is configured under the VRF and an access list and route map are configured to specify which prefixes are exported:
Router(config)# ip vrf REDRouter(config-vrf)# rd 1:1Router(config-vrf)# export map BLUERouter(config-vrf)# route-target import 2:1Router(config-vrf)# exitRouter(config)# access-list 1 permit 192.168.0.0 0.0.255.255Router(config)# route-map BLUE permit 10Router(config-route-map)# match ip address 1Router(config-route-map)# set extcommunity rt 2:1Router(config-route-map)# endRelated Commands
extended-port
To associate the currently selected extended Multiprotocol Label Switching (MPLS) ATM (XTagATM) interface with a particular external interface on the remotely controlled ATM switch, use the extended-port command in interface configuration mode.
extended-port ctrl-if {bpx bpx-port-number | descriptor vsi-descriptor | vsi vsi-port-number}
Syntax Description
Defaults
Extended MPLS ATM interfaces are not associated.
Command Modes
Interface configuration
Command History
Usage Guidelines
The extended-port interface configuration command associates an XTagATM interface with a particular external interface on the remotely controlled ATM switch. The three alternate forms of the command permit the external interface on the controlled ATM switch to be specified in three different ways.
Examples
The following example shows how to associate an extended MPLS ATM interface and bind it to BPX port 2.3:
ATM(config)# interface XTagATM23ATM(config-if)# extended-port atm0/0 bpx 2.3The following example shows how to associate an extended MPLS ATM interface and bind it to port 2.4:
ATM(config)# interface XTagATM24ATM(config-if)# extended-port atm0/0 descriptor 0.2.4.0The following example shows how to associate an extended MPLS ATM interface and binds it to port 1622:
ATM(config)# interface XTagATM1622ATM(config-if)# extended-port atm0/0 vsi 0x00010614Related Commands
interface XTagATM
Enters interface configuration mode for an extended MPLS ATM (XTagATM) interface.
show controller vsi status
Displays a summary of each VSI-controlled interface.
import map
To configure an import route map for a Virtual Private Network (VPN) routing/forwarding instance (VRF), use the import map command in VRF configuration submode.
import map route-map
Syntax Description
Defaults
No import route map is configured for a VRF.
Command Modes
VRF configuration submode
Command History
Usage Guidelines
Use an import route map when an application requires finer control over the routes imported into a VRF than provided by the import and export extended communities configured for the importing and exporting VRF.
The import map command associates a route map with the specified VRF. You can use a route map to filter routes that are eligible for import into a VRF, based on the route target extended community attributes of the route. The route map might deny access to selected routes from a community that is on the import list.
The import map command does not replace the need for a route-target import in the VRF configuration. You use the import map command to further filter prefixes that match a route-target import statement in that VRF.
Examples
The following example shows how to configure an import route map for a VRF:
Router(config)# ip vrf vrf_blueRouter(config-vrf)# import map blue_import_mapRelated Commands
ip vrf
Configures a VRF routing table.
route-target
Creates a route-target extended community for a VRF.
show ip vrf
Displays the set of defined VRFs and associated interfaces.
index
To insert or modify a path entry at a specific index, use the index command in IP explicit path configuration mode. To remove the path entry at the specified index, use the no form of this command.
index index command
no index index
Syntax Description
Defaults
This command is disabled.
Command Modes
IP explicit path configuration
Command History
Examples
The following example shows how to insert the next address at index 6:
Router(cfg-ip-expl-path)# index 6 next-address 3.3.29.3Explicit Path identifier 6:6: next-address 3.3.29.3Related Commands
interface xtagatm
To create an extended Multiprotocol Label Switching (MPLS) ATM (XTagATM) interface, use the interface xtagatm command in global configuration mode.
interface xtagatm interface-number
Syntax Description
Defaults
XTagATM interfaces are not created.
Command Modes
Global configuration
Command History
12.0(5)T
This command was introduced.
12.2(4)T
This command was updated to reflect the MPLS IETF terminology.
Usage Guidelines
XTagATM interfaces are virtual interfaces that are created on reference-like tunnel interfaces. An XTagATM interface is created the first time the interface xtagatm command is issued for a particular interface number. These interfaces are similar to ATM interfaces, except that the former only supports LC-ATM encapsulation.
Examples
The following example shows how to create an XTagATM interface with interface number 62:
Router(config)# interface xtagatm62Related Commands
extended-port
Associates the currently selected extended XTagATM interface with a remotely controlled switch.
ip explicit-path
To enter the command mode for IP explicit paths and create or modify the specified path, use the ip explicit-path command in router configuration mode. An IP explicit path is a list of IP addresses, each representing a node or link in the explicit path. To disable this feature, use the no form of this command.
ip explicit-path {name word | identifier number} [enable | disable]
no explicit-path {name word | identifier number}
Syntax Description
Command Modes
Router configuration
Command History
Examples
The following example shows how to enter the explicit path command mode for IP explicit paths and creates a path numbered 500:
Router(config-router)# ip explicit-path identifier 500Router(config-ip-expl-path)#Related Commands
ip route static inter-vrf
To allow static routes to point to Virtual Private Network (VPN) routing/forwarding instance (VRF) interfaces in VRFs other than those to which the static route belongs, use the ip route static inter-vrf command in global configuration mode. To prevent static routes from pointing to VRF interfaces in VRFs to which they do not belong, use the no form of this command.
ip route static inter-vrf
no ip route static inter-vrf
Syntax Description
This command has no arguments or keywords.
Defaults
Static routes are allowed to point to VRF interfaces in any VRF.
Command Modes
Global configuration
Command History
12.0(23)S
This command was introduced.
12.2(13)T
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
The ip route static inter-vrf command is turned on by default. The no ip route static inter-vrf command causes the respective routing table (global or VRF) to reject the installation of static routes if the outgoing interface belongs to a different VRF than the static route being configured. This prevents security problems that can occur when static routes that point to a VRF interface in a different VRF are misconfigured. You are notified when a static route is rejected, then you can reconfigure it.
For example, a static route is defined on a provider edge (PE) router to forward Internet traffic to a customer on the interface pos1/0, as follows:
Router(config)# ip route 10.1.1.1 255.255.255.255 pos 1/0Mistakenly, the same route is configured with the next-hop as the VRF interface pos10/0:
Router(config)# ip route 10.1.1.1 255.255.255.255 pos 10/0By default, Cisco IOS accepts the command and starts forwarding the traffic to both pos1/0 (Internet) and pos10/0 (VPN) interfaces.
If the static route is already configured that points to a VRF other than the one to which the route belongs when you issue the no ip route static inter-vrf command, the offending route is uninstalled from the routing table and a message similar to the following is sent to the console:
01:00:06: %IPRT-3-STATICROUTESACROSSVRF: Un-installing static route x.x.x.x/32 from global routing table with outgoing interface intx/xIf you enter the no ip route static inter-vrf command before a static route is configured that points to a VRF interface in a different VRF, the static route is not installed in the routing table and a message is sent to the console.
In the following example, configuring the no ip route static inter-vrf command prevents traffic from following an unwanted path. A VRF static route points to a global interface or any other VRF interface as shown in the following ip route vrf commands:
•
Router(config)# no ip route static inter-vrfRouter(config)# ip route vrf vpn1 10.10.1.1 255.255.255.255 serial 1/0.0•
Router(config)# no ip route static inter-vrfRouter(config)# ip route vrf vpn1 10.10.1.1 255.255.255.255 serial 1/0.1With the no ip route static inter-vrf command configured, these static routes are not installed into the vpn1 routing table because the static routes point to an interface that is not in the same VRF.
If you require a VRF static route to point to a global interface, you can use the global keyword with the ip route vrf command:
Router(config)# ip route vrf vpn1 10.12.1.1 255.255.255.255 ser1/0.0 7.0.0.1 globalThe global keyword allows the VRF static route to point to a global interface even when the no ip route static inter-vrf command is configured.
Examples
The following example shows how to prevent static routes that point to VRF interfaces in a different VRF:
Router(config)# no ip route static inter-vrfRelated Commands
ip route vrf
To establish static routes for a Virtual private Network (VPN) routing/ forwarding instance (VRF), use the ip route vrf command in global configuration mode. To disable static routes, use the no form of this command.
ip route vrf vrf-name prefix mask [next-hop-address] [interface interface-number] [global] [distance] [permanent] [tag tag]
no ip route vrf vrf-name prefix mask [next-hop-address] [interface interface-number] [global] [distance] [permanent] [tag tag]
Syntax Description
Defaults
No static routes are established.
Command Modes
Global configuration
Command History
Usage Guidelines
Use a static route when the Cisco IOS software cannot dynamically build a route to the destination.
If you specify an administrative distance when you set up a route, you are flagging a static route that can be overridden by dynamic information. For example, Interior Gateway Routing Protocol (IGRP)-derived routes have a default administrative distance of 100. To set a static route to be overridden by an IGRP dynamic route, specify an administrative distance greater than 100. Static routes each have a default administrative distance of 1.
Static routes that point to an interface are advertised through the Routing Information Protocol (RIP), IGRP, and other dynamic routing protocols, regardless of whether the routes are redistributed into those routing protocols. That is, static routes configured by specifying an interface lose their static nature when installed into the routing table.
However, if you define a static route to an interface not defined in a network command, no dynamic routing protocols advertise the route unless a redistribute static command is specified for these protocols.
Examples
The following command shows how to reroute packets addressed to network 172.23.0.0 in VRF vpn3 to router 172.31.6.6:
Router(config)# ip route vrf vpn3 172.23.0.0 255.255.0.0 172.31.6.6Related Commands
ip vrf
To define a virtual private network (VPN) routing/forwarding (VRF) instance and to enter VRF configuration mode, use the ip vrf command in global configuration mode. To remove a VRF instance, use the no form of this command.
ip vrf vrf-name
no ip vrf vrf-name
Syntax Description
Defaults
No VRFs are defined. No import or export lists are associated with a VRF. No route maps are associated with a VRF.
Command Modes
Global configuration
Command History
Usage Guidelines
The ip vrf vrf-name command creates a VRF instance named vrf-name. To make the VRF functional, a route distinguisher must be created using the rd route-distinguisher command in VRF configuration mode. The rd route-distinguisher command creates the routing and forwarding tables and associates the route distinguisher (RD) with the VRF instance named vrf-name.
Examples
The following example shows how to import a route map to a VRF:
Router(config)# ip vrf vpn1Router(config-vrf)# rd 100:2Router(config-vrf)# route-target both 100:2Router(config-vrf)# route-target import 100:1Related Commands
ip vrf forwarding (interface configuration)
To associate a Virtual Private Network (VPN) routing/forwarding instance (VRF) with an interface or subinterface, use the ip vrf forwarding command in interface configuration mode. To disassociate a VRF, use the no form of this command.
ip vrf forwarding vrf-name [downstream vrf-name2]
no ip vrf forwarding vrf-name [downstream vrf-name2]
Syntax Description
Defaults
The default for an interface is the global routing table.
Command Modes
Interface configuration
Command History
Usage Guidelines
•
•
•
–
–
–
Forwarding Between X.25 Interfaces and Interfaces Configured for MPLS
This command enables IP forwarding between X.25 interfaces and interfaces configured for MPLS, which lets you connect customer premises equipment (CPE) devices to a provider edge (PE) router via an X.25 network by forwarding IP traffic between the CPE devices and the MPLS network. You must configure MPLS on the PE and provider routers in the network.
This command lets you perform an X.25 aggregation function on a PE router for several CPE devices with X.25 VCs into an MPLS network. The PE router performs the aggregation function of terminating X25 VCs and also performs the mapping function (in which VCs are mapped to the appropriate MPLS VRF domains).
Distributed CEF switching, CEF switching, and fast switching are not supported (only process switching is supported). Forwarding of IPv6 traffic is not supported.
Note
For additional references, see CCITT 1988 Recommendation X.25 (Interface Between Data Terminal Equipment (DTE) and Data Circuit-Terminating Equipment (DCE) for Terminals Operating in the Packet Mode and Connected to Public Data Networks by Dedicated Circuit), RFC 1356 (Multiprotocol Interconnect on X.25 and ISDN in the Packet Mode), and RFC 1461 (SNMP MIB extension for Multiprotocol Interconnect over X.25).
Examples
The following example shows how to link a VRF to ATM interface 0/0:
Router(config)# interface atm0/0Router(config-if)# ip vrf forwarding vpn1The following example associates the VRF named U with the virtual-template 1 interface and specifies the downstream VRF named D:
Router> enableRouter# configure terminalRouter(config)# interface virtual-template 1Router(config-if)# ip vrf forwarding U downstream DRouter(config-if)# ip unnumbered Loopback1Related Commands
ip route vrf
Establishes static routes for a VRF.
ip vrf
Configures a VRF routing table.
show ip vrf
Displays the set of defined VRF instances and associated interfaces.
ip vrf receive
To insert the IP address of an interface as a connected route entry in a Virtual Private Network (VPN) routing/forwarding instance (VRF) routing table, use the ip vrf receive command in interface configuration mode. To remove the connected entry from the VRF routing table, use the no form of this command.
ip vrf receive vrf-name
no ip vrf receive vrf-name
Syntax Description
Defaults
No default behavior or values
Command Modes
Interface configuration
Command History
12.0(22)S
This command was introduced.
12.3(7)T
This command was integrated into Cisco IOS Release 12.3(7)T.
Usage Guidelines
The ip vrf receive command supports VRF route selection for the following features:
•
•
This command is used to install a primary or secondary IP address of an interface as a connected route entry in the VRF routing table. These entries appear as "receive" entries in the Cisco Express Forwarding (CEF) table. MPLS VPNs require CEF switching to make IP destination prefix-based switching decisions. This command can be used to selectively install the interface IP address in the VRF that is specified with the vrf-name argument. Only the local interface IP address is added to the VRF routing table. This command is used on a per-VRF basis. In other words, you must enter this command for each VRF in which you need to insert the IP address of the interface. This command does not remove the interface IP address from the global routing table.
Note
VRF Selection Based on Source IP Address Guidelines
The ip vrf receive command is automatically disabled when the no ip vrf vrf-name command is entered for the local interface. An error message is displayed when the ip vrf receive command is disabled in this manner. Interfaces where the VRF Selection Based on Source IP Address feature is enabled can forward packets that have an IP address that corresponds to an IP address entry in the VRF table. If the VRF table does not contain a matching IP address, the packet is dropped, by default, because there is no corresponding "receive" entry in the VRF CEF entry.
VRF Selection Using Policy Based Routing Guidelines
You must enter the ip policy route-map command before the ip vrf receive command can be enabled. The ip vrf receive command is automatically disabled when either the no ip policy route-map map-name or the no ip vrf vrf-name command is entered for the local interface. An error message is displayed when the ip vrf receive command is disabled in this manner. With the VRF Selection Using Policy-Based Routing implementation of the VRF selection feature, a route map filters the VRF routes. If a match and set operation occurs in the route map but there is no receive entry in the local VRF table, the packet is dropped.
Examples
VRF Selection Based on Source IP Address
The following example shows how to configure Ethernet interface 0/2 (172.16.1.3) and insert its IP address in VRF_1 and VRF_2 with the ip vrf receive command. You must enter the ip vrf select source command on the interface or subinterface to enable VRF selection on the interface or subinterface. You must also enter the vrf selection source command in global configuration mode to populate the VRF selection table and to configure the VRF Selection Based on Source IP Address feature. (The vrf selection source command is not shown in this example.)
Router(config)# interface Ethernet0/2Router(config-if)# ip address 172.16.1.3 255.255.255.252Router(config-if)# ip vrf select sourceRouter(config-if)# ip vrf receive VRF_1Router(config-if)# ip vrf receive VRF_2Router(config-if)# endVRF Selection Using Policy-Based Routing
The following example shows how to configure Ethernet interface 0/1 (192.168.1.2) and insert its IP address in VRF_1 and VRF_2 with the ip vrf receive command. You must configure an access list and a route map to allow the VRF Section Using Policy-Based Routing feature to select a VRF. (The access list and route map configuration are not shown in this example.)
Router(config)# interface Ethernet0/1Router(config-if)# ip address 192.168.1.2 255.255.255.252Router(config-if)# ip policy route-map PBR-VRF-SELECTIONRouter(config-if)# ip vrf receive VRF_1Router(config-if)# ip vrf receive VRF_2Router(config-if)# endRelated Commands
ip vrf sitemap
To configure Site of Origin (SoO) filtering on an interface, use the ip vrf sitemap command in interface configuration mode. To disable SoO filtering on an interface, use the no form of this command.
ip vrf sitemap route-map
no ip vrf sitemap
Syntax Description
route-map
The name of the route map that is configured with the as-number and network of the VPN site.
Defaults
No default behavior or values
Command Modes
Interface configuration
Command History
Usage Guidelines
The SoO extended community is a BGP extended community attribute that is used to identify routes that have originated from a site so that the re-advertisement of that prefix back to the source site can be prevented. The SoO extended community uniquely identifies the site from which a PE router has learned a route.
Examples
The following example, beginning in global configuration mode, configures SoO filtering on an interface:
Router(config)# route-map Site-of-Origin permit 10Router(config-route-map)# set extcommunity soo 100:1Router(config-route-map)# exitRouter(config)# interface FastEthernet 0/0Router(config-if)# ip vrf forwarding REDRouter(config-if)# ip vrf sitemap Site-of-OriginRouter(config-if)# ip address 10.0.0.1 255.255.255.255Router(config-if)# endRelated Commands
list
To show all or part of the explicit path or paths, use the list command in IP explicit path configuration mode.
list [starting-index-number]
Syntax Description
starting-index-number
(Optional) Index number at which the explicit path(s) will start to be displayed. Valid values are from 1 to 65535.
Defaults
Explicit paths are not shown.
Command Modes
IP explicit path configuration
Command History
Examples
The following example shows how to list the explicit path:
Router(cfg-ip-expl-path)# listExplicit Path name Joe:1:next-address 10.0.0.12:next-address 10.0.0.2The following example shows how to list the explicit path starting at index number 2:
Router(cfg-ip-expl-path)# list 2Explicit Path name Joe:2:next-address 10.0.0.2Router(cfg-ip-expl-path)#Related Commands
